Most businesses are careful with data on computers and surprisingly casual with the same data on paper. But under UK GDPR there is no difference: a payroll printout in a bin bag is a data breach waiting to happen, and your business remains legally responsible for it right up to the moment it’s securely destroyed. Here’s what that means in practice — in plain English, not legalese.
What actually counts as confidential waste
The test is simple: would it matter in the wrong hands? That covers far more than most businesses realise: HR and payroll records, job applications and CVs, invoices and bank statements, customer and supplier lists, quotes and pricing, medical and care notes, legal correspondence, signed contracts, pupil and student records, delivery notes with addresses, expired ID documents, and old diaries and notebooks full of names and numbers. If any of that is going into ordinary recycling, your confidential waste is leaving the building readable.
You can’t keep it forever either
GDPR cuts both ways: you must protect records while you need them, and you must not keep them longer than you need. Common retention periods — six years for most financial and tax records, longer for some HR and medical categories — mean every business accumulates archives that eventually must be destroyed. That end-of-retention purge is exactly when documents are most at risk: decades of client files heading for a skip because nobody wanted to feed ten thousand sheets through an office shredder.
Why the office shredder isn’t the answer
For a handful of letters, fine. For anything more: a strip-cut shredder is slow, jams on volume, staples kill it, and the strips can be reassembled — reconstruction of strip-cut documents is a solved problem. More importantly for compliance, it produces no evidence. GDPR’s accountability principle means being able to demonstrate compliant disposal, and “someone shredded it at some point, probably” demonstrates nothing.
What professional shredding gives you
Volume handled in minutes rather than days; destruction beyond reconstruction; a certificate of destruction stating what was destroyed, when and how — the paperwork your auditors, insurers and clients increasingly ask for; and 100% of the shredded paper recycled. Documents are collected in sealed containers — counted and documented before they leave your site — and shredded at a licensed facility. One-off archive clearances and scheduled collections both exist for a reason: some businesses purge once a decade, others generate confidential paper every day.
Don’t forget the drives
The filing cabinet is only half the risk. Old hard drives, backup tapes, USB sticks and retired laptops carry the same obligations with far more data per item. If you’re clearing an archive room, clear the IT cupboard in the same job — our certified data destruction service covers drives and media with the same certificate and serial-number audit trail, and free IT recycling collection handles the rest of the equipment.
The practical next step
Walk your office and count: filing cabinets past their retention date, archive boxes nobody has opened in years, the drawer of old paperwork everyone ignores. Then get a fixed quote for clearing it in one documented job — our confidential waste shredding service covers Nottingham, Derby, Long Eaton and Mansfield, one-off or scheduled, with a certificate every time.
Quick answers
What counts as confidential waste?
Anything carrying personal or commercially sensitive information: HR files, payroll, invoices, customer lists, medical and legal records, signed contracts and expired ID documents.
Is an office shredder GDPR compliant?
It can destroy documents, but it gives you no certificate, no audit trail, and strip-cut shreds can be reassembled. Professional shredding provides the documented evidence UK GDPR accountability requires.
What is a certificate of destruction?
A document stating what was destroyed, when, and by what method — your evidence of compliant disposal if a regulator, auditor or client ever asks.