Data Privacy Day: Why Secure Document Disposal Still Matters in the UK

It’s 28 January, which means it’s Data Privacy Day. You’ll see plenty of articles today about cyber security, password hygiene, and the latest phishing scams. All important stuff. But there’s another side to data protection that rarely gets the attention it deserves: what happens to your paperwork when you’re done with it.

We run a shredding company. We collect confidential documents from businesses and homes across Suffolk, East Anglia, and London, and we destroy them properly. And we can tell you from experience, paper is still everywhere. Despite all the talk of going digital, most organisations are sitting on years’ worth of sensitive documents. Old personnel files. Customer records from accounts that closed a decade ago. Financial paperwork that nobody’s looked at since it was filed.

The problem isn’t that this stuff exists. The problem is what happens when it needs to go.

A quick word on what Data Privacy Day actually is

Data Privacy Day marks the anniversary of Convention 108, signed back in 1981, the first international treaty on data protection. In the UK, the day ties in with the UK GDPR and the Data Protection Act 2018.

The idea is to get people thinking about how personal data is handled. Not just collected and stored, but shared, used, and crucially disposed of. That last bit tends to get forgotten.

Most data breaches aren’t sophisticated attacks

When you hear “data breach” you probably picture hackers in dark rooms. The reality is usually much more mundane.

Look at the ICO’s own figures. In 2023, three-quarters of the data breaches reported to them were classified as non-cyber incidents. That means no hackers. No malware. Just human error: emails sent to the wrong person, documents left on trains, paperwork chucked in the bin without a second thought.

The ICO says it plainly: human error is the leading cause of reported data breaches. Not ransomware. Not state-sponsored attacks. People making mistakes with paperwork.

A bank statement in a bin bag. An old client file left out for the recycling. Staff records dumped when an office moves. None of it malicious, but all of it potentially serious.

What the law actually requires

The UK GDPR doesn’t distinguish between digital and physical data. If you’re holding personal information on paper, you’ve got the same obligations as you would for a database.

That means keeping it secure. And when you no longer need it, destroying it properly, not just binning it. The Information Commissioner’s Office can and does take action against organisations that get this wrong. Fines are possible. Reputational damage is almost guaranteed.

You might have the best IT security in your sector. Firewalls, encryption, two-factor authentication on everything. But if your confidential waste goes out with the regular rubbish, you’ve got a gap that none of that technology will cover.

What we see in practice

We work with all sorts of organisations like accountants, solicitors, medical practices, schools, care homes, manufacturers, retailers. The story is often the same.

Someone gets in touch because they’ve got a backlog. Filing cabinets nobody’s opened in years. Archive boxes stacked in a storage unit. A whole room that’s become the dumping ground for anything with a name on it.

Sometimes it’s prompted by an office move or a retirement. Sometimes by a near-miss like a member of staff spots something they shouldn’t have been able to see, or a client asks an awkward question. Sometimes it’s just a new manager who takes one look at the situation and decides enough is enough.

The confidential shredding itself is straightforward. We collect it, we destroy it, we give you a Certificate of Destruction to prove it’s been done. What takes longer is usually the decision to actually deal with it.

The home working question

Something else worth thinking about: where does your staff’s paperwork go?

Hybrid working is normal now. People print things at home. They make notes. They receive post. And when they’re done with it? Domestic shredders are slow and most people give up after the first few sheets. The kitchen bin is right there.

If your team handles anything sensitive (and most do, even if it’s just their own HR correspondence), it’s worth having a conversation about what happens to paper at home. We offer a home shredding service that covers exactly this, but even if you don’t use us, the question is worth asking.

Doing something about it

Data Privacy Day comes round once a year. It’s as good a prompt as any to take stock.

Have a look at your confidential waste arrangements. Are they actually being followed? Does everyone know what counts as confidential? Where do documents go when they’re finished with?

If you’ve got a backlog, now’s the time to deal with it. We can arrange a one-off collection or set up a regular service so it doesn’t build up again. If you want to watch the shredding happen yourself, we do on-site mobile shredding too.

We cover Suffolk, the rest of East Anglia, and London. Get in touch if you’d like to talk through what you need. There’s no hard sell, just a conversation about what would work for your situation.

Paperwork isn’t glamorous. Shredding certainly isn’t. But getting it right is one of the simplest things you can do to protect your business and the people whose data you hold. That’s worth remembering, today and the rest of the year.

Contact Shredsec to discuss your shredding requirements.