Waste carriers don’t usually think of themselves as data processors. You collect waste. You fill in a note. You move on. Data protection sounds like something for tech companies.
It isn’t. Every waste transfer note you fill in has personal data on it. UK GDPR applies. The Information Commissioner’s Office can fine you under it. Most small carriers have never had this explained in plain English. This is that.
What’s personal data on a WTN
A waste transfer note typically includes:
- The customer’s full name and address
- A contact phone number or email
- The driver’s name and signature
- The carrier’s registered business details
- Sometimes the registration plate of the vehicle
Names, addresses, and signatures are personal data under UK GDPR. That means you’re processing personal data every time you create a waste transfer note for a domestic customer, a sole trader, or anyone whose name appears on the note.
You’re a data controller for that information. Your drivers and admin staff are processing it on your behalf.
What UK GDPR actually asks of you
The rules boil down to a few things that you can usually satisfy with common sense and a bit of admin hygiene:
- A lawful basis for processing. For waste transfer notes, the lawful basis is legal obligation (you have to keep these records under Section 34 of the Environmental Protection Act) and legitimate interest (you need customer details to run the job).
- Only collect what you need. A WTN needs a name, address, and signature. It does not need a date of birth or a National Insurance number. Don’t collect extras.
- Keep it secure. Personal data in a filing cabinet needs to be in a locked cabinet. Personal data in software needs encryption at rest and in transit. Personal data in a van needs to not be lying on the dashboard.
- Keep it no longer than necessary. The retention period for a waste transfer note is 2 years (3 for hazardous). After that, you should either securely destroy the note or, if you keep it longer, have a clear reason why.
- Tell customers what you do with their data. A short privacy notice at the point of collection or on your website is enough. It should say who you are, what you collect, why, who you share it with, and how long you keep it.
- Be ready to respond if a customer asks. Customers can ask to see what you hold, ask you to correct it, or (in some cases) ask you to delete it. You’re expected to respond within a month.
Where waste carriers tend to get caught out
A few patterns show up repeatedly in ICO complaints and enforcement actions against small businesses.
Carbon copy books left in vans. A carbon copy book contains hundreds of customer names and addresses. If the van gets broken into and the book is taken, that’s a data breach. The ICO asks you to report personal data breaches within 72 hours if they are likely to cause harm to individuals.
Photos of WTNs sent over personal WhatsApp. Common shortcut: driver takes a photo of the note, sends it to the office WhatsApp. The image sits in personal devices, cloud backups, and the WhatsApp server. It contains personal data. That’s a processing arrangement that needs to be on a legitimate legal footing, and it usually isn’t.
Customer details copied into spreadsheets without retention. Office manager types customer details into an Excel sheet to make quoting easier. That sheet sits on a laptop for years, long past the 2-year WTN retention period. No deletion schedule, no review.
No idea who has access. Ten people have the shared email login. Nobody knows which contractor set up the website. The Google Drive folder is shared with a driver who left two years ago. This is the mess most small businesses live in, and it’s the one the ICO asks about if there’s ever a complaint.
What digital changes about GDPR
Moving from paper to a digital WTN system does a few things for you automatically:
- Access control. Only people with logins can see notes. You know who.
- Encryption at rest and in transit. Any serious platform encrypts personal data on the server and when it moves between devices.
- Retention enforcement. A good system flags or deletes notes that have aged out of their retention window.
- Audit trail. Every note has a timestamp and a user attached. If someone asks who accessed a customer’s details, you can say.
The paper version of each of these is possible but depends on human discipline. Filing cabinets can be locked. Books can be logged. Retention dates can be tracked on a sheet. In practice, most small operations don’t do any of this reliably.
A minimum plausible setup
If you run a small waste carrier business and you’ve never looked at GDPR before, here’s the shortest version of getting into reasonable shape:
- Write a one-page privacy notice. Stick it on your website. Something like: “We collect the following information to do your job and comply with waste regulations. We keep it for 2 years. We don’t sell it. Contact us at [email] with questions.”
- Register with the ICO as a data controller. Almost all small businesses that process customer data need to register. It costs £40-60 a year. It takes 15 minutes.
- Pick a WTN system that encrypts customer data and enforces retention. Paper in a van does neither.
- Stop using personal WhatsApp to send WTNs. Move the workflow into a tool that keeps the data inside the tool.
- Write down, somewhere, who has access to what. Even a single-page list is better than nothing.
None of this is hard. All of it sits quietly until somebody complains, at which point you need to show that you’ve thought about it.
What WTN App does on the data side
Customer data is encrypted at rest and in transit. Access is per-user, not shared logins. Notes are marked for destruction when they pass the retention window. Data is held on UK-hosted infrastructure.
You still need to register with the ICO and run your own privacy notice. We can’t do those for you. But the data-handling side of the waste transfer note itself is something you stop having to worry about.
This post is general guidance, not legal advice. If you’re handling sensitive personal data or you’ve had a breach, talk to a data protection lawyer or the ICO directly.
Start free. 20 notes included, no card required.