Paper documents and shredding: the often-forgotten side of secure disposal

Every article on every security site begins with the assumption that documents are digital. Most documents are, now. But the corner of the filing cabinet with last year’s tax returns, the stack of medical EOBs by the printer, the bank statements your parent still gets in the mail, the signed contracts from a real-estate closing — those are not digital, and they carry exactly the same sensitive information as their PDF equivalents.

Paper documents are handled in dumpsters. Dumpster diving is not a 1990s trope; it is still a reliable way for identity thieves to harvest usable information, and it is done at scale in low-surveillance environments. “Shred it” is the right answer. “Shred it properly” is a more specific answer, and the specifics matter.

What to shred, by category

Most of what arrives in your mailbox can go in the recycling without ceremony. A specific subset can’t:

Definitely shred

• Bank and credit card statements.
• Bank and credit card offers (pre-approved credit offers are specifically valuable to identity thieves — they can be opened in your name by someone pulling them out of the trash).
• Utility bills with full account numbers.
• Tax documents: W-2s, 1099s, returns, anything with your SSN.
• Medical records, EOBs, prescription labels — anything with diagnosis codes or policy numbers.
• Pay stubs (account numbers, SSN on older ones).
• Old passports, driver’s licenses, ID cards (cut up the plastic ones; shred the paper).
• Receipts with full credit card numbers (older receipts sometimes had them; modern ones usually show only the last four).
• Anything with a signature (signed contracts, checks, canceled checks).
• Legal documents with addresses, account numbers, or case details.
• Insurance documents with policy numbers.
• Anything pre-filled with your address and name in combination with any of the above.

Probably shred

• Junk mail addressed to you that contains any account or application info — the most common source of identity-theft scams.
• Prescription bottles with full name and details.
• Event tickets with personal details or barcodes.
• Boarding passes (the barcode can reveal frequent-flyer info).

Fine to recycle whole

• Generic junk mail (sales circulars, weekly ads).
• Magazines and newspapers.
• Packaging that doesn’t show your address label — and if it does, tear off the label and shred just that.

Cut types, in the order they matter

Shredders are classified by how finely they cut. The classification matters more than most buyers realize.

Strip-cut

The shredder reduces paper to long vertical strips. The strips are easily reassembled, by hand or by software. Do not buy a strip-cut shredder. They are a Halloween costume of a security control. They’re fine for non-sensitive paper.

Cross-cut

The shredder cuts into small rectangular confetti — typically around 4×40mm pieces. A cross-cut shredder makes reassembly significantly harder; for ordinary theft, effectively impossible. This is the floor for personal use.

Micro-cut

Tiny particles, ~2×15mm. Significantly harder to reconstruct; essentially the consumer equivalent of commercial-grade destruction. Best for sensitive or regulated records.

Levels by standard

The European DIN 66399 standard defines seven security levels (P-1 through P-7) for paper. Rough mapping to real buying advice:

• P-1, P-2 — strip-cut. Non-sensitive material only.
• P-3 — cross-cut, ~320mm² particles. Consumer minimum for personal records.
• P-4 — smaller cross-cut, ~160mm². Recommended for anything with financial info.
• P-5, P-6, P-7 — micro-cut and finer. Required for government classified material; overkill for most households.

US NIST SP 800-88 describes paper sanitization more loosely but converges on similar recommendations: cross-cut or finer for confidential, micro-cut for restricted.

Buying a shredder that’s actually worth using

A shredder you won’t use is worse than no shredder. Specifications matter, but so does the practical experience:

Capacity

Look for 10+ sheets per pass. Shredders that accept 3-5 sheets are miserable to use — you spend 20 minutes to process what should take two. The sheet-count is marketing-optimistic; derate by 20%. A “12-sheet” shredder is comfortable with 8-10 sheets of normal paper.

Run time

Shredders have a duty cycle: X minutes of operation, then Y minutes of cool-down. Cheap shredders run for 3-5 minutes then need 20-30 minutes off. Good home shredders run for 20-30 minutes before needing a break.

If you only shred a few things a week, duty cycle doesn’t matter. If you’re cleaning out a decade of files, it matters a lot. A shredder that has to cool off every five minutes will make the project take a whole Saturday.

Auto-feed

Higher-end home shredders have an auto-feed tray — drop a stack of up to 100 sheets, close the lid, walk away. These are about twice the price of manual shredders and dramatically better if you have volume.

Cut type

Per above — cross-cut minimum, micro-cut preferred.

Bin size

Capacity determines how often you empty. 5-7 gallons is typical for a home shredder; bigger bins cost more but mean less emptying. Emptying a cross-cut shredder is messy; expect paper confetti everywhere. Shred over a clean area or use shredder bags.

Specific recommendations (by type, not brand — these change)

• Low-volume cross-cut for occasional use: $60-100 range. Something rated 10-12 sheets, 5-minute duty cycle.
• Medium-volume micro-cut for a household: $150-250 range. 10-15 sheets, 20-minute duty cycle.
• Auto-feed for bulk cleanup: $250-400 range. 100-sheet auto- feed bin, 30-minute duty cycle.

Things that aren’t paper but need destruction too

Your shredder handles more than plain paper if you know its limits:

• Credit cards and ID cards: most home shredders can take one or two plastic cards at a time. Check the manual; forcing them into a paper-only shredder jams it.
• CDs and DVDs: some shredders have a separate slot; most don’t. For a few discs, kitchen scissors work. For many, a dedicated disc-shredder or the shred service.
• USB flash drives and SSDs: not paper shredders. See retiring old devices for the right method (cryptographic erasure or physical destruction).
• Check stubs, pay stubs: cross-cut works; watch for staples.
• Bound notebooks or stapled packets: remove the binding and staples; shred the pages.

When to use a professional shred service

For anything large:

• Cleaning out a decade of records during a move.
• Closing a small business’s files after the retention period.
• Disposing of client records under HIPAA / legal / accounting regulations.

Professional shred services (Shred-it, Iron Mountain, regional operators) work two ways:

• Drop-off: bring documents to their facility. Cheapest.
• Scheduled pickup: they bring a locked bin to you; when full, they pick up and shred off-site or in a shred truck.
• On-site shredding: a truck comes to you and shreds everything while you watch. Most expensive, most theatrical, best audit trail.

For regulated use, request a certificate of destruction — a document stating what volume of material was destroyed, when, and how. This is evidence for HIPAA/GDPR/professional compliance audits.

Cost

A household’s decade of paperwork: often $30-60 for a drop-off shred at Staples / Office Depot / a local shred service. A small business’s annual cleanup: $100-300. On-site shredding at a business: $150-300 per service call.

Retention periods before shredding

Don’t shred things you might need. Common retention guidance:

• Tax returns and supporting documents: 7 years (US). Some professionals keep indefinitely. Three years is the audit window for most ordinary issues; six years if significant underreporting; no limit for fraud. Seven years is the safe default.
• Bank and credit card statements: 1 year typically; keep until tax records for that year are filed, then 7 years with the tax records if they support tax claims.
• Pay stubs: until reconciled with W-2 each year, then shred.
• Receipts: keep receipts for major purchases (warranties, large deductions) for the relevant period; ordinary receipts can go in a few months.
• Medical EOBs: one year typically; longer if there’s an ongoing dispute or chronic condition.
• Contracts: for the duration of the contract plus at least the statute of limitations in your jurisdiction (often 4-6 years).
• Real-estate closing documents: for as long as you own the property plus 7 years after sale.
• Birth, marriage, death certificates; passports; diplomas: never shred. Scan, store original in a fireproof lockbox.

A small-business note

For a solo practice or small business handling any regulated records (health, legal, financial, tax preparation):

• Document a disposal policy in writing. Retention periods, destruction method, who’s authorized to destroy, how destruction is logged.
• Use a service for anything beyond occasional volume. The certificate of destruction is worth the cost under HIPAA, GDPR, and professional compliance regimes.
• Log destruction events: date, volume, method. A text file is sufficient for most small operations; auditors want to see you took the disposal seriously.

Paper is unfashionable in security writing. It remains, stubbornly, the medium for a non-trivial portion of the sensitive documents in most households and small businesses. A cross-cut shredder by the door, a retention habit, and a professional service for volume is the whole program. It’s boring. It works.