The guidance on electronically storing documents and destroying of paper documents depends on what type of organisation you are. Everything from Law Firms to Charities have different guidelines set out to ensure your business stays compliant with data retention rules and regulations. Extracts from each regulatory body have been drawn up in the following article. Read on to find out more. For more information about how off-site storage and  data management systems can help your organisation click on the links.

We have selected the most relevant sections from the guidance for your perusal. Click the links below each section to download the full publication.

Extracts:

Law Society Guidance:

Can I store documents photographically or electronically, and destroy the originals?

Original documents, such as deeds, guarantees or certificates, which are not your own property, should not be destroyed without the express written permission of the owner. Where the work has been completed and the bill paid, other documents, including your file, may be stored, for example, on a CD ROM, computer system or microfilm and then destroyed after a reasonable time. […]

7. What is the evidential value of a photographically or electronically stored document where the original has been destroyed?

There is a dearth of judicial authority on this topic and, until the law and practice on the subject of microfilmed or electronically stored documents are clarified, it is only possible to provide general guidelines.

The Society has been advised that:

(a) A microfilm of any document in a solicitor’s file will be admissible evidence to the same extent, no more and no less, as the document itself, provided that there is admissible evidence of the destruction of the document and identification of the copy.

(b) Written evidence of the destruction of the original and of identification of the copy will enable the microfilm to be adduced in subsequent civil proceedings (under the Civil Evidence Act 1968) and in criminal proceedings (under the Police and Criminal Evidence Act 1984).

8. What procedures would the Society recommend where an original document is stored electronically or photographically and then the original is destroyed?

(a) Written evidence of the destruction of the original and of identification of the copy must always be preserved in case oral evidence is no longer available when needed (see question 7(b) above).

(b) There should be a proper system for:

(i) identifying each file or document destroyed;

(ii) recording that the complete file or document, as the case may be, has been photographed;

(iii) recording identification by the camera operator of the negatives as copies of the documents photographed; and

(iv) preserving and indexing the negatives.

(c) If a microfilm, electronically or photographically stored data is required to be produced in evidence, a partner or senior member of staff should be able to certify that:

(i) the document has been destroyed;

(ii) the microfilm, electronically or photographically stored data is a true record of that document; and

(iii) the enlargement is an enlargement of the microfilm, electronically or photographically stored data.

(d) Microfilm copies of some documents (e.g. coloured plans) can be unsatisfactory, in which case the originals should be preserved.

9. Will I be covered by the Solicitors’ Indemnity Fund if I lose a client’s file or destroy it without the client’s consent?

If you incur liability either to a client or to a third party by the loss or destruction of documents, cover will normally be provided by the Solicitors’ Indemnity Fund.

Download the Law Society Guidance PDF: Ownership, Storage and Destruction of Documents

FSA Handbook (superseded by FCA Handbook) Guidance:

SYSC 9.1.4 G

Subject to any other record-keeping rule in the Handbook, the records required under the Handbook should be capable of being reproduced in the English language on paper. Where a firm is required to retain a record of a communication that was not made in the English language, it may retain it in that language. However, it should be able to provide a translation on request.

SYSC 9.1.5 G

In relation to the retention of records for non-MiFID business, a firm should have appropriate systems and controls in place with respect to the adequacy of, access to, and the security of its records so that the firm may fulfil its regulatory and statutory obligations. With respect to retention periods, the general principle is that records should be retained for as long as is relevant for the purposes for which they are made.

Download the FCA Handbook PDF: General Rules on Record Keeping

HMRC Guidance:

Background

[…] A number of recommendations have been adopted:

a. A record of all such documents should be recorded on a database. This should be updated and maintained in line with current security and operational policy.

b. A manual record of any documents returned or destroyed should be recorded, witnessed and retained securely in the destruction & returns log sheet.

c. All documents should be retained for a period of 1 year and destroyed thereafter or returned to the relevant issuing authority (if appropriate). This includes withdrawn applications where documentation cannot be returned due to lack of contact or no response from the applicant.

d. An electronic documents database has been set up by the Security Team for all regional offices, to record all documents that have been retained in IPS (with the exception of foreign passports) when they cannot be re-united with the rightful owners.

e. Instructions will be given to ensure that all regional offices deal with the destruction of these documents in a consistent manner.

The Process

It should be noted that every effort should be made to re-unite these documents with the rightful holders before any documents are destroyed or returned to the relevant issuing authority. Each regional office should ensure that these documents are stored in secure locations and access is restricted to those authorised to do so. Any documents that cannot be re-united with the rightful owner should be added to the documents database. Documents should be held for a maximum of 1 year, […] then either destroyed or returned to the issuing authority concerned.

Each office should carry out a minimum of an annual check of stored documents and any that have been retained for 1 year or more should be either destroyed or returned to the issuing authority in line with the instructions below. […].

Download Gov.uk PDF: Guidance on Storage, Destrcution and retention of files

Yes! The physical destruction of electronic media is the safest way to ensure your unwanted business data can never be recovered. The on-site destruction of hard drives, backup tapes and mobile devices is preferred by many compliance and IT managers as it means they can witness the destruction and rest assured their unwanted data can never be recovered.

Our MDX shred trucks are fitted with high torque data shredders that cut and grind electronic media into tiny fragments. These shredders mean we can conduct on-site media destruction at the same time as shredding paper documents in the same visit. Our security vetted staff will collect your electronic media and load them directly into the shred truck where they will be shredded on-site. The fragments of shredded metal and plastic fall into locked bins inside the shred truck which are taken back to our secure facilty.

View our video to find out more about Topwood’s secure on-site data destruction process

Depending on the destruction specification, the fragments are either graded for recycling or fed into a second shredder fitted with screens to render down the fragments even further. Once the disintegration process is complete the powder-like material is blown into bulk sacks and sent to a specialist smelter who can separate out the plastic and metals for reuse.

We offer destruction of:

• Hard drives
• CDs
• USB data sticks
• Floppy disks
• Laptops
• VHS tapes
• Mobile devices

Our pricing is based on a number of factors including the quantity of data to be destroyed, the type of data and your location. Whether you want a one-off shredding service or as part of your scheduled shredding visit we can meet your needs. After every shredding process you will receive a certificate of destruction which is available to download from our online login service.

Our Data Destruction service is similar to our paper shredding service. You drop your physical data items into the confidential waste bins. You can have either a lockable red wheelie bin or our dual console, which will be picked up by our operatives at an arranged interval.

We have our blue wheelie bins for paper, but we also supply red bins for data to be destroyed. This ensures that materials disposed of are done so correctly.

It is possible for a single hard drive or disk to contain thousands of files. It is not sufficient for a Data Controller (office manager) to instruct an IT engineer to wipe information or software from electronic media. Information can still remain after deletion. For example, emails and online activity are still

recoverable by those with the digital forensic ‘know how’ and motive. There are often news stories involving some kind of digital data security breach.

Leaving commercially sensitive information, information about your clients, employees or the public on unwanted electronic media can have devastating consequences. Destroying data must be a thorough process and isn’t simply a case of pressing the ‘delete’ key. The surest way to know that information can never be recovered from electronic media is to physically destroy it.

After each destruction service, you will receive a Certificate of Destruction.

Visit our Media Destructionwebpage for more information about this service.

After the secure destruction of every batch of confidential documents and data, Topwood (the data processor) will provide you with a Certificate of Destruction as required under principle 7 of the Data Protection Act 1998. Depending on the service used, you will be provided with your certificate via email within 24hrs. Read on to find out more.

Principle 7 of the Data Protection Act relates to the security of files and data. It states that as part of a secure destruction process a proof of destruction should be obtained.

On completion of on-site shredding, off-site shredding and other shredding services, we will provide you with a certificate of destruction to add to your records.

How do you get your certificate?

Whether you are a one-off bulk customer or are a regular shredding customer, you will receive an email from us with your certificate of destruction attached in PDF format within 24hrs of shredding. Take a look at an example of what your certificate will look like below.

For more information on what the Certificate of destruction is, read our Download Centre article:

Certificate of Destruction Explained

Yes. The process of shredding and disintegration reduces hard-drives, CDs, VHS tapes, mobile devices and other physical data items to a powder-like material that can then be recycled.

This mechanical destruction eliminates the possibility of data theft and gives security and compliance mangers the total peace of mind that their media has been completely destroyed.

We are experts in the secure destruction of data. Our high-torque industrial shredders cuts and grinds the media into tiny fragments until they pass through a screen (30mm down to 6mm depending on security requirements). Once powder-like, the rendered material is sent to a smelter so it can be recycled.

Our Data Destruction service is similar to our paper shredding service. You drop your physical data items into the locked red wheelie bin, which will be picked up by our operatives at an arranged interval.

We have our blue wheelie bins for paper, but we also supply red bins for Data to be destroyed. This ensures that materials disposed of are done so correctly.

Physical Data that we can destroy:

• Harddrives
• Floppy disks
• VHS tapes
• USB Sticks

It is possible for a single hard drive or disk to contain thousands of files. It is not sufficient for a Data Controller (office manager) to instruct an IT engineer to wipe information or software from electronic media. Information can still remain after deletion. For example, emails and online activity are still recoverable by those with the digital forensic ‘know how’ and motive. There are often news stories involving some kind of digital data security breach.

Leaving commercially sensitive information, information about your clients, employees or the public on unwanted electronic media can have devastating consequences. Destroying data must be a thorough process and isn’t simply a case of pressing the ‘delete’ key. The surest way to know that information can never be recovered from electronic media is to physically destroy it.

After each destruction service, you will receive aCertificate of Destruction.

Visit our Media Destruction webpage for more information about this service.

Watch our video below on Topwood’s Hard drive shredding service.

When dealing with Waste Management, you may come across these abbreviations. You will need to know the codes for the type of waste you are managing when you fill in the mandatory Waste Transfer Note. Read on to find out more.

As a data controller, you are required to complete a waste transfer notice. Our Waste heierachy article explains the waste transfer note in more detail. In this article, we explain the EWC and SIC codes you will need to fill in your waste transfer note when you deal with waste such as confidential documents, data devices, or uniforms.

EWC stands for European Waste Catalogue. The codes are used to define different types of waste. We deal with many different types of waste when shredding for different customers such as:

• Confidential document shredding
• Packaging and labels destruction
• Dental records
• Uniforms

This website will help you find the correct EWC code for your waste

SIC stands for Standard Industrial Classification. This code defines what kind of business your company engages in. Our customers come from a range of sectors, such as:

• Retail
• Healthcare
• Education
• Finance
• Legal
• Public Sector
• Insurance

This website will help you find the correct SIC code for your business and premises

When it comes to EWC codes, there is no difference between regular waste paper, and confidential paperwork, as they are the same material. Therefore you can use the same EWC code for both. However, it is the method in which you dispose of the confidential paperwork that needs to be disposed of in a secure manner to comply with legislation.

Use a professional shredding firm like Topwood to help you manage your document destruction.