Records disposal

What it means

Shredding, or secure destruction, is the controlled and irreversible destruction of documents after their retention period has expired, so that no data can be recovered. For paper documents this means a shredder with an adequate security level or a certified company; for electronic ones, secure erasure of data from storage media.

Shredding is the final stage of records management. It is preceded by checking that the retention period really has expired and that the document is not needed for pending proceedings, an audit or a dispute. Bodies covered by the Archives Act dispose of records with the consent of the relevant state archive.

The duty to destroy data also follows from the GDPR. Personal data may not be kept longer than the purpose requires, and once the statutory retention period ends, for example for personnel files of former employees, they must be erased or destroyed.

How it works in practice

We recommend clients carry out shredding once a year, usually after closing the financial year. From the retention schedule we select documents whose period has expired, check they are not tied to unresolved matters and prepare a list for management approval.

A record of destruction is drawn up: which groups of documents from which period were destroyed, when, how and who was responsible. When using an external shredding company, we request a certificate of destruction. The record proves the company disposed of the documents lawfully.

For accounting documents, we follow the periods under the Accounting Act and tax rules, which may extend them, for example when a tax loss is being carried forward or for long-term assets. Documents relating to assets still in use are not destroyed until the asset is fully depreciated and disposed of.

What to watch out for

Destroying too early can be as problematic as too late. If a company shreds documents before the deadline for assessing tax has passed, it cannot support its expenses in an audit and the tax authority may disallow them. When in doubt, keep the document.

Throwing documents into ordinary waste is not shredding. If papers containing personal data end up in a bin and someone finds them, that is a data protection breach. Likewise, old computers and drives must be securely wiped before disposal or sale.