Start a paper-record audit with one storage location and follow a sample file through its life: arrival, access, retrieval, retention review and disposal. HR, compliance, facilities and records managers should be able to show who owns each decision and what evidence proves it happened.
Use the audit below to turn a storage policy into checks that produce named actions and deadlines. The roles, evidence and review triggers are suggested operating arrangements. Adapt them to your organisation’s risks; they are not a statutory inspection timetable.
Set the audit scope
List the cupboards, archive rooms and external facilities holding personal data, then choose a sample across locations and record types. Include files with sensitive information, files due for disposal and files recently moved. Record the sample and why you chose it so the next reviewer can understand its limits.
For non-automated processing, Article 2 covers personal data forming, or intended to form, part of a filing system. Other material and territorial scope provisions also matter. This guide uses EU GDPR requirements, including an Irish enforcement example; UK organisations should check the applicable UK framework before adopting it as their compliance checklist.
Use an evidence-based control table
| Control | Accountable role | Evidence to inspect | Review trigger | Remediation |
|---|---|---|---|---|
| Inventory and traceability | Records manager; each business owner confirms their files | Location register, box references, transfer log and sample retrieval results | New storage site, transfer, missing box or owner change | Reconcile unlisted boxes; assign ownership; record and verify transfers |
| Physical security and condition | Facilities manager, with records owner signing off suitability | Access permissions, key register, inspection findings and evidence of repairs | Water ingress, forced entry, pest damage, premises change or planned risk-based review | Restrict access; protect affected files; move records from unsafe storage and verify the new location |
| Retention decisions | Business records owner, supported by legal/compliance | Purpose, retention trigger, relevant legal requirement, review date and hold register | Purpose ends, retention trigger reached, litigation hold starts or ends, or requirement changes | Separate disposal candidates; confirm holds and continuing need; approve a documented decision |
| Secure disposal | Records manager; business owner authorises disposal | Approved disposal list, collection trace and destruction certificate or equivalent record | Approved disposal date or failed reconciliation | Investigate missing evidence; confirm what was destroyed; correct the contractor process |
| Breach readiness | Incident lead; controller’s authorised decision-maker owns notification | Awareness timeline, affected records, risk assessment, decisions and exercise results | Missing files, unauthorised access, damaged records or a planned exercise | Contain the incident; preserve evidence; assess Articles 33/34 promptly; track remedial action |
For each row, record the evidence reference, finding, action owner, due date and person who will verify closure. A missing access log or destruction record is a finding to investigate; do not fill the gap with an assumption that the control worked.
Test storage and retention decisions
A locked room can still leave records vulnerable to water damage or make needed files impossible to retrieve. Article 32 requires security appropriate to the risk and regular testing, assessment and evaluation of security measures. Inspect access arrangements and the physical condition of a sample of files, and test retrieval. Set and document your review frequency using the sensitivity of the records, site conditions and previous failures. Article 32 does not set one inspection interval for every archive.
The storage limitation principle requires identifiable data to be kept no longer than necessary for its purposes. Longer retention solely for public-interest archiving, scientific or historical research, or statistical purposes is subject to Article 89(1) and appropriate safeguards. There is no universal GDPR retention period for paper files.
Map each record category to a documented retention trigger and disposal method. Before approving destruction, check applicable statutory retention obligations, legal holds and continuing care, legal or regulatory purposes. Confirm the purpose has ended and no applicable requirement calls for continued retention. Use secure destruction arrangements and retain a certificate or equivalent audit trail. Sample files regularly to check whether approved disposal decisions have been carried out.
If a file is on hold, record the reason, who authorised it and the next review trigger. Do not destroy it merely because the routine schedule has expired. Ask legal or compliance to resolve an uncertain statutory requirement or continuing purpose before authorising disposal.
A short HSE example
The Irish DPC fined the Health Service Executive €645,000 in a decision notified on 25 August 2026. Its decision summary records damaged paper files and insecure storage, alongside excessive retention and breach-response failures. Corrective orders required facility audits, record tracking, safe destruction of unnecessary records and regular testing. These were orders to the HSE, not a universal timetable for other organisations.
Apply that example to the table: can a records owner locate a sample box, demonstrate why its contents are retained and show that the storage site protects them? If any answer lacks evidence, open a finding with an owner and verify the remedy before closing it.
Test escalation and notification
Use a missing-box or unauthorised-access exercise. Check that staff secure the site, preserve evidence and tell the incident lead promptly. The lead should establish the awareness timeline, affected information and likely consequences, then record separate decisions about notifying the regulator and communicating with people.
Under Article 33, a controller must notify the competent supervisory authority unless the breach is unlikely to result in a risk to people’s rights and freedoms. Notification must be without undue delay and, where feasible, within 72 hours of awareness. A notification after 72 hours must explain the delay. If all required information cannot be provided together, Article 33(4) permits phased information without undue further delay. Do not wait for a complete investigation before starting escalation and notification.
Under Article 34, a breach likely to result in a high risk requires communication to affected people without undue delay, subject to the Article 34(3) conditions. These cover applied protection measures that make the data unintelligible to unauthorised people, subsequent measures that remove the likelihood of high risk, and disproportionate effort. The last condition requires an equally effective public communication or similar measure. Record the separate decisions about regulatory notification and communication to people.
Keep a breach record covering the facts, effects and remedial action, as required by Article 33(5). Record the reasoning for notification decisions too. Audit the exercise for delays between facilities staff discovering a problem and the authorised decision-maker receiving the evidence.
Close findings with proof
Choose a high-risk location for the first audit. Give each finding a named owner and a due date proportionate to the risk; urgent exposure needs immediate containment. At follow-up, check the repaired lock, reconciled inventory or disposal evidence directly. An email saying an action is complete is a starting point for verification.
Use our staff training checklist to support staff awareness alongside this audit. Put the next review trigger and the person responsible for it in the audit record.
Frequently asked questions
How often should we audit paper-record storage?
Set a documented frequency based on risk and add reviews after incidents or changes to premises, access or storage arrangements. Article 32 requires regular assessment of security measures but specifies no universal archive-inspection interval.
What evidence shows retention is under control?
Keep a record inventory, documented purposes and retention triggers, named owners, hold decisions and evidence of approved disposal. Sample files to confirm the schedule operates in practice. Resolve statutory requirements, legal holds and continuing purposes before destroying records.
Does GDPR security apply to paper records?
For non-automated processing, Article 2 brings personal data within GDPR’s material scope when it forms, or is intended to form, part of a filing system. Paper files meeting that condition are subject to the appropriate technical and organisational security measures required by Article 32. Assess the filing arrangements and other applicable scope provisions rather than assuming every loose piece of paper is covered.
What is the GDPR 72-hour breach rule?
Under Article 33, notify the competent supervisory authority unless the breach is unlikely to result in a risk to people’s rights and freedoms. Act without undue delay and, where feasible, within 72 hours of awareness. Explain late notification and provide unavailable information in phases without undue further delay. Document the breach, its effects, remedial action and the risk assessment, including a decision not to notify.
