Data Protection & Freedom of Information Office

It is essential for the effective administration of the University that redundant or time expired information is destroyed routinely. Employees need to know the most appropriate method and the point in time to destroy information.

It is the responsibility of employees who select information for destruction to do so in accordance with the relevant record retention schedules, and to ensure they follow University guidelines and advice.
 
In addition, the General Data Protection Regulation (GDPR) and Freedom of Information (Scotland) Act 2002 place specific responsibilities upon us to destroy information (both paper and electronic) appropriately, i.e. in line with the agreed records retention schedule, and regularly. It may also be necessary to keep a record of its destruction.

Papers that contain information about sensitive University business, and therefore have a selected readership, (i.e.  disclosure would compromise personal privacy, financial or strategic information etc.) need to be disposed of carefully.

• If you have small amounts of papers to destroy and have access to a shredder, use it and then put the waste into your office paper-recycling bin.
• Large volumes of information about sensitive University business (i.e. information where disclosure would compromise personal privacy, financial or strategic information etc.) should be disposed of using the confidential waste service provided through Estates and Buildings.

The type of information which should be handled and disposed of confidentially includes any significant information about living people, whether they are employees, students, or have other links to the University.

Confidential disposal is a relatively expensive way of destroying information so only use it for dealing with information which warrants it.

Follow the appropriate records retention schedule, to ensure that different types of record (e.g. committee papers, individual employee files, project files) are reviewed, weeded and disposed of systematically. Doing so will meet the requirements placed on us by FOISA and the GDPR, and other external regulation.

IT Services have a policy on the disposal of IT equipment.  Further guidance on the disposal of other electrical goods and electronic equipment, including disposable media such as CDs and DVDS, can be found on the Safety and Environmental Protection Service pages.