What is a certificate of destruction, and how should your business keep one?

What is a certificate of destruction?

When you hand confidential material to someone else to destroy, you lose sight of it the moment the bin, sack or crate leaves the building. A certificate of destruction closes that gap. It is a document, usually issued electronically, that confirms a specific collection was received and securely destroyed.

You may see it called a destruction certificate, a proof of destruction or a note of secure destruction. The name matters less than the content. What you want is a record you can match to a particular collection from a particular site on a particular day.

It applies to more than paper. The same idea covers hard drives, laptops and other media, and branded stock or uniforms that you do not want resold or reused.

Why does your business need one?

UK GDPR expects you to show your working

Under UK GDPR you are responsible for keeping personal data secure, and you must be able to demonstrate how you do it. Disposal is part of that. The ICO's disposal and deletion toolkit says organisations using a third party should have contracts that give appropriate assurance of secure disposal, for example through audit checks and destruction certificates. It also suggests that a member of staff checks that certificates match what was sent for destruction.

Without evidence of disposal, the ICO warns that personal information may not be secure during disposal, or may not be disposed of at all.

It belongs in your supplier arrangements

If a provider destroys personal data for you, it is acting on your behalf. The ICO explains what a contract with a processor needs to include, such as security measures and the information you need to show compliance. Asking for a certificate for every job is a simple, practical way to get that information.

It helps when someone asks questions later

Auditors, clients, insurers and your own management may ask how you handle confidential waste. A certificate per collection, filed in one place, lets you answer quickly and specifically rather than relying on memory.

What should a certificate of destruction contain?

There is no single legal template, but a useful certificate lets you answer five questions: what, how much, from where, when and by whom. Look for:

• Your organisation and site. The name and the address the material was collected from.
• Date of collection and date of destruction. These can be different, and both are useful.
• What was destroyed. For example confidential paper, hard drives, laptops, mixed media or branded stock.
• Quantity. Number of consoles or sacks, weight, or a count of items. For IT equipment, serial numbers or asset tags where they were recorded.
• Method. For example shredding, or physical destruction of drives.
• A unique reference. So you can tie the certificate to a booking, a collection note and your own log.
• Confirmation of destruction. A clear statement that the material listed has been securely destroyed.
• Who issued it. The provider's name and contact details.

If a certificate you receive is vague, for example "assorted waste" with no quantity or date, ask for more detail before you file it.

How we handle it

For confidential waste collections, we issue an electronic note of secure destruction the working day after collection. It details the quantity and type of waste collected and confirms it has been securely destroyed. For IT and media, we provide chain of custody and destruction documentation, so you have an audit trail for your records. You can read more on our confidential waste disposal and IT and media recycling pages.

How should you keep your records?

Keep a disposal log

The ICO expects a log of equipment and confidential waste sent for disposal or destruction, and a log of records and devices awaiting destruction and where they are. A spreadsheet is enough for most offices. Record the date, the type and quantity of material, the site, who authorised it and the collection reference.

Match every certificate to the log

When the certificate arrives, check it against your log entry. Does the quantity agree? Is the date right? Is anything missing? Note the certificate reference next to the log entry and the name of the person who checked it.

Store certificates in one dedicated place

The ICO suggests keeping electronic confirmations of destruction in a dedicated folder or email inbox. Pick one location, restrict who can edit it, and name files consistently, for example by date and site.

Decide how long to keep them

UK GDPR's storage limitation principle applies to the personal data itself, but your certificates are business records too. Set a retention period for them in your retention schedule, based on how long you might need to evidence disposal, and review it alongside your other records.

Approve destruction before it happens

The ICO's records management and security toolkit and its disposal guidance both point to destroying records in line with a retention schedule, with management approval logged before destruction. The certificate then becomes the final step in a chain that starts with a decision you can point to.

Common gaps to watch for

• Certificates arriving by email and sitting in one person's inbox.
• One certificate covering several sites, with no way to tell which material came from where.
• IT equipment listed only as "laptops x 20" when you need serial numbers to close off your asset register.
• No one checking that the certificate matches what actually left the building.

Each of these is easy to fix with a named owner and a monthly ten-minute check.

For a wider look at what the ICO expects across paper and devices, see our ICO confidential waste disposal guide. If you are reviewing who destroys your waste, our piece on choosing third-party suppliers covers the checks worth making.

Frequently asked questions