GDPR paper disposal: a guide for small offices

What counts as personal data on paper?

The ICO explains that personal data is information relating to an identified or identifiable living individual. UK GDPR covers personal data held in paper records that form part of, or are intended to form part of, a filing system, as well as data processed electronically. In a small office that commonly includes:

• staff records, contracts, payslips and sickness notes
• CVs and interview notes
• customer and client files, letters and order forms
• invoices and delivery notes with names and addresses
• signed forms, visitor books and accident books
• printed emails and spreadsheets
• handwritten notes and sticky notes with names, numbers or account details

Some of this is more sensitive than the rest. Health information in sickness notes, for example, is special category data and deserves extra care. The safest habit is simple: if in doubt, treat it as confidential.

How long should you keep paper records?

UK GDPR's storage limitation principle says you must not keep personal data for longer than you need it. The ICO says you should be able to justify how long you keep it, and that a policy setting standard retention periods is good practice where possible.

For a small office this does not need to be complicated:

1. List your main record types. Staff files, payroll, client files, accounts and so on.
2. Set a period for each. Some periods come from other laws or professional rules, so check with your accountant, adviser or professional body.
3. Write it down. A one-page retention schedule is fine.
4. Review on a set date. Once or twice a year, pull out what has passed its date and send it for destruction.

Keeping everything "just in case" is not a safe default. The more you keep, the more there is to lose.

How should you store paper before it is collected?

Paper waiting to be destroyed is still personal data. The ICO's guide to data security expects appropriate security measures, and its disposal and deletion toolkit expects records awaiting destruction to be stored securely, with a log of what is waiting and where.

Use lockable consoles, not open boxes

Lockable consoles with a posting slot let staff dispose of paper as they go, without anyone being able to reach back in. Place them where paper is generated: near printers, in HR and finance areas, and by desks that handle client files.

Keep sacks and boxes locked away

If you are clearing a large archive, keep filled sacks or boxes in a locked room or cupboard until collection. Do not leave them in corridors, reception or by the back door.

Never mix with general recycling

Confidential paper should never go in general waste or standard paper recycling. Our post on confidential paper binned by mistake shows how quickly "ready for shredding" can turn into a problem.

Make it easy for staff

A short note by each console, a line in your induction and a reminder after any office move go a long way. Tell people what goes in, what does not, and who to ask.

What are your shredding options?

Desk shredders

A small office shredder can work for the odd sheet, but it is slow for larger volumes and easy to put off. Choose a cross-cut model rather than strip-cut, empty it often, and remember the waste still needs disposing of.

Regular collections

If you produce confidential paper every week, a scheduled service with lockable consoles is usually the least effort. Our confidential waste disposal service securely transports your documents to a secure warehouse facility, where they are shredded and handled by fully vetted staff, and we issue an electronic note of secure destruction for every job.

One-off clear-outs

If you are clearing an archive, moving office or catching up after a retention review, a single collection may suit you better. See our one-off shredding service.

Whichever route you choose, keep the record of each collection with your disposal log. Our certificate of destruction guide explains what to check.

What if something goes wrong?

If personal data on paper is lost, stolen or binned by mistake, act quickly. Work out what was involved and whose data it was. The ICO explains when you must report a breach. Where reporting is required, it must be done within 72 hours of becoming aware of it. Keep a record of what happened even if you decide it does not need reporting.

A quick small office checklist

• Identify where personal data on paper is created and kept.
• Write a one-page retention schedule and review it regularly.
• Put lockable consoles where paper is generated.
• Store sacks and archives securely until collection.
• Keep confidential paper out of general recycling.
• Keep a log of what was sent for destruction and the paperwork you got back.
• Know who to call if something goes missing.

For more detail on ICO expectations, read our ICO confidential waste disposal guide.

Frequently asked questions