Confidential Waste: Do You Legally Have to Shred Business Documents?

Strictly speaking, no UK law says “thou shalt shred.” But before you tip that filing cabinet into the recycling bin — the law absolutely does require you to destroy personal data securely, and for paper documents, shredding (or professional confidential destruction) is the only realistic way to prove you’ve done it.

Here’s what the rules actually say, what counts as confidential waste, and how to dispose of it without a data breach on your hands.

What the Law Actually Requires

Two pieces of legislation do the heavy lifting:

UK GDPR and the Data Protection Act 2018. Any document containing personal data — names, addresses, phone numbers, financial details, anything identifying a living person — must be kept secure throughout its life, including disposal. The moment you no longer need it, you’re required to erase or destroy it in a way that means it can’t be reconstructed or accessed. Throwing intact documents in a bin, skip or open recycling container fails that test the moment the bin leaves your control.

Duty of Care (Environmental Protection Act 1990). Separately, all business waste — confidential or not — must be handled by licensed waste carriers with proper documentation.

So while “shredding” isn’t named in statute, secure destruction of personal data is a legal obligation, and the ICO can (and does) fine businesses whose documents turn up intact where they shouldn’t. Data protection fines can reach into the millions for serious breaches — and even a small incident means mandatory breach reporting, reputational damage and awkward conversations with affected customers.

What Counts as Confidential Waste?

More than you’d think. If it identifies a person or exposes your business, treat it as confidential:

• Customer records — invoices, order details, contact lists, complaints
• Staff paperwork — payslips, HR files, timesheets, CVs and job applications (including from people you didn’t hire)
• Financial documents — bank statements, card receipts, supplier accounts
• Medical or sensitive records — for salons, clinics, care settings
• Business-sensitive material — contracts, pricing, quotes, strategy documents
• Anything with a signature, address or account number — including envelopes and delivery labels

Rule of thumb: if you’d be uncomfortable with a stranger reading it, it doesn’t go in the ordinary bin.

How Long Should You Keep Documents First?

Don’t shred too early. Common retention periods:

• Tax and accounting records — 6 years (HMRC requirement for companies)
• Payroll records — typically 6 years
• Employee records — commonly 6 years after employment ends
• Unsuccessful job applicants — usually 6–12 months
• Contracts — 6 years after expiry (12 for deeds)

GDPR cuts the other way too: you shouldn’t keep personal data longer than needed. A simple retention schedule — what you keep, for how long, and when it gets destroyed — ticks both boxes and is exactly the kind of document the ICO likes to see.

Your Disposal Options

1. Office shredder. Fine for small volumes, but slow, and basic strip-cut shredders don’t meet modern security expectations — cross-cut (P-4 or above under DIN 66399) is the standard for personal data. Someone still has to feed it, empty it, and the shredded paper still needs a proper waste route.

2. Professional confidential waste collection. Lockable consoles or sacks on your premises, collected by a licensed carrier, destroyed at a secure facility, and — the crucial bit — a Certificate of Destruction issued for your records. That certificate is your evidence of GDPR-compliant disposal. The destroyed paper is then baled and recycled, so it satisfies your recycling obligations too.

3. One-off purges. Office moves, closures and archive clear-outs often surface years of boxed paperwork at once. This needs a bulk confidential collection — not a skip. Documents in an open skip on the street are a data breach waiting to happen, however briefly they sit there.

For anything beyond occasional small volumes, option 2 is the safe answer: it’s auditable, it’s hands-off, and it scales from one sack a month to a full archive clearance.

Common Mistakes That Count as Breaches

• Putting intact documents in mixed recycling (“it’s getting pulped anyway” — not before several strangers have had access to it)
• Leaving confidential waste bags beside general bins overnight
• Reusing printed paper as scrap/note paper with customer data on the back
• Skipping old filing cabinets with the files still inside during a clear-out
• Assuming digital is different — old hard drives, USB sticks and backup tapes also need certified destruction, not the WEEE bin

Getting It Sorted

The fix is straightforward: a lockable console in the office, a scheduled collection, and a certificate in your compliance file. Select A Skip can arrange secure confidential waste collections as part of a wider commercial waste management package — one provider covering your confidential, recycling and general waste streams, with waste reporting keeping the documentation in one place. Clearing an office or archive? Talk to us before you book the skip and we’ll make sure the paperwork stream is handled securely alongside the skip hire.

Get in touch for a no-obligation quote — we reply the same working day.

---

This article is general guidance, not legal advice. For specific data protection questions, the ICO’s website is the authoritative source.