Your patients trust you with some of their most sensitive information. X-rays, treatment records, medical histories: all of it is classified as special category data under GDPR, and all of it must be destroyed securely once the retention period ends.
PaperMountains provides BSEN 15713-compliant, ICO-registered confidential document shredding for dental practices across London and the South East. We collect from your surgery, destroy securely, and issue a signed certificate of destruction for every single service.
Call 0808 281 1100 or chat online to get a clear, no obligation quotation.
Why Dental Practices Need a Certified Secure Shredding Service
Dental records are not ordinary business paperwork. Under GDPR, patient health information is classified as special category data, which carries stricter obligations than standard personal data. The Information Commissioner's Office (ICO) can fine practices up to £17.5 million or 4% of annual turnover for serious breaches. CQC inspections routinely ask practices to demonstrate that they have a compliant data destruction process in place.
If patient records are going into a general waste bin, a recycling bag, or even a standard office shredder, your practice is carrying a risk that could cost far more than the fix.
A certified document shredding service removes that risk entirely. You get a clear, auditable chain of custody from collection to destruction, a certificate of destruction you can produce at any inspection, and the confidence that patient data cannot be reconstructed.
PaperMountains is registered with the ICO as a Data Controller and holds Environment Agency Upper Tier Waste Carrier status. Every member of staff who handles confidential material is security-vetted, and every collection vehicle is tracked throughout its route.
GDPR and CQC: What Your Practice Must Be Able to Prove
Article 5 of GDPR, the accountability principle, requires you to be able to demonstrate that your practice complies with data protection law. That means keeping written records of what you destroy, when, and how.
For dental practices: NHS dental records must be kept for a minimum of 11 years after the last entry, or until the patient reaches the age of 25, whichever is the later date. For records where treatment started when the patient was a minor, the period runs until the patient turns 25 or for 11 years from the last treatment, whichever is longer.
Private dental records : should follow General Dental Council guidance, which recommends a minimum retention period of 11 years for adult patient records.
Once the retention period has passed, records must be disposed of securely. Keeping them in storage indefinitely does not meet your obligations.
CQC inspectors look for evidence that your practice has a documented, consistent process for patient data disposal. A certificate of destruction from a BSEN 15713-compliant provider is one of the strongest pieces of evidence you can put in front of an inspector.
When you use PaperMountains, every service generates a signed, dated certificate of destruction. You keep it on file. If an inspector asks, you have it ready.
How the Collection Service Works
Setting up takes one call. After that, the service runs on your terms.
Secure, locking consolesWe supply lockable consoles or bins in sizes to suit your surgery. Reception, treatment rooms, and back-office areas can all have their own units. Documents go straight in and stay secure between collections.
No sorting requiredYou do not need to remove staples, separate X-ray films from paper records, or sort by document type. Our team handles all preparation before destruction.
Scheduled collections or one-off clearancesWe run regular collection routes across Kent, London, and the South East. If you need a one-off clearance because you are closing a practice, changing premises, or clearing long-term archive boxes, we can arrange that separately.
Security-vetted staff and full chain of custody documentationEvery collection follows a documented chain of custody from your premises to our destruction facility. The operative collecting your material is security-vetted, the vehicle is GPS-tracked, and paperwork is completed at every stage.
BSEN 15713 and GDPR compliant throughout
We operate to BS EN 15713, the British Standard for secure destruction of confidential material. The process meets GDPR requirements for the disposal of patient data, including special category health records.
Clear, fixed quotations with no hidden charges
The price in your quote is the price on your invoice. No surcharges, no extras.
Your Certificate of Destruction
A certificate of destruction is not optional for dental practices. It is the document that proves your patient records were disposed of in line with your GDPR obligations and CQC requirements.
Every PaperMountains certificate of destruction includes:
- ✔The date of collection and destruction
- ✔A description of the material and approximate volume destroyed
- ✔A reference number linked to the collection record
- ✔Our company credentials, including ICO registration and Environment Agency status
Keep each certificate on file in line with your practice's data governance policy. If the CQC inspects you, the ICO audits you, or a patient makes a Subject Access Request that raises questions about their record, you have documented proof that disposal was handled correctly.
Some providers treat the certificate as an add-on. We issue one as standard with every service.
Frequently Asked Questions
How long must a dental practice keep patient records?
For NHS dental patients, records must be kept for a minimum of 11 years after the last treatment date, or until the patient turns 25, whichever is later. Where treatment started when the patient was a child, the period runs to age 25 or 11 years from the last entry, whichever is longer.
Private practices should follow General Dental Council guidance, which recommends the same 11-year minimum for adult patients. When in doubt, check with your dental defence organisation for advice specific to your situation.
What happens to patient records when a dental practice closes?
Records must not simply be discarded. When a practice closes or transfers to new ownership, patient records remain subject to GDPR and must either be transferred to the receiving practice, retained by the responsible dentist, or securely destroyed if they have passed the retention period. A certificate of destruction is required for any records that are destroyed. PaperMountains handles practice closures and archive clearances as a standard part of the service.
Do I need a certificate of destruction for patient records?
Yes. The GDPR accountability principle requires you to demonstrate that patient data was disposed of securely. A signed certificate of destruction from a BSEN 15713-accredited provider is the accepted standard. Without one, you cannot prove compliant disposal if you are ever audited or inspected.
Is shredding patient records GDPR compliant?
Shredding is one of the most secure methods of physical document disposal and is GDPR compliant when carried out by an accredited provider working to the correct security level. The key requirements are that the destruction meets BS EN 15713 standards, the chain of custody is fully documented, and a certificate of destruction is issued. PaperMountains meets all three requirements on every collection.
What is special category data under GDPR?
Special category data is personal information that carries additional protection because of its sensitive nature. Health records, including dental records, fall into this category under Article 9 of GDPR. Practices processing special category data must have a lawful basis and an additional condition under Schedule 1 of the Data Protection Act 2018. The obligation to securely destroy this data at the end of its retention period is stricter than for standard personal data, and the consequences of a breach are correspondingly more serious.
Book a collection or request a quote today
PaperMountains serves dental practices across London, Kent, Surrey, Sussex, Essex, and the wider South East.
Call 0808 281 1100 or contact us for a clear, no-obligation quote. We will confirm pricing, suitable console sizes, and a collection schedule that works around your surgery hours.
We are registered with the ICO as a Data Controller, hold Environment Agency Upper Tier Waste Carrier status, and operate to BSEN 15713 for all secure destruction services. Every service includes a signed certificate of destruction as standard.