Most guides to confidential shredding stop at “get a certificate, you’re fine.” That works until the ICO asks how you actually decided what to destroy, who destroyed it, and where the proof lives. This is the practical version, written for the person who has to defend the process if it gets audited.
What Counts as Confidential Material
Confidential shredding is not a paper problem. Under BS EN 15713:2023, any medium holding data you have a duty to protect needs secure destruction. That covers HR files, payroll, contracts and customer correspondence, but also hard drives, USB sticks, SIM cards, microfilm, production waste carrying proprietary designs, printers waste with sensitive output, and branded items shredded at end-of-line to protect the brand.
If office staff are dropping anything from that list into the general recycling, you have a problem. That is not destruction. It is a leak waiting to happen.
The Legal Bit, Briefly
Three pieces of law shape confidential shredding in the UK. We have a fuller breakdown in our GDPR explainer, but the short version:
- The UK GDPR and Data Protection Act 2018 treat destruction as data processing. Get it wrong and you can be fined up to £17.5m or 4% of global turnover by the ICO.
- Section 34 of the Environmental Protection Act 1990 puts duty of care on you. Use authorised carriers. Keep transfer notes for two years.
- BS EN 15713:2023 is the destruction standard itself. Anyone you hire should be compliant with it, plus ISO 27001 and BS 7858 staff vetting.
Our piece on why confidential waste disposal matters walks through real ICO cases where the disposal route was the failure point.
Get a quote
On-Site vs Off-Site Confidential Shredding
This is the decision that catches people out, and the answer depends on what you produce.
On-site (mobile) shredding
A truck arrives, your locked consoles are emptied straight into its industrial shredder, and the material is destroyed before it leaves your car park. Someone from your team can witness it on the truck’s CCTV monitor. Good fit for board papers, legal files, archive purges, or anything where you want eyes on the destruction.
Off-site shredding
GPS-tracked vehicles collect sealed consoles and take them to a secure depot, destroyed within one working day. Cheaper per tonne, less disruption, better for ongoing volume across multiple sites.
Most businesses end up with both: scheduled console collections for the day-to-day, plus the occasional on-site visit for sensitive archive clear-outs.
How to Build a Shredding Policy That Survives an Audit
ICO investigations work backwards. Something leaks, the regulator pulls your paperwork, and your policy either holds up or it doesn’t. Five things to get on paper:
- A confidential waste audit. You cannot write a policy without knowing what you produce. A confidential waste audit maps every source: departments, categories, volumes, current gaps.
- A retention schedule. Payroll: 6 years. Personnel files: 6 years post-employment. Recruitment rejects: 6 to 12 months. CCTV: 30 days. Without dates, staff retain everything or destroy the wrong things.
- Locked consoles at source. Near printers, finance, HR. Keys with the provider, not on a hook in the stationery cupboard.
- Waste transfer notes and certificates of destruction, kept for at least two years.
- A supplier file. BS EN 15713 compliance, ISO 27001, waste carrier licence, BS 7858 vetting confirmation. If a regulator asks how you assured yourself, this is the answer.
What a Real Certificate of Destruction Looks Like
If your current certificate is one line saying “we shredded your stuff,” it will not hold up. A proper one records:
- Your name and address as data controller
- The provider’s name, address, and Environment Agency waste carrier number
- Date and time of collection
- Date and time of destruction
- Description and weight destroyed
- Method (shredded to BS EN 15713)
- Location (on-site or named depot)
- Onward recycling stream
- Signature of an authorised representative
InspireWaste issues a full waste disposal certificate covering all of the above for every collection.
Get a quote
Hard Drives, SSDs and Other Digital Media
Deleting files does not destroy data. Reformatting does not destroy data. Degaussing leaves recoverable fragments on SSDs because flash storage does not respond to magnetic fields the way platters do. The only defensible option is physical destruction, then recycling under WEEE.
That means two waste streams: confidential shredding for the data, and WEEE waste collection for the hardware. One provider handling both gives you one chain of custody and one set of paperwork. Two providers doubles the admin and creates gaps.
Where the Shredded Material Actually Goes
BS EN 15713 requires recycling wherever practical. Shredded paper is baled, pulped, and turned back into new paper. Non-recyclable fractions go to refuse-derived fuel or energy-from-waste. Landfill is a last resort. See our notes on shredded paper recycling and the wider challenges of paper recycling if you are dealing with volume.
One detail worth checking with any provider: commingling. Reputable operators mix shredded output across clients before baling, which makes reconstruction of any one document mathematically pointless. If yours does not, ask why.
The Mistakes That Catch Businesses Out
- Buying on price alone. Cheap quotes rarely include BS EN 15713 or vetted staff.
- No retention schedule, so staff hoard everything or destroy too early.
- Locked consoles in unlocked rooms.
- Trusting the office shredder. Strip-cut output fails most security levels, and there is no certificate at the end.
- Forgetting digital media. The data your insurer cares most about often lives on a USB stick in someone’s drawer.
- No supplier file. If you cannot show how you vetted the provider, you have failed the accountability test under Article 5(2).
Working With InspireWaste
InspireWaste handles confidential shredding for everyone from small practices to FTSE 300 organisations. BS 7858-vetted staff, BS EN 15713 destruction, full certificate of destruction, ISO 9001 / 14001 / 27001 certified, CHAS accredited. Flat-rate quotes with no hidden costs. Confidential shredding sits alongside our wider waste management services if you want one supplier across multiple streams.
