Data protection-compliant document destruction: This is how it works in an environmentally friendly and fast way

For many people, paperwork is not exactly a favorite activity – whether in a private household or in their own business, large quantities of paper waste accumulate within a few days. To prevent the chaos from getting even bigger than it already is, you need to regularly sort out unnecessary documents. In the commercial sector, there are more specific regulations here, but you should also make private documents unreadable as much as possible.

In this article, we show you the legal basis and how data protection-compliant shredding can work environmentally friendly and quickly!

Legal Basis for Data Protection-Compliant Document Shredding

First, let's look at the legal basis for document shredding in Germany and Europe and why it is so important. The European General Data Protection Regulation not only regulates the collection, storage, and use of personal data but also its destruction. Companies are obliged to comply with certain principles and rules when shredding documents in a data protection-compliant manner, regardless of whether the data is on paper or digital files.

The DIN standard 66399 applies to the security levels for data protection-compliant document shredding. It precisely regulates how small data carriers – such as paper – must be shredded so that they can be disposed of safely. The different security levels thus regulate what size the individual paper parts may still have after destruction. The respective security level is usually indicated on a shredder, ranging from general data of level one to highly sensitive data of level seven.

Important: Personal data must be destroyed at least at level three. This includes, for example, address data or telephone numbers. However, many inexpensive shredders meet at most level one or two and are unsuitable for this purpose, so be sure to pay attention!

As an entrepreneur, you can also take care of data protection-compliant document shredding yourself. However, TÜV experts advise that for particularly large amounts of data, you should rather commission an external company for destruction, as errors often creep in here.

For digital data, you should rather leave data protection-compliant document shredding to experts – because simple deletion is not enough here, the data must not be recoverable. So, play it safe and commission a specialist company to delete data from hard drives and the like.

These were the legal basics for data protection-compliant document shredding according to the valid DIN standard. In the following paragraphs, we will now look at what needs to be considered during destruction and how it can be done as environmentally friendly as possible.

Would you like to learn more about exciting topics related to employment law? Then feel free to visit our Deskspace blogs – here you can, for example, find out about the legal situation regarding a dog in the office and what you need to consider!

How Data Protection-Compliant Document Shredding Works

For data protection-compliant document shredding, there is no single path that is equally applicable to all data. Depending on how sensitive and worthy of protection the data is, it must be destroyed according to a higher security level. The higher the security level, the more difficult it is to restore the data after destruction. According to DIN 66399, there are a total of seven security levels that regulate the destruction of data.

These are the seven security levels, which are also always indicated on a shredder:

• Level 1: Reproduction is possible without tools with a certain amount of time
• Level 2: Reproduction requires certain tools, such as magnifying glasses
• Level 3: Sensitive and confidential data makes reproduction very complex
• Level 4: High time and personnel effort required for reproduction
• Level 5: Reproduction only possible with forensic equipment
• Level 6: Destruction of all data so that it cannot be restored even with technical methods
• Level 7: Makes reproduction absolutely impossible and is used for top-secret data

In addition to these security levels for destruction, the protection classes must also be observed. These are based on data protection regulations and roughly define which data belongs to which security level. There are the following protection classes:

• Protection class 1 applies to normally protected data. If it were to be published, there would be hardly any negative consequences or damage, so this applies mainly to normal data such as advertising or address labels.
• Protection class 2 applies to all data with a heightened need for protection. This is used to destroy data that is only accessible to certain individuals. For example, applicant or personnel data, or payslips.
• Protection class 3 should definitely prevent the publication of the data. Damage can occur if this data becomes public or is lost. In the worst case, the existence of people is threatened here.

Data protection-compliant document shredding is only possible when the retention periods of the respective files have expired. These range from six to ten years, depending on the type of data. This period always begins in the calendar year noted on the corresponding data carrier. If a document was created in July 2008, it may only be destroyed in August 2018.

Small shredders usually do not meet the standards required for offices or doctor's practices. Here you should use data protection-compliant shredders that also comply with the applicable DIN standard.

How a Shredder Works

For data protection-compliant document shredding, you inevitably need a shredder – regardless of its size. Depending on the protection class and security level of your documents, you must ensure that the shredder is actually approved for these documents to avoid legal difficulties.

A shredder cuts papers into tiny pieces. Either in strip cut, cross-cut or in the most secure micro-cut, where the pages are cut into tiny particles. The strip cut is not particularly secure and meets data protection regulations only in very few cases; it is primarily used in the private sector. The cross-cut, however, is somewhat more secure and is also used in many commercial document shredding operations. In absolute top-of-the-line shredders, the shredded data is then pressed through a wire mesh; these are used, for example, for government documents.

Document shredding is a sensitive topic that should be taken very seriously, especially in large companies. The data protection officer of each company is responsible for ensuring that these regulations are met and permanently complied with. If you are unsure about data protection-compliant document shredding, it is advisable to commission an external company for this.

In a successful office, many things are important – including a healthy and ergonomic workplace. At Deskspace, we have made it our goal to equip every company with high-quality office furniture, for example, with our height-adjustable desks. Feel free to visit our website and learn more about all our products!