Beyond the Envelope: Why Data Security is the New Standard in Physical Mail

Attention to data security tends to stop at the point where a file leaves a system, but a mailing carries that data onward through printing, insertion and despatch. For organisations sending statutory notices, medical reports or financial statements, production is part of the security chain rather than something that happens after it. Under the Personal Data Protection Act the sending organisation stays accountable for the whole of that chain, including the parts a vendor operates.

Encrypted transfer, restricted access, and a purge that actually happens

Security begins before the first page is printed, and three controls cover the digital half of the job.

• The transfer. Data should never be sent by ordinary email. SFTP with AES-256 encryption keeps the file unreadable to anyone who intercepts it in transit.
• The access. While a job is running, the live customer file should be open only to the people running it.
• The purge. Retention is a liability. Once a mailing is lodged, the data should be removed rather than left on a production server indefinitely, and a vendor should be able to say when that happens.

Transfer, access and purge are the three things to ask any vendor about, and the answers should be specific rather than reassuring. Ours sit with secure data printing.

The failure that matters most is a mismatched pack

The characteristic privacy breach in mail production is not an intercepted file. It is one recipient opening an envelope containing someone else's document.

The control against it is verification at the point of insertion. A 2D barcode on the letter is read by an inline scanner and matched against the envelope before the pack is sealed, so that the letter and the envelope are confirmed to belong together rather than assumed to.

What matters is the behaviour on failure. A mismatch has to stop the pack, not flag it for review afterwards, because once a wrong document is sealed and lodged the disclosure has already happened. A system that halts is preventing an incident; one that reports is documenting one.

The physical stages carry the residual risk

Once data becomes paper it stops being protected by anything digital, and the remaining controls are all physical.

An assessment of a mailing facility should establish three things:

• Access control. Which zones are restricted, and who can enter the production floor while a job is running.
• Chain of custody. Whether the count produced reconciles with the count intended, and whether that record can be produced afterwards.
• Destruction of waste. What happens to spoiled and misprinted sheets. Setup waste from a variable-data run carries real customer data and has to be destroyed on site rather than discarded.

The third is the one most often overlooked by buyers. A run that reconciles perfectly at despatch can still have left personal data in a waste bin.

Where a buyer wants these controls evidenced by someone other than the vendor, the banking sector has a framework for it. Our mailroom, messaging and local courier services are audited under the ABS OSPAR programme, which is an audit report rather than a certification, and whose scope does not extend to printing or lettershopping. We set out how that framework works, and how to read its public register, in the 2026 guide to secure document fulfillment.

What this means when choosing a partner

Treat the choice of a mailing partner as a risk decision rather than a procurement one, because the accountability does not transfer with the work.

The practical test is whether a vendor can describe their controls as a sequence of events with points of failure, rather than as a set of assurances. Ask what happens to your file on arrival, who can open it, when it is destroyed, what stops a mismatched pack, and what record exists at the end of the run. A partner who answers those five questions concretely is one whose process you can actually place on your own risk register.

Updated 6 August 2026 to remove unverifiable facility claims and to state the OSPAR scope precisely.