The Data Use and Access Act 2025 highlights why secure document shredding still matters for UK organisations

What the Data Use and Access Act 2025 Means for Secure Document Shredding

The Data Use and Access Act 2025 (DUAA) received Royal Assent on 19 June 2025, introducing amendments to the UK’s data protection framework. While the Act primarily focuses on how data is accessed, shared and reused, it serves as a timely reminder that organisations must continue to meet their existing obligations around secure data disposal.

What the DUAA changes — and what it doesn’t

According to the Information Commissioner’s Office (ICO), the DUAA aims to make data use more practical and proportionate while maintaining high standards of protection for individuals. The Act amends both the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

However, the DUAA does not remove or reduce the obligation for organisations to securely dispose of personal data when it is no longer required. Secure disposal remains a core principle of UK data protection law.

Why secure document destruction still matters

Paper records frequently contain personal data, commercially sensitive information, or both. If these records are not destroyed securely, organisations risk regulatory enforcement, reputational damage, and loss of customer trust.

The ICO continues to require that organisations take appropriate technical and organisational measures to protect personal data throughout its lifecycle. This includes ensuring that confidential documents are destroyed in a way that prevents reconstruction or unauthorised access.

What to look for in a shredding provider

When evaluating a document shredding provider, organisations should look for clear evidence of compliance with UK data protection requirements. Key considerations include:

Secure collection and chain of custody

A professional shredding company should be able to explain how confidential material is handled from the moment it leaves your premises through to its final destruction. This includes using vetted staff and maintaining secure transport arrangements.

Documented destruction processes

Transparency is essential. Organisations should expect clear documentation, such as Certificates of Destruction, which demonstrate that material has been securely destroyed in line with recognised standards. These records support your wider accountability obligations under data protection law. We provide a Certificate of Destruction with every shredding service we carry out.

Compliance with industry standards

Reputable shredding providers should work to recognised standards for secure destruction. Shredsec works to BS EN 15713, the Code of Practice for the Secure Destruction of Confidential Materials.

Insurance and risk management

A professional shredding provider should carry appropriate insurance to cover the risks associated with handling confidential material. This provides additional reassurance should an incident occur during transport or processing.

Environmental responsibility

Secure shredding services should ensure that shredded material is recycled responsibly once destruction has taken place, supporting both data protection and sustainability goals. All material shredded by Shredsec is recycled into new paper products.

Taking action on your data protection obligations

The DUAA reinforces the importance of accountability and proportionate data handling. Whether you need a one-off shredding service for an office clearout or regular scheduled collections for ongoing compliance, secure document destruction should be treated as an essential part of any data protection strategy.

For organisations in Suffolk and East Anglia reviewing their compliance arrangements, choosing a trusted shredding provider demonstrates responsible data handling and supports ongoing compliance with UK law.

Contact Shredsec to discuss your shredding requirements.