GDPR requires organisations to apply sound security practices to all electronic and paper-based personal data with respect to its collection, storage, access and disposal. Part of the requirement is to put plans in place for what should happen in the event of a breach. Whilst electronic data security has been prioritised by many organisations for many years, the security of paper based personal data is often neglected or overlooked. Statistics indicate that around 40% of data breaches may be paper based. A clear and firm document shredding policy is required supported by robust GDPR compliance process.