Can I legally destroy original documents after scanning them in the UK?

In most cases yes. Under the Civil Evidence Act 1995 copies are admissible in English civil courts, and HMRC accepts electronic copies of most business records. Working to BS 10008 gives you the process evidence to show a scan is a faithful reproduction. A small set of documents — deeds, wills, share certificates, notarised originals and some guarantees and leases — should still be kept in paper form.

How long should I keep original documents after scanning?

Hold them for a quarantine period of 30 to 90 days while you verify the scans. Thirty days is a practical minimum; 90 days suits regulated sectors and high-value archives. Use the window to reconcile page counts, check legibility, test index accuracy and confirm backups before authorising destruction.

What is a Certificate of Destruction and why does it matter?

It is the documentary evidence that confidential material was securely destroyed. A useful certificate states what was destroyed, the volume, the date, the facility and the specific box or batch references, so it links directly to your retention schedule. A vague certificate covering an unspecified consignment provides little defence in an ICO investigation.

Is keeping the paper as well as the scans the safest option?

Usually not. Holding two copies of the same personal data doubles your breach exposure and conflicts with the UK GDPR storage limitation principle, as well as costing space and money indefinitely. A written exception list identifying the few documents that genuinely need to stay in paper is safer than keeping everything by default.

What shredding standard should be used for scanned originals?

Look for a provider working to EN 15713 for secure destruction, with vetted staff, sealed transport and an auditable facility. Cross-cut shredding to DIN 66399 level P-4 is a sensible default for business records containing personal data, with P-5 for highly sensitive material.

Best Way to Handle Original Documents After Scanning

The best way to handle original documents after scanning is to hold them in secure storage for a defined quarantine period — typically 30 to 90 days — then destroy them under a certificated shredding process, with a written exception list of originals that must be kept in paper form permanently. Deciding what happens to the paper before the scanner starts is what separates a clean digitisation project from a warehouse full of boxes nobody dares throw away.

Why the Paper Doesn’t Just Disappear

Most UK businesses assume digitisation ends when the last file is indexed. In practice the boxes come back from the bureau, get stacked in a corridor and stay there for years, and the original driver for the project — space and risk — quietly evaporates.

There are three reasons the paper lingers. Nobody wants to be the person who authorised destroying something that later turns out to be needed. The legal position feels murky — teams half-remember that “originals matter” without knowing where that actually applies. And no one budgeted for disposal, so shredding never gets scheduled. All three are solved by a written post-scan policy agreed at the start of the project rather than improvised at the end.

What UK Law Actually Says About Destroying Originals

English civil courts do not require paper originals as a rule. Under the Civil Evidence Act 1995, a copy of a document is admissible regardless of how many removes it sits from the original, provided the copy is authenticated in a way the court approves. In practice this means a scan produced under a documented, consistent process is normally accepted.

The relevant guidance is BS 10008, the British Standard for the evidential weight and legal admissibility of electronic information. It doesn’t make scans legally valid in itself — it sets out the process controls (audit trails, version control, image quality checks, access management) that let you demonstrate a scan is a faithful reproduction if challenged. A provider working to BS 10008 gives you the evidence chain; a provider who has never heard of it gives you a folder of JPEGs.

HMRC takes a similar line: most business records can be kept electronically provided the images are legible and complete. The Data Protection Act 2018 and UK GDPR push the other way — keeping personal data in paper once you hold a digital copy means two sets of the same data, doubling breach exposure and undermining the storage limitation principle.

The Exceptions That Must Stay in Paper

A short list of document types genuinely needs the wet-ink original kept:

Deeds, title documents and anything executed as a deed under seal
Original wills, grants of probate and powers of attorney
Share certificates, bearer instruments and negotiable instruments
Documents requiring an apostille or notarised original for overseas use
Certain guarantees, bonds and leases where the counterparty or lender demands the original
Original certificates — birth, marriage, professional qualification — held on behalf of others

Everything else is usually a candidate for destruction after scanning. The exception list should be written down, signed off by whoever carries legal responsibility in your business, and reviewed annually — not held in one person’s head.

The Quarantine Period: Your Safety Net

Never destroy originals the day the scans arrive. A quarantine window — the paper sits in secure storage while the digital files are verified — catches problems while they’re still fixable.

Thirty days is the practical minimum; 90 days suits regulated sectors or high-value archives. Use that window for genuine verification, not a box-ticking spot-check:

Page count reconciliation — total images against the pre-scan count for every box, not a sample
Legibility review — a percentage sample opened at full size, checking small print, stamps, handwritten annotations and signatures
Index accuracy — search for 20–30 known files by reference and confirm each returns the right document
Colour and double-sided checks — highlighted text, coloured stamps and reverse pages are the usual casualties
Backup confirmation — the images exist in at least two locations, and a restore has been tested

A worked example: a firm scanning 400 boxes at roughly 2,500 sheets a box produces around a million images, so a 1% sample is 10,000 images — unrealistic to review by hand. Reconcile page counts across 100% of boxes automatically, then eyeball 200–300 images weighted towards the difficult material: older files, carbon copies, poor-quality faxes, anything handwritten.

If the paper sits off-site during quarantine, keep it retrievable — off-site document storage with barcoded boxes you can recall within hours if verification throws up a gap.

Secure Destruction: Doing It Properly

Once quarantine ends and the exception list is set aside, the remaining paper should be destroyed — not put in the recycling, not left for a general waste contractor. Look for a shredding process that meets EN 15713, the European standard for secure destruction of confidential material, with vetted staff, sealed transport and a facility you can audit. Cross-cut shredding to at least DIN 66399 security level P-4 is the sensible default for business records containing personal data; P-5 for anything genuinely sensitive.

The output that matters is the Certificate of Destruction. It should state what was destroyed, the volume, the date, the facility, and the specific box or batch IDs. “1 consignment, confidential waste” tells an ICO investigator nothing; barcoded box numbers tie destruction straight back to your retention schedule.

A certificated shredding service that already holds your boxes can destroy against the same barcodes used at intake — no reconciliation exercise, no ambiguity about what went where.

Update Your Records, Not Just Your Shelves

Destruction isn’t finished until the paperwork reflects it. Record the date against each batch in your retention schedule, file the certificate somewhere findable, and mark the digital record as the sole surviving copy. UK GDPR accountability means showing what you hold and why — a register still listing boxes destroyed 18 months ago fails that test.

Building the Policy Before You Scan

The cheapest time to decide what happens to the originals is before a single box leaves your office. Agree these five points and write them into the project brief:

Default disposition — destroy after quarantine, unless on the exception list
Quarantine length — 30, 60 or 90 days, and where the paper lives during it
Verification standard — what “passed” means, in measurable terms, and who signs it off
Exception list — the document types that stay in paper, with the reason for each
Destruction method and evidence — standard, security level, and certificate detail required

Skip this and you pay twice: once to digitise, then again to store paper nobody authorised anyone to destroy. Where the exception list runs longer than expected — common in legal, property and financial services — a hybrid model works best: a small permanent paper archive alongside full digital access. Our records management guides cover how the two fit together.

Handled well, the post-scan phase is where a digitisation project finally pays back: floor space genuinely released, duplicate data risk closed off, a certificate behind every destroyed box. Handled badly, you’ve added a digital copy to a paper problem you still own. Planning it alongside your document scanning project costs nothing at the outset.