South: GDPR also covers printed records, experts warn

Businesses are being warned there could be as many as 30 million out-of-date boxes in warehouses around the country - acting as at ticking data time-bomb.

For years, companies have outsourced storage of millions of boxes filled with papers and records, sometimes for legal reasons because they have to be kept and sometimes for convenience.

But information management experts Crown Records Management say up to 15% of boxes stored are past their 'destroy date' and being kept unnecessarily.

That has huge data protection issues when the EU General Data Protection Regulation (GDPR) comes in on May 25 - because companies will need to know what personal data they hold, where it is and be able to edit or delete it on demand.

David Fathers, regional general manager at Crown Records Management, said: "This is a far bigger problem than people realise because GDPR doesn't only apply to digital data, it applies to physical data on paper too.

"That means keeping boxes full of records when you don't need to - and especially when you have no idea what they contain - is a ticking data time bomb. It could cost businesses a lot of money and in the worst case scenario lead to data breaches and big fines.

"Getting accurate figures on the number of boxes affected across the country is difficult because of the mix of outsourced managed items and ‘in-house’ storage facilities and then there is also self-storage or removals companies that house documents too. Our company alone stores millions of cartons of documents and we estimate that around 15% are either past their destroy date, or have been kept for over 10 years having never been accessed.

"Based on that, our estimate is that the total number of outsourced boxes alone is between 150m-200m - and that could mean a staggering 22.5-30m cartons which are being kept unnecessarily.”

Businesses are being advised to either destroy boxes which no longer need to be kept or at the very least know why they are keeping them.

Fathers added: "A lot of people are keeping these boxes 'just in case' or because or they don’t know what’s in them – or because they are worried about throwing something away which will miraculously become useful in the future.

"But that is a false economy. Under GDPR companies really need to know what data they are storing and where it is.

"The regulation gives citizens new rights to ask for their data to be edited or deleted and so paying to store 'mystery boxes' really is bad news."