Recycling paper containing sensitive personal data

"Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data."  

 

This is the 7th Data Protection Principle and would apply to all paper containing patient data which is to be recycled.

The Information Commissioner's office advises that confidential waste paper should ideally be shredded by practice staff and sealed before removing for immediate recycling. The Practice Data Controller retains legal responsibility for all data security and any recycling company acts as the Data Processor in this situation.

Only reputable recycling companies should be used and the contract with the company must specify procedures that are entirely acceptable to the practice data controller. 

It is of course essential to ensure that you only destroy those documents which you are not obliged by law and business or common sense to retain!

Further information:

Recycling paper containing sensitive personal data