What security certifications should a document scanning company have?

ISO 27001 is the key certification for information security management, showing security is audited as a system rather than left to habit. ISO 9001 covers quality management, and BS EN 15713 governs secure destruction if originals are shredded after scanning. Always check certificates are current and cover the site actually doing your work.

Is a scanned document legally acceptable in the UK?

In most cases, yes. UK courts and HMRC generally accept good-quality scanned copies of business records, provided the digitisation process is reliable and documented. Some documents — such as certain original deeds and signed agreements — may still need to be kept in physical form, so a competent provider will help you identify which categories to retain before anything is destroyed.

Do I need a data processing agreement with a scanning provider?

Yes. Under Article 28 of UK GDPR, a data controller must have a written contract with any processor handling personal data on its behalf. The agreement should cover confidentiality, security measures, use of sub-processors, breach notification, and what happens to your data and documents when the project ends. A compliant bureau will provide this as standard.

How do scanning companies make sure no pages are missed?

Reliable bureaus record page counts per file during document preparation, then reconcile scanned image counts against those figures after capture. Combined with image-level quality checks for skew, cropping, and legibility, plus verification of index fields, this catches missing or unreadable pages before files are delivered — not years later during an audit.

What happens to original documents after scanning?

You have three options: certified destruction to BS EN 15713 with a certificate of destruction, return of the originals to your premises, or ongoing off-site storage for documents that must be kept in physical form. The right mix depends on your retention obligations — many businesses destroy the bulk of scanned files and store only the categories the law requires as originals.

What Makes a Document Scanning Service Secure, Accurate, and Compliant?

A document scanning service is secure, accurate, and compliant when it can demonstrate three things: controlled custody of your documents from collection to return or destruction, a quality process that catches missed pages and poor images before delivery, and documented alignment with UK data protection law — UK GDPR, the Data Protection Act 2018, and the retention rules that apply to your sector. Plenty of providers claim all three. Far fewer can evidence them. This article breaks down exactly what to look for under each heading, so you can separate genuine capability from brochure language.

Security: Custody, Not Just Cameras

Security in a scanning project is mostly about custody — who has your documents, where, and can the provider prove it at every stage. CCTV and an alarm system are the baseline; the real markers sit in the process.

Chain of Custody From Collection Onwards

A secure provider logs every box at collection, transports in vetted vehicles with tracked manifests, and books each box into their facility with a barcode or equivalent audit trail. If you ask “where is box 47 right now?” during the project, they should be able to answer within minutes — not by ringing round the production floor. This matters legally as well as practically: if a document goes missing and its contents include personal data, that may be a reportable breach under UK GDPR, and the ICO will expect evidence of who handled it and when.

Facility and Staff Controls

Look for access-controlled production areas, DBS-checked or security-vetted staff, signed confidentiality agreements, and a clean-desk policy on the scanning floor. Ask how digital files are handled too: encrypted storage, encrypted transfer (SFTP or a secure portal, never email attachments for sensitive material), and deletion of working copies once you’ve confirmed receipt. BS EN 15713 covers secure destruction if originals are shredded afterwards; ISO 27001 certification is the strongest signal that information security is managed as a system rather than a set of habits.

Accuracy: What a Real Quality Process Looks Like

Accuracy failures are the quiet killer of scanning projects. A missed page in a legal file or a mis-indexed HR record may not surface for years — usually at the worst possible moment, mid-audit or mid-dispute. A provider serious about accuracy will be able to describe their quality control in concrete steps:

Document preparation — staples, clips, and folds removed; damaged pages repaired or flagged; page counts recorded per file before scanning, so missing pages are detectable afterwards.
Image QC — a defined sampling rate (many bureaus check 100% of images on regulated work), with rescans for skew, cropping, and legibility failures rather than “fixing” them in software.
Indexing verification — double-keying or automated validation on index fields, because a perfectly scanned file with the wrong reference number is effectively lost.
OCR confidence reporting — if you’re paying for searchable files, ask what character-accuracy levels they achieve on documents like yours and how low-confidence pages are handled.
Reconciliation — a final count matching files out against files in, signed off before originals are stored or destroyed.

If a provider can’t walk you through these stages without hesitation, assume they don’t exist. A short pilot batch — a few hundred representative files — is the cheapest way to test the claims before committing a full archive.

Compliance: The UK Legal Framework Your Provider Must Work Within

Outsourcing scanning doesn’t outsource your legal responsibility. Under UK GDPR you remain the data controller; the scanning bureau is your data processor, and Article 28 requires a written contract covering confidentiality, security measures, sub-processors, and what happens to the data when the work ends. A compliant provider will offer this data processing agreement without being asked — it protects them as much as you.

Beyond the contract, check that the provider understands the retention rules that shape your project. HMRC generally expects business records to be kept for six years; employers’ liability insurance records and many HR documents carry their own periods; some pension and medical records must be held for decades. A good bureau will help you scan-and-destroy where the law allows digital copies to stand in for paper, and flag categories — such as certain deeds and original signed agreements — where the physical original still matters. If originals are destroyed, destruction should follow BS EN 15713 with a certificate of destruction for your records; if they’re retained, secure off-site document storage keeps them protected and retrievable without taking back office space.

The cost of getting this wrong is real: the ICO can fine up to £17.5 million or 4% of global turnover for serious UK GDPR infringements, and even minor incidents consume management time and client trust that no scanning saving offsets.

Questions That Separate Genuine Providers From the Rest

When you’re comparing bureaus, a handful of direct questions will tell you most of what you need to know:

Can you show me your chain-of-custody records for a recent project (anonymised)?
What certifications do you hold — ISO 27001, ISO 9001, BS EN 15713 — and are they current?
What is your image QC sampling rate, and what triggers a rescan?
How are files transferred to us, and when are your working copies deleted?
What happens to our originals afterwards — storage, return, or certified destruction?
Will you run a paid pilot batch so we can inspect output quality before the main project?

Vague answers to any of these are a warning sign. Confident, documented answers usually indicate a bureau that has been audited by demanding clients before — law firms, NHS bodies, financial services — and has survived the scrutiny.

How EvaStore Approaches Secure, Compliant Scanning

Our document scanning service is built around exactly these principles: tracked collection and box-level custody, document preparation with recorded page counts, image and index quality checks before delivery, and encrypted handover of your digital files. Once scanning is complete, you choose what happens to the originals — certified secure shredding, return to your offices, or continued protection in our storage facility. For more guidance on planning a digitisation project, browse the rest of our resources library.

Secure, accurate, and compliant aren’t three separate features — they’re the product of one disciplined process. Choose a provider who can show you that process end to end, and the scanned archive you receive will be an asset you can rely on for decades.