Confidential papers ended up in a street bin. Could it happen in your office?

What happened in Zagreb?

According to reports in Jutarnji list and Zagreb.info on 4 October 2026, a member of the public photographed bundles of paper sticking out of a full bin on Vlaška Street. They included personal information about nursery employees and a number of contracts belonging to the city's education office.

The City of Zagreb said its education office was told about the find on Wednesday 30 September. The documents were collected and stored securely, and an internal investigation began. The city explained that the paperwork was no longer needed and had been prepared for destruction in line with the rules, but a cleaning worker confused part of it with general waste and put it in a container for collection.

The city has sent a personal data breach report to Croatia's data protection authority and is informing the staff affected. The authority told Jutarnji list that no protective measures appear to have been taken, that the personal data was left unsupervised on a public street where anyone could read it, and that it will open a supervisory procedure once it has established who is responsible. It pointed to Article 32 of the GDPR, which deals with the security of processing.

These details are summarised from Croatian-language reports. Quotes have been paraphrased rather than translated word for word.

Why "ready for shredding" is not the same as "shredded"

Nobody in Zagreb set out to throw personal data away. The paper had already been sorted for destruction. The failure happened in the waiting period, when the pile looked like any other rubbish to someone who had not been told otherwise.

It is a pattern that shows up again and again. In March 2026, the Isle of Man Information Commissioner reprimanded Payroll Partners Limited after two full, unlocked shredding bins of payroll documents were left behind in an office the firm had vacated. Dip sampling of five boxes found more than 9,700 records, including names, salary information, immigration documents and photographs.

Closer to home, Fellowes analysed 846 paper disposal breaches reported to the UK ICO between 2019 and 2025. Health organisations accounted for 227 of them, and education and childcare for 185. In each case, paperwork with personal data was thrown away without being shredded or otherwise destroyed.

What does UK guidance expect for paper awaiting destruction?

The UK GDPR carries the same Article 32 security duty that the Croatian authority cited. The ICO's own audit checklists make the practical steps clear. We cover them in detail in our guide to what the ICO expects when you dispose of confidential waste, but the points most relevant to the Zagreb case are:

• Locked bins: records containing personal information should go into locked waste bins or consoles, not open bags or boxes.
• Secure storage while waiting: records awaiting destruction should be kept securely, for example in a locked area with restricted access, and checked on site walks.
• A disposal log: keep a record of confidential waste sent for destruction, and of what is still waiting and where.
• Proof: get a certificate of destruction for every collection and have a named person check it against your log.
• Breach reporting: if personal data is exposed, you must report it to the ICO within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people's rights and freedoms.

What this means for your business

If your team handles patient notes, staff files, safeguarding records or client paperwork, the Zagreb case is a useful prompt to look at the weakest link in your own process.

1. Remove the "to shred" pile altogether. Confidential paper should go directly into a locked console at the point it is no longer needed, so there is nothing for anyone to mistake for rubbish.
2. Brief cleaners and facilities staff. Contract and agency cleaners change often. Make sure they know which containers are confidential, and that they never empty or move them.
3. Plan moves, closures and archive clear-outs. The Isle of Man case started with an office closure. Book a one-off collection before the keys are handed back.
4. Keep the paper trail. Match each certificate of destruction to your disposal log, so you can show what left your control and when.

Nurseries, clinics, dental practices and care providers are the organisations most often caught out, but the same steps apply to any office that holds personal data on paper.

Frequently asked questions