UK GDPR does not name a shredding method, but it does require you to keep personal data secure until it is destroyed. In practice, that means using a company with recognised shredding certifications, such as BS EN 15713 and ISO 27001, and keeping a certificate of destruction for every collection. Those records are your proof if the ICO or an auditor ever asks.

This guide explains what UK GDPR expects when you destroy paper files and hard drives, which certifications matter, and how to keep records that stand up to an audit. For the wider picture, see our guide to GDPR and data protection.

What UK GDPR Says About Shredding

In the UK, data protection is covered by the UK GDPR and the Data Protection Act 2018. The Information Commissioner’s Office (ICO) enforces both. Since Brexit, the EU GDPR no longer applies directly, but the rules are very similar.

The Rules That Apply to Destroying Data

• Keep it secure. Personal data must be protected from loss, theft or misuse at every stage, including disposal. The ICO’s security guidance covers this.
• Don’t keep it too long. Once a record passes its retention period, it should be destroyed securely.
• Be able to prove it. You must show how you comply. Certificates of destruction and contracts are that proof.
• Have a contract with your shredder. A shredding company that handles your data is a processor, so UK GDPR requires a written contract with it.

Paper counts just as much as digital data. Payslips, HR files, customer forms and medical notes all hold personal data, and all must be destroyed properly.

Shredding Certifications to Look For

A shredding certification shows that an independent body has checked how a company collects, stores and destroys your material. Choosing a certified provider is the simplest way to show you picked your shredder with care, which UK GDPR expects.

The Main UK Shredding Standards

• BS EN 15713:2023. The code of practice for the secure destruction of confidential and sensitive material. It covers collection, storage, transport, destruction and certification, and was updated in 2023.
• ISO 27001. Shows the company manages information security properly across its whole business.
• ISO 9001. Shows the company follows a consistent, checked process every time.
• ISO 14001. Shows shredded material is recycled and handled responsibly.
• Waste carrier licence. A legal must for anyone moving your waste. You can check it on the Environment Agency public register.

You may also see NAID AAA, which is a US-led scheme. In the UK, BS EN 15713 is the standard most buyers ask for.

Certification vs Certificate of Destruction

These are two different things. A certification is about the shredding company and how it works. A certificate of destruction is about your job: the date, what was destroyed, how, and the weight or drive serial numbers.

You need both. The certification shows you chose the right provider. The certificate shows your data was actually destroyed.

Why Use a Certified Shredding Company?

• Vetted, trained staff handle your documents
• Locked consoles and sealed bags keep paper safe before collection
• Tracked vehicles and a clear chain of custody
• A certificate of destruction after every job
• Shredded paper is recycled, not sent to landfill

Our commercial shredding service includes all of these as standard.

How to Stay Compliant When You Shred

Good shredding is not just the shredding itself. It is everything from the moment a document is no longer needed to the moment you file the certificate.

Five Steps to GDPR-Compliant Shredding

1. Know what you hold. List where personal data is kept, on paper and on devices.
2. Set retention periods. Decide how long each type of record is kept, then stick to it.
3. Store waste paper securely. Use locked consoles, not open bins, boxes or bags.
4. Use a certified provider under contract. Check their certifications and sign a processor contract.
5. Keep the paperwork. File every certificate of destruction and waste transfer note so you can show them on request.

The same steps apply to old laptops and servers. Our guide to e-waste disposal and hard drive shredding explains how to handle IT equipment.

Best Practices for Secure Data Destruction

The aim of secure destruction is simple: nobody should be able to read or rebuild your data afterwards. How you get there depends on what you are destroying.

Choose the Right Shredding Method

• Strip-cut. Cuts paper into long strips that can be pieced back together. Not suitable for personal data.
• Cross-cut. Cuts paper into small particles. The usual choice for business documents.
• Micro-cut. Cuts paper into very fine particles for highly sensitive material.
• Hard drives and SSDs. Need physical shredding. Our hard drive destruction service shreds every drive and records each serial number.

Wiping a drive is not always enough, as our guide to hard drive shredding vs wiping explains. Breaking drives by hand is risky too, as covered in our post on DIY hard drive destruction risks.

Secure Storage and Collection

Many paper data breaches happen before anything reaches a shredder. Documents left in open bins, skips or unlocked rooms can be picked up by anyone.

Keep confidential waste in locked consoles until collection. Make sure it is carried by vetted staff, in sealed bags, in a tracked vehicle, and shredded on-site or at a secure facility. Every handover should be recorded, so you can follow your data from your office to the shredder.

What Happens If You Don’t Comply

The ICO can take action against any business that fails to keep personal data safe, including when it is thrown away. Small businesses are not exempt.

UK GDPR Fines and a Real Example

Under ICO fining rules, the most serious breaches can cost up to £17.5 million or 4% of worldwide annual turnover, whichever is higher. Other breaches can cost up to £8.7 million or 2%. The ICO can also issue reprimands and enforcement notices.

The first ever UK GDPR fine was about paper records. In 2019, the ICO fined London pharmacy Doorstep Dispensaree £275,000 for leaving documents with personal and medical data in unlocked crates in a yard. The fine was cut to £92,000 on appeal, but the finding against the pharmacy was upheld.

The fine is often not the biggest cost. Customers and partners lose trust quickly when their data is mishandled.

Need Certified Shredding You Can Prove?

Total Shred provides secure document shredding and hard drive destruction for businesses across London and the South East. You get a certificate of destruction after every job, ready for your audit file.

Get a quote or call 0800 298 4009.

Frequently Asked Questions

Does UK GDPR require documents to be shredded?

UK GDPR does not name a method, but it requires personal data to be destroyed securely. Shredding with a certificate of destruction is the most common way to show you did this.

What is the main shredding standard in the UK?

BS EN 15713:2023 is the main code of practice for secure destruction of confidential material. Many providers also hold ISO 27001, ISO 9001 and ISO 14001.

What is a certificate of destruction?

It is a record from your shredding company confirming what was destroyed, when and how. For hard drives, it should list each serial number.

How long should I keep certificates of destruction?

There is no fixed legal period. Keep them for as long as you may need to show what happened to the data, and set this in your retention schedule.

Is the shredding company responsible if something goes wrong?

Both of you can be. You must choose a reliable provider and have a contract with it. The provider must follow your instructions and keep your data secure.

What is the maximum UK GDPR fine?

Up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for the most serious breaches.