A Practical Guide to Secure Document Destruction in Australia
Why secure destruction is not optional
Every business has a version of the same problem. Somewhere in the office there is a cabinet, a storeroom, or a stack of archive boxes full of old paperwork nobody has looked at in years. Invoices, contracts, HR files, client records, the odd folder nobody can quite remember the purpose of. It all feels too risky to throw in the recycling bin and too much hassle to deal with properly, so it just sits there. The trouble is, that paperwork is not neutral. If it contains anything personal or confidential, and most business paperwork does, then simply letting it pile up is a genuine compliance and security risk. This guide explains what secure document destruction actually involves, what Australian law expects of businesses, and how to choose a service you can trust with your records.
Under the Privacy Act 1988, most Australian businesses are required to protect the personal information they hold and to take reasonable steps to destroy it once it is no longer needed. This obligation sits within Australian Privacy Principle 11, commonly known as APP 11. It applies to information about customers, staff, clients, patients or members, and it does not stop applying just because the information has moved from a digital file to a piece of paper in a box.
What counts as reasonable will depend on the size of your organisation and the sensitivity of what you are holding, but the direction of the law is clear. If you no longer need it, and you are not required by another law to keep it, you need a proper process for getting rid of it. Tossing old client files into a general waste bin does not meet that standard, no matter how harmless it might feel in the moment.
There is also a practical reason to take this seriously. Old paperwork is one of the more overlooked sources of a data breach. Businesses invest heavily in firewalls, passwords and cyber security, and rightly so, but a filing cabinet full of unshredded records sitting in a storeroom is just as capable of exposing personal information if it ends up in the wrong hands.
What actually needs to be securely destroyed
As a general rule, anything containing personal, financial or commercially sensitive information should go through secure destruction rather than the recycling bin. In practice, that covers things like:
- Client and customer files, including names, addresses and account details
- Financial records such as invoices, statements and payment information
- Employee and HR records, including applications, payroll and performance files
- Medical or health related information
- Contracts, legal correspondence and board papers
- Anything marked confidential, or anything you would not want a stranger reading
If you are ever unsure whether something needs to be shredded, it is worth treating it as if it does. A quick sort before destruction is far less costly than a data breach afterwards.
How secure destruction actually works
Professional destruction services generally offer two approaches, and most businesses end up using a mix of both depending on the situation.
Onsite or mobile shredding brings a secure shredding vehicle to your premises. Your documents are destroyed on the spot, so you can see the process happen rather than simply trusting that it did. This is a popular option for businesses that want maximum visibility and reassurance.
Offsite shredding involves collecting your documents in locked, tamper evident bins or boxes and transporting them to a secure destruction facility. This tends to suit larger volumes, ongoing scheduled collections, or archive cleanouts where speed and cost matter more than watching the shredder work.
Either way, a proper service will give you a Certificate of Destruction once the job is done. This is a simple but important document. It records what was destroyed, when, and confirms that the process was completed securely. It is the piece of paper you would want on hand if a client, auditor or regulator ever asked how you handle old records.
Most reputable providers also recycle the shredded material afterwards, so the paper gets a second life rather than going to landfill.
What to look for in a destruction provider
Not all shredding services offer the same level of assurance, and this is one area where it pays to ask a few direct questions before you sign up.
Certification matters. NAID AAA Certification, overseen by i-SIGMA, is the recognised industry benchmark for secure data destruction in Australia. Providers with this certification are subject to scheduled and unannounced audits against a defined set of security requirements, rather than simply making claims about how careful they are.
Chain of custody matters just as much as the shredder itself. Ask how documents are handled from the moment they leave your premises to the moment they are destroyed. Are collection staff police checked? Are vehicles tracked? Are bins locked and tamper evident? Security is built through consistent process, not just industrial equipment.
A Certificate of Destruction should be standard, not an optional extra you have to request or pay more for.
Flexibility helps. Some businesses need a single, large archive cleanout. Others need a regular, scheduled collection as part of everyday operations. A good provider should be able to support both without locking you into something that does not suit your situation.
How this fits with scanning and record retention
Secure destruction rarely happens in isolation. For most businesses it is one part of a bigger conversation about how physical records are managed over time.
If you are holding onto paper because you are not sure whether you still need it, our guide on business record retention in Australia walks through how long different categories of records need to be kept and where those obligations come from.
If the real issue is that you want to stop accumulating physical paperwork altogether, our definitive guide to reducing your physical file burden covers how document scanning works and how it pairs naturally with secure destruction once records have been safely digitised.
In practice, the sequence usually looks like this. Records are reviewed against a retention schedule. Anything still needed is scanned and stored digitally, or kept in a well organised archive. Anything that is no longer required, and is not covered by another legal obligation, goes through secure destruction. It is a straightforward process once it is set up properly, and it removes both the compliance risk and the physical clutter in one step.
A word on who does the work
Frequently asked questions
What is secure document destruction?
It is the process of destroying paper records so the information they contain cannot be read, recovered or reconstructed. It is different from simply putting paper in a recycling bin, which does not guarantee the information is unreadable.
Is secure destruction a legal requirement for my business?
If you hold personal information about customers, clients, patients or staff, Australian Privacy Principle 11 requires you to take reasonable steps to destroy that information once you no longer need it. The exact requirements depend on your industry and the type of information involved, so it is worth checking with your accountant, lawyer or a records management professional if you are unsure.
What is the difference between onsite and offsite shredding?
Onsite shredding happens at your premises using a mobile shredding vehicle, so you can watch the process take place. Offsite shredding involves collecting your documents in secure, locked containers and destroying them at a dedicated facility. Both methods offer the same level of security when handled by a properly certified provider.
How do I know the destruction actually happened securely?
A trustworthy provider will supply a Certificate of Destruction confirming what was destroyed and when. Look for providers with NAID AAA Certification, which involves independent audits of their security processes, rather than relying on their word alone.
What can be securely destroyed besides paper?
Most providers can also securely destroy hard drives, USB drives, CDs, DVDs, ID cards and other media containing sensitive information. If you have digital media alongside paper records, it is worth asking your provider whether they can handle both in the one service.
How often should a business schedule shredding?
This depends on how much paperwork you generate. Businesses with a steady flow of confidential paperwork often use a regular scheduled collection, while others prefer an occasional bulk cleanout when archives build up. Either approach can be secure as long as documents are stored safely between collections.
Can old records be shredded if they are still within their legal retention period?
No. If a record is still required under tax law, employment law or another regulation, it should be retained until that period has passed. Secure destruction should only happen once a document has passed both its legal retention period and any business need for keeping it.
Does shredded paper get recycled?
Yes, in most cases. Reputable providers recycle shredded paper once destruction is complete, so the material is both securely destroyed and put to further use rather than sent to landfill.
Should I shred documents myself or use a professional service?
A standard office shredder can work for small, occasional jobs, but it is slower, less secure, and does not provide a Certificate of Destruction. For anything involving client, financial or health information, a professional service offers a higher and more consistent level of security, along with the documentation needed for compliance.
What should I do with a large backlog of old paperwork I am not sure about?
Start by sorting it against your retention obligations. Anything you are required to keep should be filed or scanned for safekeeping. Anything you no longer need, and are not required to retain, can go straight to secure destruction. If the backlog is large, a one off archive cleanout with a professional provider is usually the most efficient way to deal with it.
This article is general information only and does not constitute legal advice. For guidance specific to your business, speak with your accountant, lawyer or a records management professional.