The Data Protection Act is not prescriptive concerning the exact ways that care needs to be taken of personal data, this means that you have to consider whether measures you are taking comply with the intent of the Act.

The Act covers computer records, information held in manual files (e.g. index cards, filing systems etc), discs and CDs.

The destruction of the data has to be carried out in such a way as to ensure that data from which individuals can be identified can't fall into the wrong hands.

The Act specifically says that in deciding how far to go with this, you need to consider the level of technology available, together with the cost of using it, and the effect it would have on the data subject if the information was misused as a result of it falling into the wrong hands, putting information in bins and hoping that it will be appropriately destroyed at a later date is not enough.

Why is Data Destruction important

The responsibilities of organisations relating to confidential data have become more stringent since the implementation of the Data Protection Act 1998.

Organisations must destroy under secure conditions any data containing personal information.

If the data controller (i.e. those originating the data) is using a sub-contractor as their data processor, they must:

• Choose one that gives guarantees about security measures.

• Take reasonable steps to ensure compliance with those measures.

• Have a contract with the data processor.

• The data processor is legally responsable for the data right up to the point of destruction,

• It is important to get a certificate of destruction from the sub contractor as proof that the process has been completed.

An individual who suffers damage because of a contravention by the data controller is entitled to compensation for that damage.

NAC Property Clearance will supply a Guarantee of Destruction Certificate and complete a Duty of Care Waste transfer note for every Confidential Waste Disposal contract we undertake, a copy of our waste carrier registration is available on request.

Contravention of the Data Protection Act is a criminal offence carrying a maximum £5000 fine. The trend is for prosecutions to be on the increase.