Home › Knowledge base › Outsource or do it yourself
Practice

Document destruction: outsource or do it yourself? The honest trade-off for SMEs

· 10 min read · DeSnipperaar
Document destruction: outsource or do it yourself

You have a stack of outdated paper. Retention periods have expired, an archive cabinet is full, or a move is planned. The question is: do you fetch a paper shredder from the supply room, or do you order a collection service?

Both options can be legitimate. Which is the right one for you depends on volume, content, DIN requirements and the value of your time. This article lays out that trade-off honestly, without arguing for either side.

The core of the difference

FactorDestroy yourselfOutsource
Cost per jobLow (power plus time)Fixed price per box/container
Time investmentHigh (man-hours per folder)Low (set boxes ready, the rest is done for you)
DIN levelDepends on your machineSet by the provider (ask for P-5)
Chain of evidenceYou make your own logCertificate of Destruction included
GDPR riskHigher if documentation is missingLow if a DPA and certificate are in place
ScalabilityLimited (machine capacity)Unlimited (any volume collectable)

When is destroying it yourself realistic?

Small volume, regularly

If you have ten to twenty sheets of paper a week, daily print-outs, receipts, internal memos, a P-4 office shredder is an efficient choice. You destroy while you work, no collection moment is needed.

Documents that contain no special categories of personal data

For internal meeting material, draft versions or non-privacy-sensitive documents, P-4 suffices. You do not need to engage an external service for every sheet.

If you do document it

The GDPR problem with destroying it yourself is not the shredder, but the lack of evidence. If you keep a simple log (date, description, quantity, initials), you have a demonstrable chain of evidence for ordinary categories of personal data.

When is destroying it yourself insufficient?

More than 50 folders per quarter

An average office shredder has a throughput of 8 to 12 sheets per minute, with a mandatory cool-down of 30 minutes after every 15 to 30 minutes of use. For 50 folders of roughly 100 sheets each, you quickly reckon on 3 to 5 working days of pure shredding. Those man-hour costs quickly exceed the price of an external collection service.

Content with special categories of personal data

Personnel files with citizen service numbers, medical files, copies of ID documents and financial client data fall under special categories. A cheap office shredder at P-2 or P-3 is insufficient for this.

See also: cross-cut versus strip-cut: why particle size determines everything.

With data carriers

An office shredder cannot destroy hard drives, SSDs or USB sticks. Wiping SSDs via software is not an option either, wear-levelling and spare cells hold on to data.

If you expect an audit

An external certificate (with order details, weight, DIN level and sealed transport) makes a stronger impression on an inspector than an internal log and rules out discussion.

The cost comparison, calculated honestly

Example: SME, two archive cabinets per year (approx. 100 folders, ≈ 100 kg of paper).

Scenario A, do it yourself

Scenario B, outsource

The maths is surprisingly simple: at this volume outsourcing is cheaper than doing it yourself, if you honestly count the man-hour cost. Above approx. 5 boxes per year the balance tips.

Decision chart for your situation

More than 5 boxes per year?
  YES  → Outsourcing is usually cheaper (including your own time)
  NO   → Doing it yourself is fine, if a P-4/P-5 machine is available

Do the documents contain special categories of personal data?
(medical, BSN, ID copy, financial)
  YES  → Outsourcing with P-5 and a certificate strongly recommended
  NO   → Doing it yourself with a good machine and a log suffices

Are there also hard drives, SSDs or USB sticks?
  YES  → Outsourcing required (no office shredder can do this)
  NO   → Go to the next question

Do you expect a GDPR audit or professional inspection?
  YES  → A certificate via outsourcing gives the most certainty
  NO   → Choose based on volume and cost

The hybrid approach

Many SMEs combine both methods effectively:

Curious what outsourcing costs for your volume?

Call us for a price within 5 minutes, or request a quote directly. No contract, a certificate with every order.

Request a quote

Frequently asked questions

Is an office shredder sufficient for the GDPR?

For ordinary office documents without special categories of personal data: yes, provided the level is at least P-4 and you keep a log. For special categories: no, then P-5 and demonstrably sealed transport are required.

May I just shred my own documents and then throw them in the paper container?

If you reach P-4 or P-5: yes, the shreds may go in the paper container. Strips from a strip-cut machine at P-2 are still reconstructable.

How do I know which DIN level my machine reaches?

It is on the device or in the specifications. Look for ‘DIN 66399’ or ‘Sicherheitsstufe P-X’. If nothing is stated: assume it is P-2 or P-3.

What is the downside of outsourcing?

You temporarily hand over physical control. Mitigate this with sealed transport, destruction within 24 hours and a provider with a data processing agreement.

Conclusion

Destroying it yourself is acceptable for small volumes of ordinary documents with a good machine and a maintained log. As soon as volumes grow, special categories of personal data come into play, or data carriers have to go too, outsourcing is almost always the wiser choice, financially as well.

Want to know what outsourcing costs for your volume? Call us for a price within 5 minutes, or request a quote directly via desnipperaar.nl.