How files must be destroyed

For many people, the turn of the year is the ideal time to bring the workplace up to scratch and to reorganise. This includes sorting out the piles of files that have accumulated on the desk over the year or possibly even over the years and throwing away one or two old things. There are a few things to keep in mind. Not all documents, data carriers or papers can simply be thrown away. Legislation regulates how long business documents must be kept and what must be destroyed. Accounting records, for example, must be kept for 10 years, patient records for 30 years and business letters for 6 years. So before you switch on the shredder, you should first check which deadlines have to be met for which documents. In particular, if third party data is involved, the data carriers must be disposed of using a document shredder in accordance with DIN standard 66399. We have taken a closer look at the DIN.

Document destruction – the DIN standard 66399

The DIN standard 66399 on data destruction defines the security of all contemporary media as well as the requirements for corresponding machines and processes for data destruction.

For this purpose, all data must first be divided into protection classes. There are a total of 3 protection classes:

• Protection class 1: Normal protection requirement for internal personal data, including for example telephone lists, product lists, supplier data or address data.
• Protectionclass 2: High protection for confidential data, including financial accounting documents, balance sheets and annual financial statements as well as internal reporting.
• Protection class 3: Very high protection requirement for particularly confidential and secret data, this includes very sensitive data such as documents from witness protection programmes or information from the federal and state governments, but also documents from research and development.

The security levels according to DIN 66399

In addition, DIN 66399 distinguishes 7 security levels, each according to the destruction recommendation. They are assigned to the protection classes.

• Security level 1: General written material that is to be made illegible, for example outdated advertising material such as brochures or catalogues – reproduction of the destroyed data is possible with simple effort.
• Security level 2: Internal documents that are to be rendered illegible, for example company communications such as expired instructions, forms or notices – reproduction is still possible with special effort.
• Security level 3: Data carriers with sensitive, confidential and personal data requiring increased protection, e.g. tax documents, orders with address data of persons – reproduction is only possible with considerable effort.
• Security level 4: Data carriers with particularly sensitive and confidential data as well as personal data with an increased need for protection ,such as balance sheets, payrolls, personnel data, employment contracts or medical reports – reproduction is possible with extraordinary effort.
• Security level 5: Data carriers with information to be kept secret with existential importance for a person, a company or an institution, for example patents, design documents, strategy papers or process documents – reproduction is only possible with dubious methods.
• Security level 6: Secret high-security data such as research and development documents, official areas – reproduction is technically impossible.
• Security level 7: Strictly secret high-security data, e.g. for intelligence or military purposes – reproduction is not possible.

Data carriers and security levels

Depending on the data carrier and security level, certain particle sizes must be adhered to during destruction, which in turn is decisive for choosing the right document shredder.

Each data carrier is labelled with an abbreviation.

• P – Presentation of information in original size: paper, film, printing forms.
• F – Information representation in reduced size: film, microfilm, foil
• O – Information representation on optical data carriers: CD/DVD
• T – Information representation on magnetic data carriers: diskettes, ID cards, magnetic tape cassettes
• H – Information representation on hard disks with magnetic data carriers: hard disks
• E – Information representation on electronic data carriers: memory stick, chip card, semiconductor hard disk, mobile communication media

Which shredder for what?

Document shredders should fulfil several aspects. The blades should not only be able to shred paper but also staples, CDs and cardboard. The capacity, speed, health and safety and noise level also play a role in the selection process. We have listed the 4 document shredder models in our range in a table with all the relevant information.