The Bin Bag Doesn't Shred: A Thirty-Minute Clear-Out Audit for Small UK Offices

Most small organisations have a security policy that lives online and a bin store that lives in reality. The policy talks about access control and incident response. The bin store contains a half-used notebook, three old laptops, a box of lanyards and a bank statement for an account you closed ages ago. Guess which one is easier to audit?

Disposal is one of those areas where good intentions go to die. Someone leaves, a cupboard gets cleared, a charity collection is booked, and a well-meaning colleague puts everything in a sack. No malice. No plan either. For a small UK team without a facilities manager, that is how a data breach gets a lid put on it and rolled out to the pavement.

You do not need a industrial shredder or a consultant to improve this. You need half an hour, a few labels and a rule that nothing data-bearing leaves the building until someone has actually looked at it.

Start with a walk, not a policy

Pick a quiet thirty minutes and walk the route rubbish takes. Desks first. Then the printer area, the stationery cupboard, the shelf where old kit gets put because nobody wants to make a decision, reception, and finally the bin store or skip. Take a notepad or your phone. You are not there to tidy. You are there to spot what is already leaving.

Look for four things:

• Paper that identifies people or systems. Payslips, invoices, customer letters, meeting notes with names, old contracts, printouts of spreadsheets, anything with account numbers or signatures.
• Devices and media. Laptops, phones, tablets, USB sticks, external drives, SIM cards, memory cards, old backup tapes if you are unlucky enough to have them.
• Things that prove identity or access. Visitor badges, staff lanyards, keys, fobs, headed paper, compliment slips, old ID cards, stamps with your company name.
• Post that still arrives for people who left. Bank statements, HMRC letters, pension paperwork, supplier statements, anything with an address and a reference number.

Make a note of where each item is and who owns that area. If you find a laptop in a bin bag, do not just rescue it and feel virtuous. Ask how it got there. That is the control failure.

Put a hold on the bin

For the audit to mean anything, you need a temporary stop. Tell the team that nothing except food waste and genuinely empty packaging goes out for a week. Put a labelled box or locked cupboard in each area for anything that needs checking. Call it the hold area. It sounds bureaucratic; it is actually just a pause between 'we do not want this' and 'it is gone'.

If you use a shredding contractor, ask where their console is and whether it is locked. If you do not, buy a decent cross-cut shredder and put it somewhere sensible, not in a locked room nobody can access. A shredder that is inconvenient will be bypassed.

Wiping is not the same as resetting

Old kit is where small teams get caught. A factory reset on a laptop or phone is a good start, but it is not a guarantee. Some devices retain data, some cloud accounts stay signed in, and some resale routes rely on the buyer doing the right thing. You should assume the next person is curious.

For a small team, keep it simple:

• Know what you have. A basic asset list with serial numbers and who had it is worth more than a fancy policy nobody reads.
• Remove accounts before you wipe. Sign out of Microsoft 365, Google Workspace, Apple, Google and any device management tool. A wiped phone that is still locked to an old Apple ID is a brick with a data protection problem attached.
• Encrypt before you lose control. If your laptops use full-disk encryption, a proper wipe is easier to trust. If they do not, fix that for the next batch.
• Use the manufacturer's secure erase where available. For solid-state drives, ordinary overwrite tools are not always reliable. Check the manufacturer's tool or ask whoever supports your IT.
• Destroy when in doubt. For old drives, phones and anything that held customer data, physical destruction is a legitimate option. Use a reputable provider and keep the certificate of destruction.

A certificate is not magic. It is evidence that someone with a process took responsibility. Keep it with the asset record. If a device is resold or donated, note where it went and what was removed. If it is destroyed, note the date and the provider.

Charity shops are lovely; your old laptop is not automatically a gift

Donating old kit feels better than binning it, and sometimes it is the right answer. But a charity shop is not a secure IT disposal route. It may be staffed by volunteers, it may resell quickly, and it may not have the means to verify a wipe. If you donate a device, treat it as leaving your control entirely. Remove the drive or have it professionally wiped and documented first. Do the same with phones, tablets and any storage media.

The same goes for resale. A refurbished laptop can be a good buy, but your old one should not arrive with your browser history, saved passwords or a signed-in work profile. Branded lanyards and old ID cards are lower risk, but they still help someone sound plausible at reception. Shred or cut them rather than putting them in a charity bag.

The leave-the-building checklist

Before anything goes out, someone should be able to answer five questions:

1. What is it? Paper, device, media, badge, post or furniture.
2. Who owned it? A person, a team or a supplier.
3. What data could it hold? Customer, staff, financial, supplier or none.
4. What have we done to it? Shredded, wiped, destroyed, returned or donated.
5. Where is the evidence? A certificate, a log entry or a named person who checked.

If you cannot answer question five, you do not have a disposal process. You have a hope.

Make it stick without a facilities team

You do not need a committee. Put the hold area somewhere visible, name one person as the disposal checkpoint, and add a line to the leaver checklist: 'Clear desk and cupboard; hand kit to [name]; do not bin it.' Book a quarterly fifteen-minute check of the bin store and the old-kit shelf. Add unwanted post to the same routine: open it, note anything that needs action, shred the rest, and tell suppliers to update their records.

A wheelie bin is not a security control. But a thirty-minute audit, a labelled hold box and a signed wipe record will stop your rubbish from becoming someone else's opening line.