GPDR Paper document disposal

[jmak]

I've just had a supplier of document shredding on the phone trying to scare me into buying a shredding service. A quick search suggests that we need certificates of disposal for paper documents. Is that true? If so, do you have any plans to manage it. Obviously there are periods of the year when we have large volumes of particular types of data, but we have confidential data produced continuously and shredded within hours. Surely we can't be expected to document what we've printed (type of data, number of pages etc) and what we dispose of? I regularly print lists of names and dates of birth and then shred the same day - it's not practical to document that.

 

Also, if you have shredders on site, what do you do with the shreddings? Ours go in the food waste for composting, but those bins aren't locked in the same way a secure disposal bin.

 

Thanks

[witch]

@GrumbleDook ????

[GrumbleDook]

https://ico.org.uk/media/for-organisations/documents/1132/report_dp_guidance_for_schools.pdf is a few years old now, but looks at a lot of problems that schools still have.

 

This is based on 1st and 7th principles of the DPA.

https://ico.org.uk/for-organisations/guide-to-data-protection/principle-1-fair-and-lawful/

https://ico.org.uk/for-organisations/guide-to-data-protection/principle-7-security/

 

You have to decide if you still need the data (in that format) and if so then you secure it. If not you destroy it.

The DPA doesn't specify standards and so on, but I can bet that the company will talk about BS EN 15713:2009 ... if they say BS 8470:2006 then walk away, that standard has been superseded by BS EN 15713:2009

The thing is ... the standard is more about staff vetting, site security, collection and transport, audit controls ... the actual destruction can be done by the school. One benefit from using a shredding company is they will often provide you with the secure bins to use, but these are readily available to by.

 

Shredders are in DIN levels, and go from P1-6 (P3 deals with confidential), so you can go and find a good shredder yourself.

You simply need to have a destruction procedure (which should be tied in with your data proctection and information handling policy) and have evidence that it is being followed. You only need to have certificates of evidence if you are using a shredding service.

 

Many LAs and businesses have done a Risk Assessment and a Time and Motion study and found that it is more cost effective to take on such a service (reduction in staff time doing the shredding, no kit required, reduced risk of fines for data breaches, etc.) so you are going to find companies chasing business again with the new law coming in.

 

Don't panic, have it in mind when your school is discussing next steps and check what is actually needed.

[jmak]

https://ico.org.uk/media/for-organisations/documents/1132/report_dp_guidance_for_schools.pdf is a few years old now, but looks at a lot of problems that schools still have.

 

This is based on 1st and 7th principles of the DPA.

https://ico.org.uk/for-organisations/guide-to-data-protection/principle-1-fair-and-lawful/

https://ico.org.uk/for-organisations/guide-to-data-protection/principle-7-security/

 

You have to decide if you still need the data (in that format) and if so then you secure it. If not you destroy it.

The DPA doesn't specify standards and so on, but I can bet that the company will talk about BS EN 15713:2009 ... if they say BS 8470:2006 then walk away, that standard has been superseded by BS EN 15713:2009

The thing is ... the standard is more about staff vetting, site security, collection and transport, audit controls ... the actual destruction can be done by the school. One benefit from using a shredding company is they will often provide you with the secure bins to use, but these are readily available to by.

 

Shredders are in DIN levels, and go from P1-6 (P3 deals with confidential), so you can go and find a good shredder yourself.

You simply need to have a destruction procedure (which should be tied in with your data proctection and information handling policy) and have evidence that it is being followed. You only need to have certificates of evidence if you are using a shredding service.

 

Many LAs and businesses have done a Risk Assessment and a Time and Motion study and found that it is more cost effective to take on such a service (reduction in staff time doing the shredding, no kit required, reduced risk of fines for data breaches, etc.) so you are going to find companies chasing business again with the new law coming in.

 

Don't panic, have it in mind when your school is discussing next steps and check what is actually needed.

 

Thanks for the detailed response. Supplementary question: If we have a shredder to the required DIN level, are there rules on how we dispose of the waste, or does the shredding standard make the waste non-confidential in the same way as physically destroying a hard drive?

 

The issue with using a service is that with the size of our school it would take months to collect enough to be worth while collecting and we'd then have to find somewhere to keep secure bins that were easily accessible. Currently we have a shredder in the main office, so people just drop stuff in as they pass.

 

Edit: I've just checked and our shredder meets the standard for DIN P-4: 160mm2 For highly sensitive documents and personal data subject to high protection requirements

Edited September 14, 2017 by jmak

[GrumbleDook]

Once shredded it becomes waste.