Updated November 2026 · Southern New Hampshire
Paper shredding security levels: strip-cut, cross-cut and micro-cut
Paper shredding security levels explained in plain words: what P-1 to P-7 mean under DIN 66399 and ISO/IEC 21964, and how big the pieces are at each level. You will also see what HIPAA and the FTC actually require, and how to pick a level for a home office or a business.
Cross-cut shredding at our Tewksbury office, 99¢ per pound. Certificate of Destruction on every job.
- 99¢ per pound
- Cross-cut every job
- Since 2007
- BBB A+
Quick answer
Paper shredding security levels run from P-1 to P-7 under the German standard DIN 66399, which ISO/IEC 21964 now carries internationally. P-1 allows strips up to 12 mm wide, P-4 allows particles up to 160 square millimetres, and P-7 allows particles no larger than 5 square millimetres. HIPAA and the FTC Disposal Rule do not name a level: they require paper to be shredded so it cannot practicably be read or reconstructed. New Hampshire Document Shredding cross-cuts every job at its Tewksbury office as part of its document shredding service.
What paper shredding security levels actually measure
A security level is a size limit. It tells you the largest piece of paper a shredder is allowed to leave behind. Smaller pieces mean more work for anyone trying to put a page back together, so the level climbs as the pieces shrink.
The scale most people mean comes from DIN 66399, a German standard for destroying data carriers. Its terms and principles were taken up internationally as ISO/IEC 21964, published in 2018 in three parts. Part 1 covers principles and definitions, Part 2 the requirements for the machines, and Part 3 the process of destruction. ISO lists Part 1 as reviewed and confirmed in 2025, so the series is still current.
The standard does not only cover paper. HSM, a German shredder maker, summarizes six media categories: paper in original size (P), information in reduced format such as film (F), optical media (O), magnetic data carriers (T), hard drives (H) and electronic data carriers (E). This post is about the P scale. Drives and phones follow their own rules, which we cover on our hard drive destruction page.
Strip-cut
Parallel blades slice the sheet into long ribbons the length of the page. Fast and simple. The P-1 and P-2 levels are defined by strip width, 12 mm and 6 mm.
Cross-cut
The sheet is cut in two directions, so it comes out as short particles instead of ribbons. From P-3 up, the levels are defined by the area of each particle.
Micro-cut
A maker’s name for very small cross-cut particles. It is a label, not a level. Read the P-number on the machine to know what you are buying.
The seven paper shredding security levels, P-1 to P-7
Here is the paper scale as HSM summarizes DIN 66399. The size column is the largest piece allowed. The middle column is the kind of document HSM suggests for each level, and the last column paraphrases how hard HSM says reconstruction becomes.
| Level | Largest piece allowed | Typical paper, per HSM | Reconstruction |
|---|---|---|---|
| P-1 | Strips up to 12 mm wide | Catalogues, brochures, general documents | Easy |
| P-2 | Strips up to 6 mm wide | Internal papers such as old instructions | Possible with some effort |
| P-3 | Particles up to 320 mm² | Sensitive and personal data | Only with considerable effort |
| P-4 | Particles up to 160 mm² | Particularly sensitive data, such as salary statements and employment contracts | Only with extraordinary effort |
| P-5 | Particles up to 30 mm² | Very sensitive material such as medical reports and patents | An undefined amount of effort |
| P-6 | Particles up to 10 mm² | Secret material needing extraordinary precautions | Not possible with current technology |
| P-7 | Particles up to 5 mm² | Top-secret military and intelligence material | Impossible |
Look at the drop between P-3 and P-5. A P-3 particle can be up to 320 square millimetres, for example a sliver 4 mm wide and 80 mm long. A P-5 particle can be no more than 30, less than one tenth of that. That jump is where shredders stop producing pieces you can read a word on.
To picture the units, a square millimetre is a square one millimetre on each side. A strip 6 mm wide, the P-2 limit, still carries a slice of every line of type it crosses, often two or three whole characters wide. Lay the strips side by side and the page starts to reappear. That is why strip-cut paper is the easiest to reassemble.
Protection classes: matching the level to the paper
DIN 66399 also groups the levels into three protection classes. The class describes how much harm a leak would do, and the levels inside it are the ones that fit. HSM puts it this way.
| Protection class | What a leak would mean | Levels that fit |
|---|---|---|
| Class 1, normal | Internal data. A leak would have a limited effect on the company | P-1, P-2, P-3 |
| Class 2, higher | Confidential data. A leak could hurt a person’s social or financial standing | P-3, P-4, P-5 |
| Class 3, very high | Particularly confidential and secret data. A leak would be an existential threat | P-5, P-6, P-7 |
Most of what crosses our counter lands in class 2. Bank statements, tax returns, payroll, patient intake forms and client files all carry names, account numbers or Social Security numbers. A leak of any of them could damage a person’s finances or reputation, which is exactly how class 2 is described.
Class 3 is for material whose exposure would threaten the organization itself: defense work, intelligence, research secrets. Few New Hampshire households or small offices hold paper like that, and if yours does, your contract or your security officer will name the level for you.
Strip-cut, cross-cut, micro-cut: how the cutters differ
Inside a shredder, paper feeds between two rotating shafts fitted with cutting discs. On a strip-cut machine the discs only slice along the length of the sheet, so a page comes out as long ribbons. Cross-cut machines add a second cut across the ribbons, so the page leaves as short particles.
The trade-off is effort. Every extra cut means more blade contact per sheet, so a finer machine in the same price range can take fewer sheets per pass than a coarser one. Check the sheet capacity and the P-number together when you compare machines.
Shop by the number, not the name. Makers use words like mini-cut, micro-cut and high-security in their own ways. The P-number printed on the machine or its packaging is the claim you can compare from one brand to the next.
What the law asks: unreadable, not a P-number
Here is the part that surprises people. Neither HIPAA nor the FTC Disposal Rule names a security level. Both set an outcome and leave the method to you.
| Rule | What it says about paper | Does it name a level? |
|---|---|---|
| HIPAA Privacy Rule, 45 CFR 164.530(c), as explained in HHS disposal guidance | Shredding, burning, pulping or pulverizing paper PHI so it is essentially unreadable, indecipherable and cannot be reconstructed are examples of proper disposal | No. HHS says the rules do not require a particular disposal method |
| FTC Disposal Rule, 16 CFR 682.3(b)(1) | Burning, pulverizing or shredding papers with consumer information so it cannot practicably be read or reconstructed is a reasonable measure | No. The examples are illustrative |
| NIST SP 800-88 Revision 1 (2014), Table A-1 | Destroy paper with cross-cut shredders that make particles 1 mm by 5 mm or smaller | A size, not a P-level. Withdrawn September 26, 2025, superseded by Revision 2 |
That NIST figure is worth a second look. A particle 1 mm by 5 mm has an area of 5 square millimetres, the same ceiling as P-7 on the DIN scale. It was written for federal agencies, not for a dental office in Salem, and NIST withdrew that revision in 2025. It still shows how high the bar sits for classified-grade destruction.
For everyone else the test is practical: could someone read it or put it back together? Strip-cut ribbons fail that test far more easily than cross-cut particles. Our post on HIPAA shredding requirements covers what a practice should document, and our post on the FACTA disposal rule explains who the FTC rule covers.
Be wary of anyone who tells you HIPAA requires a specific P-level. HHS guidance says the opposite: covered entities decide what is reasonable for their own records, and paper must end up unreadable and impossible to reconstruct.
Picking a paper shredding security level for home
For a household, the question is what lands in the bin. Bank and credit card statements, tax returns, pay stubs, medical bills and anything with your Social Security number belong to class 2 by HSM’s description. P-4 is the level HSM pairs with particularly sensitive personal paper such as salary statements, so it is a sensible floor for a home office.
Strip-cut machines are cheap for a reason. A P-1 or P-2 ribbon keeps readable characters from every line it crosses, and anyone patient enough can line the ribbons up. If you own one, keep it for junk mail and catalogues, and treat it as a step up from the trash, not a security device.
Think about the bin, too. EPA says whether shredded paper can be recycled depends on your local program. Check your town’s transfer station or curbside rules before the first bag goes out.
The other limit at home is time. A small cross-cut machine handles a few sheets at a time and needs rest breaks on long runs. A year of household paper is easy. A parent’s estate or a decade of files in the basement is not. Our guide to the best home paper shredder features covers what to compare, and our post on home shredder cost runs the numbers on owning one.
Offices: level, volume and the paper trail
An office has the same choice to make with more at stake, because regulators and clients may ask how you destroy records. A level on the machine is part of the answer. The rest is a written policy and proof that you followed it.
- Sort your paper by harm. Marketing drafts and public material are class 1. Anything with client, patient, employee or account data is class 2. Very few small offices hold class 3 paper.
- Set a floor. Write down the minimum you accept for class 2 paper, whether that is cross-cut from a service or a P-4 or finer office machine.
- Decide who shreds. Office machines suit a light, steady trickle. Big volumes, purges and anything your policy wants documented are cheaper and easier to send out.
- Lock the waiting paper. Paper waiting to be shredded needs the same protection as the file it came from. A locked console or closet, not an open bin under the printer.
- Keep the proof. File the Certificate of Destruction for every service job with your retention policy, so an auditor sees what was destroyed and when.
Cost is usually what settles step three. Dropping paper at our Tewksbury office costs $64.60 for one banker’s box, $183.40 for five, $234.90 for ten and $434.90 for twenty, all fees included. Our post on shredding cost compares those numbers with buying and running an office machine.
What happens to paper you bring us
We shred at one place, our office at 1215 Main Street, Unit 115, Tewksbury, MA, on Route 38 near I-495. Every job is cross-cut. Your boxes stay in locked handling until they are shredded, and drop-off paper is shredded the same business day.
- Cross-cut shredding on every job, drop-off, pickup or witnessed
- No need to pull staples, paper clips or file folders
- A Certificate of Destruction with every job
- 100 percent of the shredded paper recycled
- Witnessed sessions at our office if your policy says someone must watch
Our post on how document shredding works follows a box from our counter to the recycling mill. If you would rather drive your boxes down, our drop-off shredding page has hours and directions. Call (978) 636-0301 with any question about how we handle a specific kind of record.
Frequently asked questions
What are the paper shredding security levels?
DIN 66399, carried internationally as ISO/IEC 21964, defines seven paper levels, P-1 to P-7. P-1 and P-2 are strip widths of 12 mm and 6 mm. P-3 to P-7 are particle areas of 320, 160, 30, 10 and 5 square millimetres. The higher the number, the smaller the pieces.
Is cross-cut the same as P-4?
Not always. Cross-cut describes how the machine cuts, in two directions. The P-level describes how small the pieces are. Cross-cut machines are sold at several levels, commonly P-3 or P-4, so check the P-number on the machine itself rather than relying on the word cross-cut.
What security level does HIPAA require?
None by number. HHS guidance says the HIPAA rules do not require a particular disposal method. Paper PHI must be shredded, burned, pulped or pulverized so it is essentially unreadable, indecipherable and cannot be reconstructed. A practice decides what is reasonable for its records and documents its policy.
Does the FTC Disposal Rule name a shredding level?
No. Under 16 CFR 682.3, anyone who keeps consumer report information for a business purpose must dispose of it with reasonable measures. Burning, pulverizing or shredding paper so it cannot practicably be read or reconstructed is the rule’s own example, and the rule says its examples are illustrative.
Is a strip-cut shredder good enough for bank statements?
We would not rely on one. HSM describes P-1 strip-cut output as easy to reconstruct, and a ribbon 6 mm or 12 mm wide still carries readable characters from every line it crosses. Use a cross-cut machine for anything with account numbers, or bring the paper to us for cross-cut shredding at 99 cents a pound.
What level is micro-cut?
Micro-cut is a maker’s name, not a level in the standard. It usually means smaller particles than an ordinary cross-cut machine, but the only reliable answer is the P-number printed on the machine or its packaging. Compare that number, along with sheet capacity, from one brand to the next.
What security level does New Hampshire Document Shredding use?
Every job is cross-cut at our office at 1215 Main Street, Unit 115, Tewksbury, MA. Paper stays in locked handling until it is shredded, every job comes with a Certificate of Destruction, and 100 percent of the shredded paper is recycled. Call (978) 636-0301 if your policy needs more detail.
Can shredded paper go in my recycling bin?
It depends on your town. EPA says whether shredded paper can be recycled depends on your local recycling program, so there is no single answer for New Hampshire. Check your own town’s transfer station or curbside rules before you put shred out, or bring the paper to us and we recycle all of it.
Sources
- HSM, Security levels (DIN 66399 and ISO/IEC 21964 summary) (checked November 2026)
- ISO, ISO/IEC 21964-1:2018 Information technology, Destruction of data carriers, Part 1 (checked November 2026)
- HHS, What do the HIPAA Privacy and Security Rules require of covered entities when they dispose of PHI (checked November 2026)
- 16 CFR 682.3, Proper disposal of consumer information (govinfo.gov) (checked November 2026)
- NIST SP 800-88 Revision 1, Guidelines for Media Sanitization, Table A-1 (withdrawn 2025) (checked November 2026)
- EPA, How Do I Recycle Common Recyclables (checked November 2026)
Bring us the paper that should not be strip-cut
Drop off at our Tewksbury office, book a pickup, or watch it happen in a witnessed session. Every job is cross-cut and comes with a Certificate of Destruction.
Where we shred
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38, near I-495. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
- Drop-off: walk in, 99¢ per pound
- Pickup: from $129.95 by zone
- Witnessed: $1.99 per pound, $100 minimum
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.