What does the ICO expect when you dispose of confidential waste?

How should you dispose of confidential paper records?

Put paper records containing personal information into locked waste bins or consoles, then have them destroyed by cross-cut shredding or incineration, either in-house or through a third party. The ICO also expects you to document your disposal methods and to store records awaiting destruction securely, for example in a locked area with restricted access.

The ICO's records management and security checklist says that for paper documents you should use locked waste bins for records containing personal information, with in-house or third-party cross shredding or incineration in place. Its disposal and deletion checklist gives cross-cut or micro-cut shredding as examples of secure methods, and suggests checking areas holding records awaiting destruction on site walks.

If you shred on site, Fellowes notes that for most personal data a cross-cut or micro-cut shredder at DIN 66399 security level P-4 or above is appropriate. For regular volumes, our confidential waste disposal service covers locked consoles and scheduled collections, and our one-off shredding service suits an archive clear-out.

Do you need a certificate of destruction?

If a third party disposes of personal information for you, you need evidence that it was destroyed. The ICO expects contracts that give you appropriate assurance of secure disposal, for example through audit checks and destruction certificates, and suggests assigning a staff member to check that certificates match what you sent for destruction.

The ICO's disposal and deletion checklist also expects contracts with disposal providers to be signed by an appropriate senior manager and to include security measures, accountability and your right to audit the provider. Without evidence of disposal, it warns, personal information may not be secure during disposal or may not be disposed of at all, which may breach UK GDPR article 5(2).

Every collection comes with an electronic note of secure destruction for your records. The ICO suggests storing electronic confirmations of destruction in a dedicated folder or email inbox.

Why should you keep a disposal log?

A disposal log shows what left your control, when and where it went. The ICO expects a log of all equipment and confidential waste sent for disposal or destruction, plus a log of records and devices awaiting destruction and their location. Matching that log against your certificates of destruction gives you a clear evidence trail.

The ICO also expects you to destroy records in line with a retention schedule, and to obtain and log management approval before destroying them. If records are not destroyed in line with the schedule, it says you should report the failure as an incident and take appropriate action.

How should you dispose of old laptops and other devices?

Use a secure method such as device wiping, degaussing or hardware shredding, and document it. Until collection, the ICO expects devices awaiting destruction to be stored securely, for example in a locked area with restricted access, with a log of every device awaiting destruction and its location.

The ICO also suggests keeping an access log showing who has accessed devices awaiting destruction, checking those areas on site walks, and using a third-party secure hardware destruction provider. If personal information on electronic devices is not destroyed securely, it warns, the information may be recoverable.

Our IT and media recycling service collects laptops, PCs, hard drives and other IT equipment for secure destruction. If you are also replacing branded uniforms or PPE, ask about our uniform disposal service at the same time.

Which organisations report the most paper disposal breaches?

Health organisations top the list. Fellowes analysed ICO data on 846 paper disposal breaches reported by UK organisations between 2019 and 2025. Health accounted for 227 (26.83%), followed by education and childcare with 185 (21.87%), local government with 69, social care with 67 and charitable and voluntary organisations with 62.

Together, those five sectors account for more than 72% of all reported incidents. The analysis describes the breaches as paperwork containing personal data being disposed of without being shredded or otherwise destroyed, leaving personal information identifiable.

How quickly must you report a confidential waste breach?

Under Article 33 of the UK GDPR, organisations are required to report personal data breaches to the ICO within 72 hours of becoming aware of them. Yet in the Fellowes analysis, more than a third of paper disposal breaches were reported late: 208 between 72 hours and one week, and 103 after more than a week.

In total, 63.24% of incidents in the dataset were reported within the 72 hour window. The analysis notes that delayed reporting can complicate the response for affected individuals and may indicate that internal detection or escalation procedures are not operating effectively. Fellowes recommends a clear, written disposal policy communicated to all staff who handle such records, backed by staff training.

What should a confidential waste disposal checklist include?

Use this short checklist to review how your practice, nursery, care service or charity handles confidential paper and old devices. Each point maps to an expectation in the ICO's records management and disposal checklists, so it also works as a quick way to spot gaps before an audit or inspection.

• Locked confidential waste bins or consoles wherever personal information is handled.
• Cross-cut or micro-cut shredding, or incineration, set out in your disposal policy.
• A retention schedule, with management approval logged before records are destroyed.
• A disposal log of all equipment and confidential waste sent for destruction.
• Old devices wiped, degaussed or physically destroyed, with the method recorded.
• Secure, restricted-access storage for paper and devices awaiting collection, plus a log of what is stored and where.
• A contract with your disposal provider covering security measures, accountability and your right to audit.
• A certificate of destruction for every collection, checked against your log by a named staff member.
• A breach process that lets you report to the ICO within 72 hours of becoming aware of a breach.

What else do organisations ask about ICO disposal rules?

Here are short answers to common questions about disposing of confidential waste. One point to note first: the ICO says that, due to changes made by the Data (Use and Access) Act, its audit guidance is under review and may be subject to change, so check the current version before you update your own policy.