The GDPR (General Data Protection Regulation) came into effect on 25 May 2018. This superseded the Data Protection Act 1998. Although the UK are no longer in the European Union this regulation still applies to the UK.
The aim of the GDPR is to ensure privacy and confidentiality for individuals and businesses with regards to information held by organisations and or released without authorisation.
The regulation requires us all to responsibly dispose of all data detailing personal or business information that is no longer required. In the event that personal or business information was disclosed whether deliberately (without permission) or accidentally, the reputation of your organisation would be at serious risk.