GDPR and Office Printers: What Small Businesses Must Do

GDPR and office printers is a topic most small businesses overlook. Data protection work tends to focus on email, cloud apps and laptops, but every day your printers and multifunction devices handle invoices, payslips, client letters and ID copies. The pages they produce, the scans they send and the drives inside them can all hold personal data. This guide explains where printers fit into the UK GDPR and EU GDPR, and which practical measures a small office can take.

This is general information, not legal advice. If you have a data protection officer or adviser, check your approach with them.

Why printers fall within GDPR

The GDPR covers personal data processed by automated means, and personal data in paper filing systems. Printers touch both:

• Printed pages are copies of digital records, often with names, addresses, account details or health information.
• Scans create new digital records that travel by email or into shared folders.
• Device storage on many multifunction printers keeps job images, address books and logs.
• Print management systems keep records of who printed what.

The security principle requires “appropriate technical and organisational measures” for personal data. The ICO’s guide to data security makes clear that paper records are included.

The four printer risks

1. Uncollected and mixed-up printouts

Pages left in a shared tray are the most common printing leak. Someone picks up a stack and takes another person’s payslip with it.

Measure: secure print release so jobs only print when the owner is present, plus a rule to collect immediately.

2. Data stored on devices

Copiers and MFPs may store scanned and printed images on a drive or flash memory, plus scan-to-email credentials and address books.

Measure: enable storage encryption and automatic overwrite where available, restrict the admin interface, and wipe before return or disposal. See copier hard drive data security and, for leased devices, end of copier lease.

3. Scans sent to the wrong place

A mistyped email address or a wrong shortcut on the panel sends a scanned document to the wrong recipient.

Measure: restrict scan to email to internal addresses or to the user’s own address, use address book entries rather than free typing, and route scans to controlled folders. Our scan to email setup guide and scan to folder setup cover the settings.

4. Unsafe disposal

Misprints and old copies go into the general recycling.

Measure: locked shredding bins or a cross-cut shredder next to each printer, and a clear rule that pages with personal data are shredded.

Device hardening checklist

For each networked printer:

• Change the admin password and restrict who can reach the admin page.
• Keep firmware updated.
• Turn off unused protocols and services.
• Encrypt stored data and enable overwrite where supported.
• Limit stored job retention.
• Log access if your print management system supports it.

The network printer security checklist has the full list, and the NCSC’s device security guidance explains the principles.

Suppliers and managed print

If a dealer or managed print provider can access your devices remotely, read stored jobs or collect logs that identify users, they may be processing personal data on your behalf. Check that your contract covers data protection terms, what they can access, and how they handle devices when they are removed. Our managed print services guide lists questions to ask.

Breaches involving printers

A printed payroll report left on a train, or a scan of a client’s ID sent to the wrong person, is a personal data breach. Under the GDPR you must assess the risk; where it is likely to result in a risk to individuals, you must report it to the supervisory authority within 72 hours of becoming aware. The ICO’s breach reporting page explains the process in the UK.

Prepare in advance:

• tell staff who to inform the moment something goes wrong;
• keep a simple breach log, including incidents you decide not to report;
• record the printer settings you changed afterwards.

Subject access requests and print logs

Print management logs that record user names and document titles can themselves be personal data. Keep them only as long as you need them and include them in your retention schedule.

Data minimisation at the printer

Data protection principles include using no more personal data than you need. At the printer, that means:

• printing only the pages needed, not whole reports with every customer’s details;
• masking account numbers and dates of birth on printed lists where the full value is not required;
• avoiding printing ID documents and scans of them unless you have to keep a copy;
• setting short retention for stored scan and print jobs on the device and in print management systems.

A one-page printer data protection check

Run through these questions once a year, or when you add a device:

1. Which printers handle personal data, and which handle special category data such as health information?
2. Is secure release on for those printers?
3. Is device storage encrypted and set to overwrite, and is the admin password changed?
4. Can scans go only to approved destinations?
5. Is there a shredder or locked bin next to each printer?
6. Do supplier contracts cover data protection and device removal?
7. Do staff know how to report a lost printout or misdirected scan?

Record the answers with the date. If you ever need to show that your measures are appropriate, this record helps.

Put it in your policy

Add a data protection section to your office print policy: secure release for personal data, no printing of restricted data at home (see remote employee printing policy), shredding rules, and breach reporting.

Professional firms and print logs

Firms that handle confidential client files, such as solicitors and accountants, usually have the highest exposure at the printer: client documents left in trays, scans sent to the wrong address, and detailed print logs. Our role guides for a printer for a law firm and a printer for an accounting firm apply the checks above to those offices. If you use print logs to charge printing to departments or clients, the logs become a business record as well as personal data, so decide which fields you need, who can see them and how long you keep them; print cost allocation by department suggests reporting in aggregate wherever possible.

Summary

Under GDPR, office printers are part of how you protect personal data. Use secure release, harden and wipe devices, control where scans go, shred properly, include suppliers in your data protection contracts, and be ready to handle a printing breach.