Your cleaners are often the only people in your office when no one else is — moving through every desk, meeting room and server cupboard, out of hours. For law firms, finance, healthcare and tech businesses, that makes cleaning a genuine information-security question, not just a housekeeping one.
Most cleaning is bought on price and standards. But if your office handles personal data, client files, contracts or IP, the way your cleaning provider vets, manages and controls its people matters just as much as how clean the desks are. This guide walks through what to check — and what a well-run contract should already have in place — so outsourcing your office cleaning never becomes your weakest security link.
Why office cleaning is a data-protection issue
Under UK GDPR, you remain responsible for personal data even when a third party is on site. Cleaning teams routinely have unsupervised, out-of-hours access to exactly the places sensitive information lives: unlocked screens, printouts left on desks, whiteboards, meeting rooms, reception logs and waste bins. A confidentiality breach doesn’t need to be malicious — a photographed whiteboard or a document put in the wrong bin is enough.
Good providers treat this as a shared responsibility with you: they control their people and processes; you set clear-desk expectations and access rules. The two together keep it safe.
1. Vetting: who is actually in your office?
The single most important control is knowing that every cleaner has been properly checked before they set foot on site. Ask how staff are screened and whether that screening is documented and current.
- DBS checks appropriate to the environment (basic, or enhanced for regulated settings).
- Right-to-work and identity verification for every operative.
- Employment-history / reference screening — ideally to BS 7858 for higher-security sites.
- No unvetted last-minute cover or unknown sub-contracted labour turning up at your door.
For more on how standards and staffing are managed, see our guides on writing an office cleaning specification and BICSc cleaning standards.
2. Access control and key holding
Out-of-hours cleaning only works safely with disciplined access management. Confirm how keys, fobs and alarm codes are issued, logged and recovered — and what happens the moment a cleaner leaves the contract.
- Named, trained key holders — not keys shared informally around a team.
- A documented sign-in/out and alarm-set procedure for every visit.
- Immediate revocation of access and return of keys/fobs when staff change.
- Agreed rules for restricted areas (server rooms, HR, legal, records).
3. Confidentiality, training and supervision
Vetting gets the right people in; training keeps them safe to work around your information.
- Signed confidentiality / NDA clauses in every operative’s terms.
- Induction covering clear-desk respect, “see it, leave it” for documents, and no photography of client areas.
- A named account manager and supervision so issues are caught and logged, not ignored.
- Correct handling of staff transfers (TUPE) so continuity never means losing control of who has access.
4. Secure waste and document handling
Cleaning and confidential waste meet at the bin. Make sure the two are not in conflict: cleaners should know the difference between general waste and confidential/shredding streams, and never move documents between them. For regulated offices, align the cleaning method with your data-retention and destruction policy.
5. Insurance, accountability and audit
Finally, make sure there is a clear chain of accountability if something does go wrong.
- Adequate public liability and appropriate insurance cover.
- ISO 9001-managed processes with documented method statements and audits.
- An incident-reporting route and a review rhythm with your account manager.
Quick buyer’s checklist
- Are all cleaners DBS-checked and reference-screened before starting?
- How are keys, fobs and alarm codes issued, logged and recovered?
- Do operatives sign confidentiality terms and complete a security induction?
- Who is the named key holder and account manager for our site?
- How is restricted-area and confidential-waste access handled?
- What insurance, ISO certification and audit evidence can you show us?
How Crystal handles it
Every Crystal cleaner is DBS-checked and screened before deployment, trained on confidentiality and clear-desk respect, and works to a documented, ISO 9001-managed method with a named account manager and controlled key holding. It’s the same standard we bring to law firms, finance and healthcare offices across London and the UK — security built into the cleaning, not bolted on after.
Outsourcing office cleaning and need it done securely? Get a clear, no-obligation quote with vetting and access controls built in.
Frequently asked questions
Is my cleaning company a “data processor” under GDPR?
Usually a cleaning provider isn’t processing your data as a service, but its staff can access personal data incidentally on site. You stay responsible for that access, so vetting, confidentiality terms and access control should be written into the contract.
What vetting should office cleaners have?
At minimum, verified identity, right-to-work and a DBS check suited to the environment. For higher-security offices, look for BS 7858 employment-screening and signed confidentiality clauses.
How do we keep out-of-hours cleaning secure?
Use named, trained key holders, a documented sign-in/alarm procedure, restricted-area rules, and immediate access revocation whenever staff change. A named account manager should own the process.
About The Author
