How to choose a reliable document destruction company? The 12-point checklist
Throwing away confidential paper is not hard. But destroying it demonstrably, securely and GDPR-compliant and being able to prove that to an auditor or the Dutch Data Protection Authority, that is a profession. Not every company that calls itself a ‘document destruction service’ delivers the same level of security, transparency and certification.
How do you tell the difference? These 12 questions let you establish whether a provider really does what it promises.
1. Does the provider work with a data processing agreement?
This is not optional. As soon as you transfer personal data to a third party, even temporarily, even for destruction, the GDPR (art. 28) requires a written data processing agreement (DPA).
Ask: ‘Can you send me your standard data processing agreement before we discuss an order?’
If a provider hesitates here or says this is ‘not needed for destruction’, walk away. Read more about the GDPR obligation when outsourcing in GDPR requirements for document destruction for SMEs.
2. Which DIN 66399 level does the provider offer?
The DIN 66399 standard determines how small the shreds are after destruction. Level P-4 is acceptable for ordinary office documents. Level P-5 is required for special categories of personal data (medical, citizen service numbers, ID copies).
Ask: ‘What DIN 66399 level do you destroy paper at by default?’
3. Does the provider supply a Certificate of Destruction?
After every destruction order you should receive a Certificate of Destruction stating at least: date, quantity, applied DIN standard and order number.
Ask: ‘Is the Certificate of Destruction included in the price and can you send me an example?’
4. Is your material transported sealed?
Professional destruction companies transport your boxes or containers with a numbered seal. That seal number is shown on the collection note and on the certificate.
Ask: ‘Do you use numbered seals during transport and do the seal numbers appear on the collection note and the certificate?’
5. How quickly after collection does destruction take place?
With the best providers this is within 24 hours. Longer interim storage means more risk: fire, burglary, unauthorised access.
Ask: ‘Within how many hours of collection is my material destroyed?’
6. Are the staff screened?
Serious destruction companies work with staff who hold a Certificate of Conduct (VOG, Verklaring Omtrent Gedrag).
Ask: ‘Do the staff who carry out orders hold a Certificate of Conduct?’
7. Is liability insured?
Ask: ‘Do you have liability insurance and what is the covered amount per event?’
8. Are you billed without hidden surcharges?
Fuel surcharges, small-order fees, administration fees, call-out charges, these are the most common surprises.
Ask: ‘Is the quoted price all-in? Are there fuel surcharges, call-out charges or administration fees?’
9. What happens to the paper after destruction?
Reliable providers dispose of it through certified recycling partners, so the paper is processed into new material. Read how that recycling process works in what happens to paper after shredding?
Ask: ‘What type of recycling processor does the shredded paper go to?’
10. Can you witness the destruction?
Ask: ‘Can I or a colleague be present at or supervise the destruction?’
11. Is a contract required, or can you order per job?
Ask: ‘Is there a minimum volume, contract term or notice period?’
12. How quickly can you be helped, including urgent cases?
In the event of a data breach or an unexpected audit you want to be helped within 24 hours. Read more about urgent destruction: when and how.
Ask: ‘Do you offer urgent destruction within 24 hours and what does it cost?’
The scorecard
Put these 12 questions to every provider you are considering. A party that gives a clear answer on all twelve points has its affairs in order. Does a provider waver on more than two of these points? Then keep looking.
Curious how DeSnipperaar scores on these 12 questions?
Call us or view our services and rates. We give you a direct answer on all twelve points.
View our ratesFrequently asked questions
What is the CA+ quality mark?
CA+ is a Dutch quality mark for paper destruction that sets requirements for collection containers, transport and destruction sites. Not every reliable provider holds it, but it is a positive signal when present.
Is DIN 66399 the same as CA+?
No. DIN 66399 is a European technical standard that defines the shred particle sizes. CA+ is a Dutch quality mark for the whole process. A provider can meet DIN 66399 without holding CA+.
Does a destruction company have to be GDPR-certified?
There is no legal ‘GDPR certificate’ for destruction companies. What counts is that they meet: a data processing agreement, appropriate security, a certificate, screened staff and demonstrable protection during transport.
How do I know the staff really hold a Certificate of Conduct?
Ask. Reliable providers confirm directly. Hesitation or evasive answers are a warning sign.
Is a cheap offer always suspicious?
Not necessarily. But if a provider is significantly cheaper, ask which parts they cut. A low price without a data processing agreement, certificate or secured transport is not a saving, it is a hidden risk.
Conclusion
Choosing a document destruction company is not a purchasing decision where price is the only factor. It is about demonstrably meeting your GDPR obligations and the legal certainty a certificate provides.
Use the 12 questions above as your standardised procurement protocol.
Comparing providers? Call us or request a quote via desnipperaar.nl. We give you a direct answer on all twelve points.