Regulatory statement 123: Shredding electronic data storage media containing confidential or sensitive material

This regulatory statement (RS) is valid until 30 November 2028 by which time it will be reviewed. You should check back at that time to ensure the RS is still valid.

NRW can withdraw or amend this RS before the review date if we consider it necessary. This includes where the activities that this RS relates to have not changed.

Regulatory statement

This RS applies to storing and shredding electronic storage media containing confidential or sensitive material for data security and destruction only.

This RS cannot be used at a permitted facility.

“Electronic data storage media” is physical media used to store electronic data (such as hard disk drives, solid state drives, memory sticks, circuit boards or similar items).

This RS applies to storage and shredding which must be carried out at the waste producers site or contractors site by fixed or mobile equipment. Storage under this RS only applies to offsite temporary storage pending treatment. Storage and other ancillary pre-treatments at the site of production such as degaussing or puncturing of hard disk drives are covered under the non waste framework directive (NWFD) 2 Waste exemption: NWFD 2 temporary storage at the place of production, as the composition of the waste is unchanged following these treatments.

Any shredding of whole WEEE items for other purposes than data destruction is outside the scope of this RS and requires an environmental permit Natural Resources Wales / Waste permitting.

The European Waste Catalogue (EWC) waste code for hard drives and other components removed from WEEE items is either 16 02 15* or 16 02 16 prior to shredding. Following shredding the outputs should be coded as 19 02 04*.

See Natural Resources Wales / Identify, classify and manage waste containing persistent organic pollutants (POPs).

Conditions you must comply with

You must:

• only store and shred up to 5 tonnes of electronic data storage media at any one site in any 12 month period
• only shred electronic data storage media
• only shred whole appliances or equipment (such as phones, laptops, tablets) with embedded electronic data storage media that cannot be easily removed, after batteries and screens have been manually removed before shredding
• only shred electronic data storage media or associated whole appliances and equipment which contains confidential or sensitive material for the purposes of data security and destruction in line with a relevant standard – such as BS EN15713:2023, Centre for the Protection of National Infrastructure (CPNI) standard April 2014 by National Protective Security Authority (NPSA), or equivalent
• use equipment with appropriate abatement to prevent or minimise the release of dust and noise
• treat any shredded output containing plastic (including printed circuit boards) as persistent organic pollutants (POPs) waste unless you have firm evidence to the contrary
• POPs waste must be sent to a facility that will make sure it is irreversibly transformed or destroyed
• send the shredded waste outputs to an appropriately permitted facility
• comply with the regulations on managing hazardous waste by consigning hazardous waste for collection and transfer and by completing hazardous waste returns if applicable
• keep records for 2 years from the date of the last use of the RS to show that you have complied with this RS and make these records available to Natural Resources Wales on request

You must not recycle any waste containing POPs or mix POPs waste with other wastes for the purposes of dilution. POPs waste must be separated and sent for destruction via incineration or irreversible transformation.

Enforcement

This RS does not change your legal requirement to have an environmental permit for a waste operation when you shred electronic data storage media (such as hard disk drives, solid state drives, memory sticks, circuit boards or similar items) containing confidential or sensitive material for the purposes of data security and destruction only.

However, NRW will not normally take enforcement action against you if you do not comply with this legal requirement provided that:

• your activity meets the description set out in this RS
• you comply with the conditions set out in this RS

In addition, your activity must not cause (or be likely to cause) pollution of the environment or harm to human health, and must not

• cause a risk to water, air, soil, plants or animals
• cause a nuisance through noise or odours
• adversely affect the countryside or places of special interest