When organizations specify document destruction requirements for compliance or security purposes, they often reference DIN 66399 shredding security levels — the internationally recognized standard that defines exactly how thoroughly a document must be destroyed to be considered secure at a given level. For New York businesses in healthcare, finance, law, government contracting, and other sensitive industries, understanding DIN 66399 security levels is essential for specifying the right destruction method, evaluating vendor capabilities, and demonstrating compliance with applicable regulations.
DIN 66399, published by the German Institute for Standardization (Deutsches Institut für Normung), defines seven security levels for paper destruction (P-1 through P-7) and parallel scales for optical media, hard drives, and other materials. While this is a German standard, it has become the de facto international reference point for shredding security levels and is referenced in compliance frameworks and vendor certifications worldwide. This guide explains each level, what particle size it requires, and which document types and industries should use it.
The Seven DIN 66399 Paper Shredding Security Levels
DIN 66399 defines security levels based on the maximum particle size produced by the destruction process. Smaller particles equal higher security. For paper documents, the seven levels range from simple strip cutting at P-1 to near-dust particles at P-7:
- P-1: Maximum particle width of 12 mm (strip cut). General documents with no sensitive content — internal memos, non-confidential correspondence. Not recommended for any business documents containing personal data.
- P-2: Maximum particle area of 800 mm², maximum width of 6 mm. Standard office documents with low sensitivity — routine business correspondence.
- P-3: Maximum particle area of 320 mm², maximum width of 2 mm. Internal documents and moderately sensitive materials — general HR communications, non-critical financial documents.
- P-4: Maximum particle area of 160 mm², maximum width of 6 mm. Sensitive personal data, financial account information, standard business confidential materials. This is the minimum recommended level for most regulated business documents.
- P-5: Maximum particle area of 30 mm², maximum width of 2 mm. Highly confidential documents — classified business information, sensitive legal matters, high-value financial data.
- P-6: Maximum particle area of 10 mm², maximum width of 1 mm. Secret documents — government and intelligence agency use, national security materials.
- P-7: Maximum particle area of 5 mm², maximum width of 1 mm. Top secret documents — highest government classification levels, intelligence service materials.
Most commercial businesses in New York operate in the P-3 to P-5 range depending on their industry and the sensitivity of the documents being destroyed. Visit our services page to learn about the security levels we offer.
Matching Security Levels to Your Business Documents
Selecting the right DIN 66399 security level requires an honest assessment of what information your documents contain and the consequences of that information being compromised. A useful framework:
- Use P-3 or P-4 for: General business correspondence, employee names and addresses, standard financial statements, routine HR documents
- Use P-4 for: Documents containing Social Security numbers, account numbers, medical information, legal correspondence — the standard for HIPAA-regulated healthcare providers and most financial services firms
- Use P-5 for: Highly confidential legal matters, trade secrets, sensitive M&A documents, board-level strategic planning materials
- Use P-6 for: Government-classified materials at the secret level — typically only relevant for defense contractors and government agencies
- Use P-7 for: Top-secret government and intelligence materials — almost exclusively governmental use
For most New York businesses, P-4 represents the sweet spot — it exceeds the security requirements of HIPAA, FACTA, and most state privacy laws while remaining practical for large-volume commercial shredding. Learn about compliance requirements that may govern your choice of security level.
DIN 66399 Levels for Non-Paper Materials
DIN 66399 isn’t limited to paper. It defines parallel security scales for other materials commonly requiring secure destruction in New York businesses:
- Optical media (O-1 through O-7): CDs, DVDs, Blu-rays, and other optical discs. O-3 (maximum particle area of 160 mm²) is typically required for sensitive optical media.
- Magnetic media (T-1 through T-7): Magnetic tapes, floppy disks, and older storage media. T-3 to T-5 for most commercial applications.
- Hard drives (H-1 through H-7): HDDs and SSDs. H-4 (maximum particle area of 160 mm²) is the standard for most commercial hard drive destruction; H-5 and above for classified government use.
- ID cards and access cards (E-1 through E-7): Plastic cards with embedded chips, magnetic strips, or RFID. E-3 or higher for sensitive access credentials.
Our hard drive and media destruction services meet or exceed DIN 66399 H-4 standards, providing certified destruction documentation for all media types.
How DIN 66399 Levels Appear in Compliance Frameworks
While U.S. regulations like HIPAA and FACTA do not explicitly cite DIN 66399 level numbers, they describe destruction requirements that map to specific DIN levels. Understanding this mapping helps organizations select the right level:
- HIPAA: Requires PHI to be “rendered unreadable, indecipherable, and otherwise cannot be reconstructed” — maps to P-4 at minimum, P-5 recommended for highly sensitive PHI
- FACTA: Requires consumer financial information to be destroyed so it “cannot practicably be read or reconstructed” — maps to P-3 at minimum, P-4 recommended
- NIST 800-88: The U.S. government’s media sanitization guidelines use a framework compatible with DIN 66399 H-4 through H-6 for hard drives
- PCI DSS: Requires cardholder data on paper to be “rendered unrecoverable” when no longer needed — maps to P-4 at minimum
Working with a certified shredding provider that operates at P-4 or higher for all commercial shredding ensures your destruction practices meet these standards regardless of the specific regulation you’re operating under.
Choosing a Shredding Vendor Based on DIN 66399 Compliance
When evaluating shredding vendors for your New York business, DIN 66399 certification is one of the key quality indicators to look for. Reputable vendors will be able to specify exactly which DIN 66399 level their equipment operates at and provide documentation of this in their service agreements. Other factors to evaluate alongside DIN 66399 compliance include:
- NAID AAA Certification — the independent third-party certification that verifies a shredding company’s security practices through regular unannounced audits
- Certificate of Destruction for every destruction event, specifying the security level used
- Secure chain of custody from collection through final destruction
- Background-checked and trained personnel
- Service coverage across your locations in the New York metropolitan area
Contact New York Shredding to discuss the security levels appropriate for your specific documents and how our certified destruction services can meet your requirements.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services.