Confidential waste refers to any document or device that contains personal data about:
It also includes data that, if read by a competitor or the general public, could put your business at risk.
This might include:
- financial data
- business plans
- intellectual property—business processes, patents, designs, manuscripts
- branding and marketing strategies
In this guide you’ll find out more about:
- Why you must dispose of confidential waste securely
- How to dispose of your confidential business waste in 4 simple steps
- What documents you should shred
- How to decide what kind of document shredding service you need
- How much document shredding services cost
- How to set up a confidential waste policy
- Confidential waste bags, bins and cabinets
If you run a business from home or are looking for a one-off document shredding service, you can find out more about domestic paper shredding services here, including how it works, the benefits and the costs.
Why you must dispose of confidential waste securely
There are three main reasons to dispose of confidential waste properly.
- You have a legal obligation to dispose of confidential waste properly
- It prevents security breaches
- It’s the right thing to do and makes your business trustworthy
Your legal obligations
A business must follow laws included in the General Data Protection Regulation (GDPR) that make it responsible for protecting people’s personal information.
If you breach GDPR, your business can be fined up to 4% of your annual turnover, or €20 million (£17.5 million)—whichever is greater.
For businesses, both online and paper-based data breaches can result in hefty fines. The website of the Information Commissioner’s Office (ICO)—the body responsible for enforcing GDPR—details what it has fined companies for.
This ranges from a few hundred pounds for individuals who accessed medical records without authorisation, to hundreds of thousands of pounds for companies that failed to protect customers’ digital data.
Our guide to personal data regulations and GDPR explains how to follow GDPR.
Prevent security breaches
Document shredding and secure confidential waste disposal prevents security breaches, and paper related security breaches happen all the time.
You’ll hear about cyber security breaches in the media frequently, but breaches involving paper documents accounted for 40% of the 598 data security incidents the ICO recorded between July and September 2016. The most common breaches included paperwork being either posted or faxed to the wrong recipients or being stolen.
One incident in 2012 involved pension records being dumped in supermarket recycling bins.
You can read more of the data breaches the ICO has recorded and acted upon on its website.
Implementing a confidential waste disposal policy and choosing a professional shredding company to deal with your business waste will greatly reduce the chance of a paper-based security breach.
Your ethical obligations
Security breaches put your customers or employees at risk and violate their privacy. Depending on the data breach, the consequences can range from causing people slight inconvenience to leaving them out of pocket or emotionally distressed.
According to the GDPR, any data breach that isn’t dealt with quickly and properly could have devastating consequences for individuals:
“A personal data breach may, if not addressed in an appropriate and timely manner, result in physical, material or non-material damage to natural persons such as loss of control over their personal data or limitation of their rights, discrimination, identity theft or fraud, financial loss, unauthorised reversal of pseudonymisation, damage to reputation, loss of confidentiality of personal data protected by professional secrecy or any other significant economic or social disadvantage to the natural person concerned.”
Security breaches also damage a company’s reputation. A feature printed in the ISACA Journal stated: “Privacy breaches disturb trust and run the risk of diluting or losing security; it is a show of disrespect to the law and a violation of ethical principles.”
Prevent identity theft
This type of fraud happens almost 500 times a day in the UK, according to figures, with a record 89,000 cases of identity theft having occurred in the first half of 2017. And although many businesses are now storing data electronically, the notion of a completely paperless office is unrealistic.
Therefore, it’s essential that you shred documents that are no longer needed and store those that are still in your possession in a safe and protected place.
Create more space
Keeping boxes, filing cabinets and cupboards full of paper documents takes up a lot of valuable space in the workplace. Enlisting shredding services means freeing up this space and clearing away clutter, which in turn can make the environment safer and more attractive for staff and clients alike.
How to dispose of your confidential business waste in 4 simple steps
There are four basic stages to confidential waste disposal:
- Create a list of all the documents and files you need to shred or destroy
- Choose the type of document shredding or destruction service you want to use and set it up
- Write a confidential waste disposal policy and communicate it to your staff
- Set up a safe and secure storage area—sealable bags, lockable confidential waste cabinets or lockable wheelie bins are good options
What documents you should shred
What your business chooses to shred will form part of your confidential waste disposal policy.
However, you should consider shredding the documents below as a minimum. Download the checklist here.
- Budget documents
- Tax returns
- Copies of sales receipts
- Payroll information
- Bank and credit card statements
- Voided cheques
- Company structure documents
- Pricing structures
- Supplier information
- Employment records
- Appraisals and employee reviews
- Disciplinary reports
- Absence and sickness information
- Documents related to promotions
- ID or access cards
Client or customer information:
- Client or customer contact details
- Printed correspondence (such as emails) containing information that can be used to identify people
- Photo identification documents
- Any documents containing personal information such as names, addresses, phone numbers or email addresses
Don’t neglect documents that might not seem sensitive
Make sure you understand what’s sensitive and what isn’t. In a recent study, we found that a number of businesses are leaving themselves at risk by failing to destroy confidential documents, simply because they thought the information wasn’t sensitive.
The research suggested that a lot of businesses see invoices, and documents that detail how the company is organised or structured, as relatively low priorities for shredding.
In fact, businesses should always consider this sort of information sensitive and destroy it securely, along with the following:
- Documents containing clients’ and employees’ personal information
- Contracts and commercial documents
- Office plans and internal manuals
- CVs from potential employees
CVs in particular are often cast aside after job interviews. Disposing of them securely isn’t always seen as a priority, despite the fact they typically contain information such as:
- the candidate’s home address, middle names and National Insurance number
- sensitive information about health conditions or previous criminal convictions
To make life easier for yourself, we recommend having a ‘shred all’ policy for any unwanted documents. This will save your employees from having to make a decision on what is or is not classified as confidential waste.
What non-paper documents you should shred
It’s not just paper documents that need shredding.
- Electronic items
Confidential information is also stored on electronic items such as hard discs, memory sticks and laptops. These items can be shredded at the end of their use, just like paper documents can.
You can read more about hard drive destruction services here.
You can read more about WEEE (WEEE stands for waste electrical and electronic equipment) with our Frequently Asked Questions on Business WEEE and IT Recycling.
- Uniform and textiles
Uniforms and branded corporate clothing can be used to identify employees, or worse, to impersonate others which can lead to identity theft. For these reasons uniforms and corporate clothing must be destroyed properly once they’re no longer needed.
You can find out more about the importance of uniform and corporate clothing destruction here.
How to decide what kind of document shredding service you need
Commercial shredding companies generally offer the choice between a one-off service and a regular one. Many businesses produce so much confidential waste that they are likely to need the regular monthly option.
If you’re using paper shredding services for the first time and need a regular service, you may also have a backlog of documents and data to deal with. In this case, you could use a yearly bulk shredding service as well.
You can find out much more about both of these services with our in-depth guide to deciding what kind of document shredding services you need for your business.
We’ve also put together a complete guide to your options for document shredding—On-site and mobile shredding: what is it and how much does it cost?
How much document shredding services cost
The cost of business shredding services largely depends on how much you have to shred, whether you want it shredding on-site or off-site and how often you need it shredding.
You can find a full price list of shredding services from Russell Richardson here and you can read more about why we charge the prices we do here.
It can be tempting to cut costs and shred documents yourself. However, this will almost always end up costing you more than hiring a professional shredding services, and could leave your business vulnerable to data breaches.
You can read more about why shredding business documents yourself isn’t a good idea on the page 5 Reasons why businesses shouldn’t shred documents themselves.
How to set up a confidential waste disposal policy
Implementing the correct processes can give your staff the confidence to deal with confidential documents that are no longer needed and dispose of these correctly, helping to avoid data breaches.
A confidential waste disposal policy will outline:
- how long your business must keep a document for
- where it should be stored for shredding (for example, in bins or bags)
- when and how it will be shredded
When putting procedures for document shredding in place, include a checklist for employees that details how to handle confidential waste that needs shredding.
The checklist should include:
- where to store documents before they are collected for shredding—this should be in a secure container such as a lockable cabinet or wheelie bin
- how often a representative from the shredding company will come to collect the documents—this should include details of the shredding company so the person responsible for giving them access to the premises can verify their identity
- where the documents will be shredded (on-site or off-site) and if someone needs to witness them being shredded
- who will receive and process the certificate of destruction
A confidential waste disposal policy should form part of your records management policy, which should contain information for how and when documents are transferred to off-site storage or are destroyed. If your employees are clear about how to handle confidential waste, security breaches will be much less likely.
Storing your documents securely in confidential waste disposal bags, bins and cabinets
Between collections, you’ll need a secure method of storing your confidential waste and documents. Most shredding companies will provide you with suitable storage for the size and nature of your business.
These containers are measured by weight, with the smallest being confidential waste bags that can hold up to 15kg—this is approximately the same weight as a standard box of A4 paper. If you have a considerable amount of documents to shred, you may want to choose a lockable skip which has a capacity of approximately 10,000kg.
The options for shredding storage containers are as follows:
Type of container
Document shredding bags that can be sealed
These cabinets are available in a range of colours to suit your office or corporate colours and have a slot at the top to post documents through.
Lockable wheelie bins
These bins have a security slot for posting documents.
60kg (small capacity)
110kg (large capacity)
Enclosed, lockable skips for large amounts of waste
Set up the containers in a specific area of the office and make sure your staff are aware of where they are. If using a lockable system, you’ll need a process in place for accessing it. Nominate a person or a select number of employees to be key holders. Monitor how full the bins, bags or cabinets are each month to assess whether you have a suitable amount of storage space for your confidential waste.
You can find out more about shredding services in general here Complete guide to shredding services: what you need to know about domestic and business paper and media shredding