Who is liable if my documents are destroyed in a fire at an archive storage facility?

Under the UK GDPR you remain the data controller and ultimately liable to the ICO and to data subjects for any personal data lost. Contractually, most archive providers limit their financial liability to a small per-box amount (often £1–£5). Your own commercial insurance should name the off-site archive as a covered location, and irreplaceable records should be digitised as a separate safeguard.

How quickly must my archive provider notify me of a security incident?

Under UK GDPR, controllers must report notifiable personal data breaches to the ICO within 72 hours. To meet that deadline, your contract should require the provider — as your data processor — to inform you within 24 hours of any confirmed or suspected incident, with enough detail to identify the records and individuals affected.

Can wet paper records actually be recovered after a flood?

Yes, if action is fast. Freezing wet documents within 48 hours halts mould growth and allows vacuum freeze-drying to recover most records in readable condition. Beyond 72 hours, mould and ink bleed make recovery much harder. A serious archive provider will have specialist recovery partners on retainer and a written wet-recovery procedure.

What certifications should a UK archive storage provider have?

Look for ISO 27001 (information security) covering the records centre itself, BS 7858 staff screening, BAFE-accredited fire system servicing, NSI- or SSAIB-accredited security installation, and an Alarm Receiving Centre at BS 5979 Cat II. Membership of recognised industry bodies is a useful additional signal but not a substitute for the certifications above.

What's the single best way to protect critical records against any incident?

Digitise them. A scanned, indexed copy stored on a separate, backed-up system means no single fire, flood, or security incident at the physical archive can destroy your access to those records. Combine high-quality off-site storage with selective backfile scanning of your most critical files for genuine resilience.

What Happens If Your Archive Storage Provider Has a Fire, Flood, or Security Incident?

If your archive storage provider suffers a fire, flood, or break-in, the consequences for your business depend almost entirely on three things: how the facility was built, what continuity plans the provider has, and what’s written into your contract. A well-run UK records centre with fire suppression, flood mitigation, and audited security can absorb a serious incident and still hand back every box. A poorly run one can wipe out decades of records overnight — and leave you holding the GDPR, legal, and operational fallout.

Here’s what actually happens when things go wrong at an off-site archive, what to ask before you sign, and how the better UK providers reduce the risk in the first place.

What a fire at an archive storage facility actually looks like

Paper records are fuel. A standard archive box holds roughly 12–15 kg of paper, and a typical UK records centre stores hundreds of thousands of them in steel racking up to 12 metres high. Once a fire takes hold in that environment, manual intervention is almost impossible — outcomes depend on whether the building has the right passive and active protection from day one.

What proper fire protection looks like

Compartmentation — fire walls and shutters dividing the warehouse into separate cells so a single zone can’t take down the whole building
VESDA (Very Early Smoke Detection Apparatus) — air-sampling systems that detect smoke long before a sprinkler would trigger
Wet or pre-action sprinklers — pre-action systems require a smoke detection event and a heat trigger before water is released, reducing accidental discharge
24/7 ARC-monitored alarms connected to a BS 5979 Cat II Alarm Receiving Centre
BAFE-accredited servicing of extinguishers and detection systems on a documented schedule

If your provider can’t tell you which of these they have — or won’t let you walk the building to verify — that’s a red flag worth acting on. Our guide to secure document storage covers what a properly built UK records centre should look like.

What happens if a records centre floods

Flooding is the more common, less dramatic risk. Burst pipes, blocked drainage, sprinkler malfunctions and surface-water flooding all cause damage every year in UK commercial property. According to the Environment Agency, around 5.5 million properties in England are at risk of flooding from rivers, sea, or surface water. A records centre on a flood plain — or with poor drainage — is gambling with your archive.

What a competent provider does about it

Site selection above Environment Agency Flood Zone 1 wherever possible, with documented flood risk assessment
Boxes stored off the floor on steel racking — typically 100–150mm clear minimum, never directly on concrete
Bunded chemical/water stores, leak detection on sprinkler mains, and quarterly drain checks
Documented water-damage recovery procedure: freeze-drying, vacuum freeze-drying, or air-drying within 48 hours to prevent mould
Specialist recovery partners on retainer (e.g. for vellum, parchment, and bound volumes)

Wet paper that isn’t frozen within 48 hours starts to bloom with mould. After 72 hours, recovery rates drop sharply. A provider without a written recovery plan is, in practice, telling you they’ll lose the records.

What “security incident” really means — and what’s at stake

A security incident is broader than a break-in. It includes unauthorised access by staff, contractor errors, lost boxes in transit, mis-delivery, and any event where the chain of custody breaks. Under the UK GDPR and Data Protection Act 2018, you — the data controller — remain liable for personal data your processor mishandles. The ICO can issue fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, and has done so for breaches involving lost or improperly handled paper records.

If a provider can’t tell you within 24 hours which boxes were affected, who accessed them, and when — you’ll struggle to meet the ICO’s 72-hour breach reporting deadline. That alone can turn a contained incident into a regulatory one.

What good security looks like at an archive

ISO 27001 certification with documented scope covering the records centre itself
BS 7858-screened staff (the UK standard for security screening in trusted environments)
Barcoded box tracking with full audit trail — every scan logged at intake, movement, retrieval, and return
CCTV with 90-day retention, access-controlled zones, and intruder alarms graded to BS EN 50131
GPS-tracked vehicles, two-person collections for sensitive material, and tamper-evident transit seals

What your contract should say (and usually doesn’t)

Most off-the-shelf storage contracts limit the provider’s liability to a tiny per-box figure — often £1 to £5 per box — regardless of what’s inside. That clause exists because providers can’t realistically insure the actual replacement cost of every client’s records. Your job is to know that going in, and to insure or mitigate accordingly.

Liability cap — read it. If it’s £2 per box, that’s what you’ll get
Business continuity — does the contract commit the provider to alternative-site recovery within a stated RTO?
Insurance — your own commercial insurance should name the off-site archive as a covered location with appropriate sum insured
Breach notification — written commitment to inform you of any incident within 24 hours, not “as soon as reasonably practicable”
Digital backup — for irreplaceable records, scanning is the only real insurance. See our document scanning service for backfile and scan-on-demand options

How to reduce the risk before anything goes wrong

Tour the facility before signing — fire compartments, racking, CCTV, and access control are all visible in a 30-minute walk
Ask for the most recent ISO 27001 audit summary, BAFE/NSI fire and security certificates, and the provider’s last flood-risk assessment
Digitise high-value or irreplaceable records — vital records (board minutes, contracts, IP, master deeds) should never exist only on paper in one location
Run a tabletop test: ask your provider to produce three specific boxes within their contracted SLA. If they can, the audit trail is real
Review your insurance schedule annually against the actual volume held off-site

For more on choosing the right partner, browse our other resources and guides on UK document storage and scanning.

The bottom line

Fires, floods, and security incidents at archive facilities are rare but not theoretical. The difference between a survivable incident and a catastrophic one is engineering, process, and paperwork — fire compartmentation, raised racking, ISO-certified controls, BS 7858 staff, and a contract that actually commits the provider to recovery. If your current provider can’t evidence all of that, the safest assumption is that you’ll be the one absorbing the loss when something goes wrong.