Paper shredders (document destroyers): how to choose the right one

Paper shredders (document destroyers): how to choose the right one

A paper shredder isn't just "an office appliance." For many homes and businesses, it's the simplest way to reduce risk: payment slips with addresses, invoices, contracts, order spreadsheets, customer lists, HR documents... all of these can contain personal data .

In the context of the GDPR, it makes sense to have a clear process: keep only what is necessary and securely destroy it when it is no longer needed. The GDPR itself defines the principle of retention limitation (not keeping personal data for longer than necessary).
And the CNPD reminds us that a data breach can include the destruction, loss, or unauthorized disclosure of personal data.

Below is a practical guide (in Portuguese - Portugal), well-suited for buyers, to help you choose the right equipment.

1) DIN 66399 safety levels: what they mean (P-1 to P-7)

The DIN 66399 standard defines seven security levels for paper , from P-1 to P-7 : the higher the number, the smaller the particle and the more difficult it is to reconstruct the document.

Types of cut (the commercial "name") vs. DIN level

Many brands first mention the type of cut — it's easier to understand that way:

  • Strip-cut → typically P-1 / P-2 (basic safety).

  • Cross-cut → typically P-3 / P-4 (more secure for sensitive documents).

  • Microcut / micro-cut → typically P-5 (very small particles; superior safety).

  • High security (P-6 / P-7) → for highly confidential information.

Useful reference: in P-5, it is common to find particles around 2×15 mm (very small area), which makes reconstitution much more difficult.

2) Which level should I buy? (quick recommendation by scenario)

For home use (occasional use)

  • P-2 / P-3 can occur if you destroy letters, addresses, receipts, and some personal documents that are not highly sensitive.

  • If you frequently destroy documents containing banking, health, or tax information: move up to P-4 .

For e-commerce / small office

  • P-4 is usually the "sweet spot" for documents containing personal data (orders, addresses, invoices, returns). Cross-cut (P-3/P-4) is recommended for more sensitive documents than "non-confidential paper".

For HR, accounting, clinics, lawyers (highest risk)

  • P-5 (micro-cut) is the "safe" choice when dealing with truly confidential data and consistent volume. P-5 is described as micro-cutting with very high particle sizes per sheet, associated with greater security.

For highly sensitive information (strategy, patents, critical files)

  • Consider P-6 / P-7 (high security).

3) Capacity and performance: how to avoid buying something "too small" (or too big)

This is where many people go wrong: they buy a cheap model, it gets constantly damaged, overheated, and ends up unused.

3.1 Sheets per pass (and the actual paper)

The advertised capacity is usually for lighter paper (e.g., 70 g). If you use thicker paper (80 g), covers, staples, or folds, the actual capacity decreases .
Simple rule: if you need to destroy a small amount , but frequently, choose a machine with headroom (not at the limit).

3.2 Duty cycle (grinding time vs. cooling time)

For home use: short cycles may suffice.
For office use: look for models designed for longer use (avoids constant downtime due to overheating).

3.3 Basket volume

  • Home: small basket may be sufficient.

  • Office/store: larger basket avoids "stopping operations" every few minutes.

3.4 Noise

If you're going to be near customer service/cashier areas, noise matters. In environments with customers, a very noisy garbage disposal creates discomfort.

4) What else will you destroy besides paper? (cards, CDs, staples)

The DIN 66399 standard is not just "P for paper". It also classifies media categories (e.g., optical, cards, etc.) and levels by material type.

In practice, this is confirmed in the product information sheet:

  • Staples and clips : many models shred, but not all.

  • Cards (plastic/chip) : some have a dedicated slot.

  • CD/DVD : less relevant today, but still appears in specifications.

5) GDPR best practices: how to turn the shredder into a “process” (and not a gadget)

The goal isn't to "crumble everything." It's about having a simple and consistent routine, aligned with:

  • conservation limitation (store for the minimum time necessary)

  • Security and risk reduction of data breaches/incidents.

5.1 Simple workflow for store/office

  1. Closed box/container for paper to be destroyed (prevents loose sheets).

  2. Regular grinding (daily/weekly) — do not let it accumulate for months.

  3. Basic registration (optional, but useful in companies): "type of documents destroyed + date + responsible party".

Regulatory authorities recommend permanently and securely destroying paper documents when they are no longer needed and evaluating suppliers/contracts when third parties handle the data.

5.2 If you use an external service (shredding)

If destruction is to be carried out by third parties (collection and destruction), look for suppliers with recognized practices. There are best practice standards for the secure destruction of classified material , such as EN/UNE 15713 , which focus on process control (from collection to destruction).

6) Purchase checklist (quick and "purchasable")

First, select the DIN level:

  • House: P-2/P-3

  • Shop/office: P-4

  • Truly confidential: P-5

Then confirm:

  • Sheets per pass (with margin)

  • Duty cycle (does not overheat quickly)

  • Basket with adequate volume

  • Reverse /anti-jamming function

  • Shreds staples/paper clips (if needed)

  • Cutting type: strip / cross / micro

  • Warranty and support

FAQ

What is the best shredder for documents containing personal data (GDPR)?
In practice, many companies choose P-4 as a baseline and P-5 when there is greater sensitivity and risk. DIN 66399 defines levels, and the higher the level, the smaller the particle.

Is P-4 sufficient for invoices, addresses, and shipping labels?
In many scenarios, yes (cross-cut P-3/P-4 is recommended for sensitive documents).

What is microcutting (micro-cut) and why is it safer?
Micro-cut typically corresponds to P-5 , with much smaller particles per sheet, making reconstruction difficult.

If I tear the paper in my hand, will that be enough?
For documents containing personal data, destruction must be secure and permanent . Regulators recommend the permanent and secure destruction of paper documents that are no longer needed.

Is it worth hiring external destruction services?
It can be worthwhile, especially with large volumes. If it's done through third parties, look for processes and best practices (e.g., EN/UNE 15713 for secure destruction) and ensure contracts/control of the processor.