If there are no secure processes and procedures for deleting and destroying information and storage media (or they are not used correctly), there is no guarantee that confidential information will be securely deleted or destroyed. It is therefore impossible to foresee where this information will end up and whether it will be accessible to third parties. This danger is particularly high in the case of digital media and IT systems that are to be discarded, as it is not always immediately apparent what (residual) information is on them. This information can be read by unauthorised third parties. If it is particularly sensitive information, such as trade secrets or sensitive personal data within the meaning of Article 9 of the GDPR, this can result in high fines.