Every business builds up old data: customer files, staff records, invoices, emails and backups on drives nobody uses anymore. UK GDPR doesn’t let you keep personal information indefinitely, and it doesn’t let you throw it away carelessly either. GDPR data destruction means permanently destroying data you no longer need, so nobody can recover it, and keeping evidence that you did. Here’s what private sector companies need to do.

What UK GDPR Says About Old Data

Two principles matter most. Storage limitation means you can keep personal data only as long as you need it for the purpose you collected it for. The law sets no fixed time limits, so you must justify your own. Security means you must protect that data from loss or misuse until the moment it’s destroyed.

The Data (Use and Access) Act 2025 amended UK GDPR, and most of its changes have been in force since February 2026. Both of these core duties still apply. See the ICO’s guidance on the storage limitation principle.

Step 1: Set Retention Periods and Find Every Copy

Start with a retention schedule. It lists each type of data you hold, how long you keep it and why. Some periods are fixed by tax or employment law, and our guide on how long UK businesses should keep records covers common examples. Once data passes its retention date, destroy or anonymise it.

Before destroying anything, track down every copy. Personal information often sits in archive boxes, old laptops, servers, USB sticks, phones, backups and supplier systems. If one copy survives, the data hasn’t really been destroyed.

Step 2: Match the Destruction Method to the Media

Good data security destruction depends on the format:

• Paper: cross-cut shredding to a recognised standard, followed by recycling
• Hard drives and SSDs: physical shredding, so recovery is impossible
• Phones, USB sticks and discs: destruction of the memory chip or disc itself

Deleting files or formatting a drive leaves data that recovery software can often restore. The only reliable option is to physically destroy the media. See hard drive shredding vs wiping to find out why.

GDPR Hard Drive Destruction

A single old laptop can hold years of customer records, HR files and emails, which is why hard drive destruction & data security go hand in hand. For GDPR hard drive destruction, shredding gives the strongest assurance. Ask for each drive’s serial number on your certificate, so every device can be matched to your asset register. Our hard drive destruction service does this as standard.

Step 3: Choose and Manage Your Provider

When you use data destruction services, the provider acts as your data processor, but you remain responsible for the data until it’s destroyed. Put a written contract in place, check the provider’s standards and staff vetting, and make sure the data stays secure during collection and transport. Our guide to GDPR shredding requirements and certifications explains which standards to look for.

Step 4: Keep Records That Prove Compliance

Under the accountability principle, you must be able to show you complied. Keep your retention schedule, a destruction log, a Certificate of Destruction for every job, and Waste Transfer Notes for disposed equipment. If the ICO asks questions, these records are your evidence.

Private Sector Data Destruction: Common Mistakes

Private sector data destruction tends to fail in the same places: storing old devices “just in case”, putting confidential paper in general waste, selling laptops without destroying the drives, and forgetting about backups. Public bodies have extra duties, which we cover in our guide to public sector data destruction.

Data Destruction Services From Total Shred

Total Shred provides secure data destruction services for businesses across London and the UK. We physically destroy paper, hard drives and other media on-site or off-site. We work to BS EN 15713, ISO 9001 and ISO 14001 standards, our staff are vetted to BS 7858, and every job comes with a Certificate of Destruction. Find out more about our commercial shredding services.

Frequently Asked Questions

What is GDPR data destruction?

It’s the secure, permanent destruction of personal information you no longer need, in line with UK GDPR. It covers paper, hard drives and other devices, backed by a record of destruction.

Does UK GDPR set how long I can keep data?

No. You decide how long to keep each type of data, based on why you need it, and you must be able to justify that decision.

Who is responsible if a contractor mishandles our data?

You remain responsible as the data controller. That’s why you should use trusted data destruction services, with a written contract and a Certificate of Destruction for every job.

What about erasure requests?

People can ask you to erase their personal data, and in most cases you must respond within one month. If copies exist on paper or old devices, those need secure destruction too.

Book Secure Data Destruction Today

Call 0800 298 4009, email shred@total-shred.com or contact us online for a tailored quote.