Most small offices have one shared printer and scanner, a cabinet of folders and a drawer nobody wants to open. Paper is rarely the main risk, but it is where rules are least clear. Files scanned to someone's inbox are lost when they leave, and a contract left in the output tray is read by whoever walks past.
A few short rules fix most of this. They fit on one page.
Scan to one place
Set the scanner to save to one shared folder, not to personal email. Scans that land in an inbox are hard to find, are not backed up with the rest of the company's files and disappear with the account.
Use the same folder structure and naming as the rest of your files (see shared drive folder structure and file naming rules). A scan called scan0042.pdf in the root folder is not an archive. Give each file a date, a type and a counterparty, and move it out of the "incoming scans" folder within a week.
Check the resolution and readability once. A scan that cannot be read is worse than no scan, because someone may shred the paper after it.
Decide: scan and shred, scan and keep, or keep the paper
Sort document types into three groups, once, and write the list down:
- Scan, then shred. Delivery notes, internal printouts, supplier brochures, copies of emails. The scan is the working copy.
- Scan, and keep the paper. Signed contracts, official letters, anything where an original may be required. The scan is for daily use, the paper is the original.
- Paper only. Documents that must not be copied or stored electronically, for example certain originals with legal force. Keep these in a locked cabinet with a short index.
If you are not sure about a document type, ask your accountant or lawyer once and write down the answer. Rules on which originals must be kept differ between countries and industries, so this article does not give a list.
Retention: how long to keep it
Every type on the list needs a period and a reason. Take the periods from your legal and tax obligations, not from guesses, and note who confirmed them. A practical way to build the table is described in a data retention schedule for business records.
Keep the table short, with columns for document type, paper or digital, period and the date the period starts. Review it once a year. Add a reminder to the owner's calendar for the shredding round, for example every January for the documents whose period ended the previous year.
Shredding
Shred what has reached the end of its period, and shred scan-and-shred documents on a regular schedule, not "when the bin is full". Use a cross-cut shredder in the office, or a certified shredding service for larger amounts. A service should give you a short written confirmation you can file.
Do not put documents with names, addresses, bank details or health information in the ordinary paper bin. A locked collection box next to the printer makes the right thing the easy thing.
One owner for the archive
Name one person who owns the paper archive, the retention table and the shredding, and one deputy. The owner does not do all the work, but answers the questions: where is this contract, can this be thrown away, who may see this cabinet.
Decide who has the key. Keep the list of people with access short and review it when someone joins or leaves (see the new employee access checklist).
Printing personal data
Rules for printing are mostly rules for not forgetting:
- Print only when needed. If a document can be read on screen, leave it there.
- Use secure release if the printer has it. The job prints only when the person is at the device with a card or PIN. Many office printers support this, and it is often switched off.
- Collect it straight away. Anything with personal data must not stay in the tray.
- Clear stored jobs. Many printers and scanners keep a history of jobs or a hard disk. Check the settings, and wipe or remove the disk when the device is returned or sold.
- Change the default admin password on the printer and keep it off the open network.
Check that it works
Once a quarter, spend ten minutes:
- Is there anything in the output tray or on the scanner glass?
- Are the files in the scan folder named and moved?
- Is the shredding box emptied, and is the retention table current?
If the answers are no, the problem is usually a rule that is too complicated, not careless people.
Common mistakes
- Scans to personal email. Files vanish when the person leaves.
- Shredding too early. An original was still needed.
- Keeping everything. The cabinet grows, and nobody knows what is in it.
- No owner. Everyone assumes someone else handles the archive.
- Forgotten printer settings. Stored jobs and default passwords stay for years.
Summary
Scan to one shared folder with clear names, sort document types into scan and shred, scan and keep, or paper only, write a retention period next to each, shred on schedule, name one owner for the archive and treat printing of personal data with care. It is an hour of setup and a ten-minute check each quarter.
Sources
- Common practice for small businesses, offered as a practical guide. No client results or market figures are claimed in this article. Retention periods and originals that must be kept depend on your country and industry; confirm them with your accountant or lawyer and adjust the rules to your company.
