GDPR and Physical Document Storage: What the Law Actually Requires Beyond Encryption

Ask most businesses how they handle GDPR and the answer is almost always about IT: encrypted databases, access logs, password policies. Paper records get mentioned far less often, if at all, despite being covered by exactly the same regulation. A filing cabinet with a personnel file in it carries the same legal duties as a server holding the same data.

GDPR Doesn't Stop at the Server Room

UK GDPR applies to personal data regardless of the format it's held in, and a huge amount of personal data in most organisations still exists on paper: HR files, medical forms, client records, safeguarding paperwork, signed contracts. Treating physical storage as somehow outside the scope of data protection law is a genuine, common gap, not a technicality.

What "Appropriate Technical and Organisational Measures" Means for Paper

GDPR requires "appropriate technical and organisational measures" to protect personal data, a deliberately broad phrase that applies as much to a locked cabinet as it does to encryption software. For physical records, that generally means controlled access, secure storage proportionate to sensitivity, and a clear record of who can reach a given file. A stack of folders on an open shelf in a shared office rarely meets that bar, whatever the organisation's IT security looks like.

Locked Storage as a Baseline Control

Lockable storage is one of the simplest, most defensible controls an organisation can point to if it's ever asked how personal data on paper is protected. Our guide to security cages and lockable storage covers the options for higher-value or higher-sensitivity material specifically, while everyday active files still need a properly lockable cabinet or drawer rather than an open run of shelving.

Segregating Records by Sensitivity

Not every paper record carries the same risk. Special category data, health information, safeguarding records, disciplinary files, generally needs tighter physical segregation and more restricted access than routine correspondence or general admin paperwork. Storing everything in one open-access filing run makes it far harder to demonstrate that access was actually limited to those who needed it, which matters if a data subject access request or a breach investigation ever asks the question directly.

Access Control and Who Can Actually Open the Cabinet

A locked cabinet only helps if it's actually clear who holds the key, or who has the code, and that list doesn't quietly grow over time as staff change roles. Reviewing who has physical access to sensitive records periodically, the same discipline most organisations already apply to IT system permissions, closes a gap that's easy to overlook once a cabinet has been locked and largely forgotten about.

Retention, Disposal and Why Storage Doesn't End When a File Closes

GDPR's storage limitation principle applies just as much to paper as to databases: personal data shouldn't be kept longer than necessary, and secure disposal matters as much as secure storage while a file is active. Our guide to document storage systems covers planning archive storage around retention schedules in more detail; the point worth adding here is that a retention schedule is only as good as the physical storage discipline that enforces it, closed files moved to proper archive storage and disposed of on schedule, rather than left indefinitely in an active filing cabinet because nobody revisited them.

Final Thoughts

GDPR compliance for paper records isn't a separate project from IT security, it's the same set of duties applied to a different format. Lock what needs locking, segregate what's sensitive, control who has access, and dispose of what's past its retention date, and physical storage stops being the overlooked half of your compliance picture.