The right provider is the one that can show, in writing and with evidence, how it will protect your records, meet your legal obligations and hand everything back when the contract ends. Price matters, but it is the last thing to compare, not the first.

This guide is for organisations choosing a supplier to scan, capture, store or manage paper and digital records. It is built around the questions that procurement staff, data protection officers, records managers and IT security teams ask during a selection, and explains what a good answer looks like for each.

Who is involved in the decision

A records contract usually needs sign-off from several people, each with different concerns:

Procurement: Route to market, contract terms, financial standing, insurance and value for money.
Data protection officer: Whether the supplier can act as a processor under UK GDPR, and on what terms.
Records or information governance manager: Scanning quality, indexing, legal admissibility, retention and destruction.
IT and information security: Certifications, hosting, data transfer and integration with existing systems.
Finance: What drives the cost, and how it will change over the contract.

Agreeing between these people what “good” looks like before approaching suppliers saves time and avoids late objections.

About this guide

This guide is published by Dajon Data Management, which is itself a supplier in this market. It is written to apply equally to any provider, including us, and does not rank or recommend suppliers. Standards and regulations change, so check the sources at the end before relying on any detail.

Before You Approach Suppliers

Suppliers can only quote accurately, and you can only compare them fairly, if everyone is answering the same brief. A short written specification also gives your data protection officer what they need to start a data protection impact assessment early.

Settle these points internally first:

What the records are: Types (files, bound volumes, plans, microfilm, mixed loose papers), condition, and whether they include special category data such as health records.
How many there are: An estimate in boxes, linear metres or files is enough to start. A sample count from a few typical boxes makes it far more reliable.
What you want at the end: Searchable images, extracted data, records loaded into a named system, or physical storage with retrieval on request.
How you will find things: The index fields you need (for example name, date of birth, reference number, date range) and how they must match your existing systems.
What happens to the originals: Returned, stored, or securely destroyed, and on whose authority. Check your retention schedule and any sector rules before deciding.
Timescales and access: Deadlines, and whether you need records back urgently while they are with the supplier.
Route to market: Whether you are a public body that will buy through a framework or run your own procurement, and who must approve the award.

A note on destroying originals

Scanning does not by itself authorise destruction of the paper. That decision belongs to your organisation, based on your retention schedule and any legal or regulatory requirement to keep originals. Public record bodies should also follow The National Archives’ guidance. Most organisations keep originals for an agreed period after scanning so that any quality problems can be found and the pages rescanned.

Questions Procurement Staff Ask

Procurement’s job is to confirm that the supplier can be bought from lawfully, will still be there in five years and can be held to what it promises.

Can we buy from you through a framework?

Public bodies can often buy through an existing framework rather than running a full tender. The main UK framework for this work is RM6346, Records Information Management, Digital Solutions and Associated Services 2, managed by the Government Commercial Agency (formerly the Crown Commercial Service).

A good answer names the framework and the lot, and you can confirm it on the framework’s supplier list rather than taking the supplier’s word for it. If you are running your own procurement under the Procurement Act 2023, check that the supplier’s record on the Central Digital Platform is current.

Which certifications do you hold, and what do they cover?

Ask for the certificate itself, not a logo. For each one, check:

Issuing body: For ISO standards, a certification body accredited by UKAS or another national accreditation body.
Scope: Which sites, services and activities are covered. A certificate that covers head office but not the scanning facility does not cover your records.
Dates: Expiry date, and for ISO/IEC 27001 that it is to the 2022 version.
Number: So you can check it with the issuer.

Certifications commonly asked for in this market are ISO/IEC 27001 (information security), BS 10008-1:2020 (evidential weight and legal admissibility of electronic information), Cyber Essentials or Cyber Essentials Plus, and, for work with NHS data, the NHS Data Security and Protection Toolkit (DSPT). Some buyers also ask for ISO 9001 (quality) or ISO 14001 (environmental).

Cyber Essentials certificates last 12 months, and Cyber Essentials Plus includes an independent technical audit where the basic level is self-assessed. Central government departments and NHS bodies should consider requiring one or the other where a supplier handles personal data, under Procurement Policy Note 014.

What insurance do you carry?

Ask for current certificates showing the insurer, limit of indemnity and expiry for each relevant policy. For records work these usually include professional indemnity, cyber liability, public and employers’ liability, and cover for documents in the supplier’s care and in transit. Check the limits against the value and sensitivity of what you are handing over.

Are you financially stable?

Records contracts can run for years, so a supplier failing mid-contract is a real risk to your records. Check filed accounts on Companies House, ask how long the company has traded and whether it has any parent company guarantee, and ask what would happen to your records if it ceased trading.

Who can we speak to?

Ask for at least two references from organisations similar to yours in sector, size and record type, from the last two to three years. Speak to them rather than relying on written testimonials, and ask what went wrong as well as what went well.

How is the price built up?

Ask for a priced breakdown against your specification, with assumptions stated. See Comparing Quotes Fairly below.

What happens when the contract ends?

Exit is where records contracts most often go wrong. Agree in the contract:

The format in which images, data and indexes will be returned, and that it is open and documented.
The cost of retrieving and returning stored boxes, and the timescale.
Certified destruction of any copies the supplier holds once return is confirmed.
That no fee or format will stop you moving to another supplier.

Questions Data Protection Officers Ask

A scanning or records supplier handling personal data on your behalf is a processor under UK GDPR, and you remain the controller. Article 28 says you may only use a processor that gives sufficient guarantees, and the contract between you must contain specific terms.

Will you sign a processing agreement with the Article 28 terms?

The contract, or a separate data processing agreement, must set out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject. It must also commit the supplier to:

Process personal data only on your documented instructions.
Make sure staff handling the data are bound by confidentiality.
Take appropriate security measures under Article 32.
Use sub-processors only with your authorisation, and on the same terms.
Help you respond to people exercising their rights, such as subject access requests.
Help you with security, breach notification and data protection impact assessments.
Delete or return all personal data at the end of the contract, as you choose.
Give you the information you need to show compliance, and allow audits and inspections.

A supplier that offers its own standard terms should be able to show where each of these is covered.

Who else will handle our data?

Ask for a list of sub-processors: courier and transport firms, cloud hosting, software providers, offsite storage and destruction contractors. For each, ask what data they see, where they are, and how you will be told about changes and given the chance to object.

Where will our data be stored and processed?

Ask for the physical locations of the scanning facility and storage sites, and the data centre region for any hosted images. If any data, including remote support access or offshore indexing, will leave the UK, ask which transfer mechanism applies and for the supporting risk assessment.

How will our records be kept secure?

Ask the supplier to describe, in writing:

Building security, access control and CCTV at each site handling your records.
Staff screening, for example to BS 7858 or the Baseline Personnel Security Standard for government work.
How records travel: vehicles, tracking, sealed containers and who may handle them.
Encryption of images in transit and at rest, and who can access them.
How long the supplier keeps working copies, and how it deletes them.

How quickly will you tell us about a breach?

As controller, you must report a notifiable personal data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, including weekends. Your supplier must tell you without undue delay, so the contract should set a shorter, specific deadline, name a contact on each side and say what information the first notice will contain. Ask the supplier how it has handled incidents before.

Can you support our data protection impact assessment?

A large scanning project involving health or other special category data is likely to need a data protection impact assessment. A good supplier will provide a description of its processing, data flows and security controls to feed into it, rather than leaving you to work them out.

How do you destroy records, and how do we know?

Ask which standard the supplier follows for destroying paper and media (for example BS EN 15713 for confidential material), whether destruction is done in-house or by a sub-processor, and what certificate you receive. The certificate should identify the records or batch, the date and method.

Questions Records Managers and IT Teams Ask

These questions decide whether the digital records you get back can be relied on, found and used in your own systems for as long as you need to keep them.

Will the scanned images stand up as evidence?

If you plan to rely on scanned images instead of the paper, for example in a dispute, a claim or an inspection, ask how the supplier’s process supports their evidential weight. BS 10008-1:2020 is the British Standard for the evidential weight and legal admissibility of electronically stored information. Certification shows the supplier’s own systems meet it, but you will also need to keep the audit trail it produces.

Ask to see the audit trail for a sample batch: who handled the records, when they were scanned, what checks were done and how any rescans were recorded.

What scanning specification will you use?

A good supplier will propose a specification for your records and explain why, rather than offering one setting for everything. Ask about:

Resolution: 300 dpi is common for typed text. Small print, fine handwriting, plans and photographs may need more.
Colour: Whether colour, greyscale or black and white will be used, and how coloured annotations, stamps and highlighting will be kept.
File format: PDF/A or TIFF for long-term keeping, with searchable text from optical character recognition where useful.
Sector rules: For GP records, NHS England’s guidance on digitising Lloyd George records and the national scanning standard it refers to. Other sectors and regulators may set their own.

How do you check quality?

Ask what is checked, by whom and how often: every image or a sample, and how the sample is chosen. Ask how page counts are reconciled against the originals, how missing or poor images are found and rescanned, and what accuracy rate the supplier commits to for indexing and data capture. Ask for the rate as a measured figure from comparable projects, not only a target.

How will documents be prepared and indexed?

Preparation (removing staples, repairing tears, unfolding plans) has a large effect on quality and cost. Ask what is included, how fragile items are handled and whether records are reassembled in their original order afterwards. For indexing, confirm the fields, how each will be checked and what happens when a field cannot be read.

How do you track our records from collection to return?

Ask how each box or file is identified (usually by barcode), how it is tracked at collection, in transit, on site and on return or destruction, and whether you can see that tracking yourself. Ask how quickly the supplier can find and return a specific file while it is in their care.

How will the output reach our systems?

Ask the IT team to confirm:

The delivery method, such as secure file transfer, direct upload or an interface with your document management or patient record system.
The format of the index or metadata file (for example CSV or XML) and whether it matches your system’s import format.
Whether a test batch will be loaded and checked before full production starts.
How long the supplier keeps a copy after delivery, and how it is deleted.

If you store our records, how do we get them back?

For physical storage or scan on demand, ask for retrieval timescales (standard and urgent), how requests are made and logged, and how records are packaged and delivered. Ask how the supplier protects stored records from fire, flood and pests, and what its business continuity plan says about your records.

Comparing Quotes Fairly

A low price per page can hide higher charges elsewhere, so compare the total cost of theThe right provider is the one that can show, in writing and with evidence, how it will protect your records, meet your legal obligations and hand everything back when the contract ends. Price matters, but it is the last thing to compare, not the first. whole job against the same specification. Ask every supplier to price the same items, state their assumptions and say which costs are fixed and which depend on volume.

Cost driver	What to ask	Why it varies
Volume	Is the price per page, per image, per file or per box? How was the page count estimated?	Box sizes, paper types and how full boxes are all vary, so per-box prices are hard to compare.
Preparation	What preparation is included, and what is charged extra?	Stapled, bound, folded or fragile papers take far longer to prepare than loose sheets.
Document size and type	Are large-format plans, bound books or photographs priced separately?	They need different scanners and handling.
Indexing and data capture	How many fields, at what accuracy, checked how?	Each extra field adds keying and checking time.
Image specification	Which resolution, colour mode and formats are included?	Higher resolution and colour add scanning and storage cost.
Turnaround	What is the standard timescale, and what does faster cost?	Shorter deadlines need more staff and shifts.
Collection and transport	Is collection included? Secure vehicles? Return delivery?	Distance, number of sites and security level all change the cost.
Storage	Price per box per week or month, and any minimum term?	Long storage terms can cost more than the scanning.
Retrieval and returns	What does it cost to retrieve, scan on demand or permanently withdraw a box?	Withdrawal and exit fees vary widely between suppliers.
Destruction	Price per box or per tonne, and is a certificate included?	Method and witnessing requirements change the price.
Minimum charges	Is there a minimum order, invoice or monthly charge?	Small or irregular jobs may fall under a minimum.

Ask for a sample

The most reliable way to compare suppliers is a paid or free pilot on a representative sample of your own records, assessed against the same checklist. It tests the price assumptions, the image quality, the indexing accuracy and how easily the output loads into your systems, before you commit to the full volume.

Warning Signs

None of these rules a supplier out on its own, but each deserves a clear explanation before you go further.

Certification logos on the website, but no certificate, scope or expiry date when asked.
A certificate whose scope does not include the site or service that will handle your records.
Reluctance to sign a processing agreement with the Article 28 terms, or to name sub-processors.
No clear answer on where data is stored, or offshore processing that was not mentioned until asked.
A price that is much lower than others, with assumptions that are not written down.
Exit costs, return formats or withdrawal fees that are left vague or set out only in standard terms.
References only from organisations unlike yours, or none that you can speak to.
Claims such as “the only”, “the leading” or “fully compliant” with no evidence beside them.
Pressure to commit to the full volume before a pilot or sample batch.

Supplier Checklist

Use this table as a guide to record the evidence each supplier provides. Add or remove rows to match your specification.

Area	Evidence to ask for
Route to market	Framework name and lot, confirmed on the framework’s supplier list; Central Digital Platform record
Information security	ISO/IEC 27001:2022 certificate with scope, issuer and expiry
Cyber security	Cyber Essentials or Cyber Essentials Plus certificate and expiry
Legal admissibility	BS 10008-1:2020 certificate and a sample audit trail
NHS data	Current DSPT status and organisation code, checked on the public register
Insurance	Certificates with insurer, limits and expiry
Financial standing	Latest filed accounts and any parent company guarantee
References	Two or more comparable clients you have spoken to
Processing agreement	Draft contract covering every Article 28 term
Sub-processors	Named list, locations and change-notification process
Data location	Sites and data centre regions; any transfer outside the UK
Physical security	Site access, staff screening and transport arrangements
Breach notification	Contractual deadline and named contacts
Scanning specification	Resolution, colour, formats and OCR proposed for your records
Quality control	Checking method and measured accuracy on comparable work
Tracking	Barcode tracking from collection to return or destruction
Integration	Delivery method, metadata format and a test load
Destruction	Standard followed and certificate format
Price	Itemised quote against your specification, assumptions stated
Exit	Return formats, timescales, fees and deletion of copies
Pilot	Results from a sample batch of your own records

How to Choose a Document Scanning or Records Management Provider