Quick answer
A secure mailing house should be able to show four things: an independently certified information security system (ISO/IEC 27001), registration with the ICO and a written data processing agreement covering everything UK GDPR Article 28 requires, secure handling of your data from transfer to destruction (encrypted transfer such as SFTP, restricted access, audit trails and deletion at an agreed point), and verified pack assembly, so the right letter goes in the right envelope. That last point matters because the ICO lists "sending personal data to an incorrect recipient" as a personal data breach. Ask for evidence of each before you send any data.
Key takeaways
- When a mailing house processes your mailing data, you are the controller and they are the processor. UK GDPR requires a written contract between you covering specific terms.
- ISO/IEC 27001 certification means an independent auditor has assessed the supplier's information security management system. Check the certificate's scope and expiry date.
- Data should arrive by an encrypted channel such as SFTP, never as an email attachment, and be deleted or returned at an agreed point after the mailing.
- A wrong letter in an envelope is a data breach. Ask how pack integrity is verified, for example by camera matching and checkweighing on the enclosing line.
- Notifiable breaches must be reported to the ICO within 72 hours of becoming aware of them, so your contract should say how quickly the supplier must tell you.
Why data security matters when you outsource mailings
Every personalised mailing starts with personal data: names, addresses and often much more, such as donation history, account numbers, policy details or appointment information. When you send that file to a mailing house, you stay responsible for it as the controller. The mailing house becomes your processor, acting only on your instructions.
The risks are not only about hacking. In print and mail, the most common way personal data goes wrong is physical: a statement in the wrong envelope, two letters stuck together, or a pack sent to an old address. The ICO lists "sending personal data to an incorrect recipient" as an example of a personal data breach. A secure mailing house has to control the data and the production line.
| Stage | What can go wrong | What good looks like |
|---|---|---|
| Transfer | Data emailed as an attachment or sent on unencrypted media | Encrypted transfer, such as SFTP with individual logins |
| Processing | Wide staff access; data copied to personal devices | Isolated, access-controlled systems with individual user credentials and audit logs |
| Production | Wrong letter in the wrong envelope; missing or duplicate inserts | Camera matching and checkweighing on every pack, with mismatches rejected |
| Retention | Data kept indefinitely "just in case" | Deletion or return at a point agreed in the contract |
| Incidents | Supplier delays telling you about a problem | A contractual timescale for notifying you, so you can meet the ICO's 72-hour deadline |
Certifications and registrations to ask for
Certificates do not make a supplier secure on their own, but they show that someone independent has checked. These are the ones that matter most for mailings:
| Evidence | What it shows | What to check |
|---|---|---|
| ISO/IEC 27001 certificate | An independently audited information security management system | Certificate number, scope (does it cover data processing and mailing?), certification body and expiry date |
| ICO registration | The organisation is registered with the Information Commissioner's Office | Search the ICO's public register for the company name and check it is current |
| Data processing agreement | The processor's contractual commitments under UK GDPR Article 28 | That it covers every term in the checklist below |
| NHS DSP Toolkit | For NHS patient data: the supplier's position against the National Data Guardian's ten data security standards | Ask for the supplier's current toolkit status, or how its processes align with the standards |
| Information security documentation | Policies, incident procedures and technical controls | That they cover transfer, access, retention, destruction and breach reporting |
As a worked example, Fretwell holds ISO/IEC 27001:2022 certification (certificate 11595-ISMS-001), independently audited and renewed annually, and is registered with the ICO (reference ZA036188). For healthcare work, our processes are aligned with the NHS Data Security and Protection Toolkit's ten data security standards. You can view and download our certificates on our certifications page.
What your data processing agreement must include
UK GDPR requires a written contract whenever a controller uses a processor. The ICO's guidance sets out what it must cover. Use this as a checklist when you review a mailing house's agreement:
Agree the destruction point up front
Write the retention period into the agreement: for example, a set number of days after the mailing is handed to Royal Mail. That allows for reprints and queries without keeping data longer than needed.
Secure data processing for personalised mail
Data arrives by secure SFTP, is processed on isolated, access-controlled systems under ISO 27001, and is destroyed at the agreed point after your campaign.
Explore the serviceA due-diligence checklist for choosing a secure mailing house
| Question to ask | A good answer | How Fretwell does it |
|---|---|---|
| How do we send you our data? | An encrypted channel with individual logins, never email | Secure SFTP; login credentials supplied on request |
| Is our data encrypted? | Yes, in transit and at rest | Encrypted in transit and at rest throughout processing |
| Who can access it? | Only named, authorised staff with individual accounts | Isolated, access-controlled systems; individual user credentials for authorised personnel |
| Can you show us what happened to our data? | Audit logs available on request | Full audit trails available to your information governance team on request |
| How do you stop the wrong letter going in the wrong envelope? | Automated verification of every pack | Camera matching on all three enclosing lines, with checkweighers; packs that do not match are rejected |
| When is our data deleted? | At a point agreed in the contract | Automated data destruction at the agreed point after campaign completion |
| Will you sign our data processing agreement? | Yes, or provide a compliant template | Yes, and we can supply our own template |
| Can you support our procurement review? | Documentation provided promptly | ISO 27001 certificate and information security documentation supplied on request |
Pack integrity is often overlooked. On our enclosing lines, each envelope is weighed and camera-checked against its intended contents before sealing. If the weight or barcode scan does not match, the machine stops and the pack is rejected for manual investigation. For statements, renewals and patient letters, that check is what prevents a personal data breach at the production stage. Our guide to what a mailing house does explains the full process.
Extra requirements in regulated sectors
- Financial services. Firms regulated by the FCA typically need full audit trails on data and production, and verified enclosing for statements, renewals and compliance notices. See our financial services page.
- Healthcare. Any organisation with access to NHS patient data or systems must complete the NHS Data Security and Protection Toolkit, and trusts will want to see how suppliers meet its standards. See our healthcare page.
- Charities. Donor files often include giving history used for ask-string personalisation, so the same controls apply. See our charity page.
Security is only half of compliance. You also need a lawful basis for the mailing itself: see our GDPR and direct mail guide. For keeping the data accurate before it is mailed, see mailing data cleansing.
