There are many regulations designed to protect data, and by default, that affects how and when businesses should destroy documents that contain this data, too.
But, exactly when should a record be destroyed?
To answer this question, it’s worth taking some time to consider the specific regulations that lay down the law on the issue. They are set in place for a reason, and can save you from getting rid of documents too quickly or holding on to them for too long. There can also be a hefty penalty for not following the rules.
Failing to destroy documents that contain sensitive information can result in reputational damage and severe financial penalties – businesses and organisations found to be in breach of the Data Protection Act 1998, for example, can face a financial penalty of up to half a million pounds.
Here are some factors to consider when determining when a record should be destroyed.
When statutory retention periods have passed
Existing data retention regulations outline exactly when you are legally required to destroy certain records – in other words, when the statutory retention periods have passed.
Some examples include:
Business agreements: Section 5 of the Limitation Act 1980 outlines these in detail. All contracts, business agreements, and other relevant documents should be kept for a period of six years (excluding the length of the contract) before destruction.
VAT records: As per Schedule 11, paragraph 6 of the VAT Act 1994, and HMRC Notice 700/21 October 2013, you have to keep VAT records for at least six years from the moment of creation. Store these records digitally, as well as in a safe physical location, and you’ll be fully compliant.
Pension documents: The Registered Pension Scheme (Provision of Information) Regulations 2006 mandates that these records must be stored for at least six years.
When it is no longer of use
You can say goodbye to your drawers, folders and envelopes full of receipts – it’s safe to shred any document that does not directly relate to company information or accounts and does not need to be kept for any other reason.
Things like receipts, deposit slips or monthly bank statements can be shredded on a monthly or annual basis. As long as your receipts have been reconciled with your bank statement or accounts and you have received your end of year bank statement, you don’t need to keep all of those receipts anymore.
When you’ve made sure you have backup copies of it
Sometimes, holding on to a hard copy can put you at more risk of it being stolen or intercepted than destroying it, if you have an online copy saved securely elsewhere. With the ubiquitous use of email, the need for actual hard copies of documents seems unnecessary. Having electronic copies of contracts and other legal documents mean now that most hard copies of these can be destroyed. However, there are some documents for which you are legally required to retain the original, physical copy. It worth double checking before throwing something away!
When the information is confidential and should not be seen by others
It should go without saying, but any information that should not be seen by others, whether it’s a physical copy or online, should be properly destroyed. When you leave old papers around, they become available to everyone. Even if you’re sending a document to the trash on your computer, or you’re filing it away in an old folder, it could put you at risk if it is not completely destroyed. Those intent on finding the information – hackers or otherwise – are always going to be able to extricate data that has not been completely destroyed.
Need to develop a fool-proof strategy for storing and shredding business records? Contact our team of experts today.