When people hear "data breach", they imagine hackers in hoodies, ransomware messages and leaked passwords. Cyber security dominates the conversation, and rightly so. But some of the most damaging privacy failures in Australian businesses have involved nothing more sophisticated than a box of files left in the wrong place.

An overflowing recycling bin behind a medical clinic. A filing cabinet sold at auction with client records still inside. Old tax returns dumped in a skip during an office move. These things happen more often than anyone would like to admit, and they are entirely preventable. A sensible approach to storing, handling and eventually destroying paper records, including using a proper secure document destruction service rather than the general recycling bin, closes one of the most overlooked gaps in business security.

Paper is still everywhere

For all the talk of the paperless office, most workplaces still generate a steady stream of printed material. Contracts get signed in hard copy. Patients fill in forms in waiting rooms. Payslips, invoices and employee records get printed for convenience. Some industries, such as law, accounting and healthcare, are legally required to keep certain documents for years.

The problem is that paper tends to feel less risky than digital files. Nobody thinks twice about printing a client list for a meeting, and that printout can easily end up on a train seat or in a café bin.

What the law expects

Australian businesses covered by the Privacy Act have obligations under the Australian Privacy Principles. Among other things, they must take reasonable steps to protect personal information from misuse, loss and unauthorised access. They are also expected to destroy or de-identify personal information once it is no longer needed.

That word "reasonable" carries a lot of weight. A business handling sensitive health or financial information will be held to a higher standard than one that only keeps basic contact details. Serious breaches may also need to be reported under the Notifiable Data Breaches scheme, which can bring reputational damage on top of any regulatory consequences.

Even businesses that fall outside the Privacy Act have plenty of reasons to care. Customers expect their information to be handled with respect, and a single careless incident can undo years of trust.

Where paper records go wrong

The weak points tend to be the same across most workplaces:

• The desk. Documents left out overnight or visible to visitors.

• The printer. Sensitive jobs sitting in the tray for anyone to collect.

• The archive room. Storage left open, with no record of who accesses what.

• The bin. Confidential paper tossed into general waste or open recycling.

• The move. Office relocations where boxes are packed in a rush and some end up lost or discarded.

Notice that most of these involve habits rather than technology. That is good news, because habits can be changed.

Simple habits that make a real difference

Start with a clean desk policy. It sounds old-fashioned, but asking staff to clear sensitive papers away at the end of the day reduces casual exposure significantly.

Use secure print release on shared printers, so documents only print when the person who sent them is standing at the machine.

Lock up archives and keep a simple log of who takes files out and when they are returned.

Replace open recycling boxes in offices with locked consoles for confidential paper. Staff drop documents through a slot, and nobody can fish them back out.

Set a retention schedule. Work out how long each type of document needs to be kept, and destroy it promptly once that period ends. Holding onto records "just in case" increases your risk without any real benefit.

Why the office shredder is not enough

A small strip-cut shredder under a desk feels responsible, but it has limits. Strips can be reassembled by a determined person, the machines jam constantly and staff tend to stop using them when they get busy. Bags of shredded paper are also bulky and often end up in ordinary recycling anyway.

Professional destruction services collect locked bins on a schedule, destroy the contents under controlled conditions and can provide certificates confirming destruction. For businesses with regular volumes of sensitive paper, this is usually safer and simpler than doing it in-house.

Make it part of the culture

Policies only work when people understand why they matter. Include paper security in staff induction, remind teams during busy periods such as end of financial year and make it easy to do the right thing by putting secure bins where people actually work.

Cyber security will always deserve attention. But a business that locks down its servers while leaving client files in an open recycling tub has only done half the job.