Security

Working from home with confidential documents: how to do it safely

28 June 2026 · 10 min read · DeSnipperaar

Since working from home became normal, part of the office records moves along to the living room. A printed client file on the dining table, a payslip next to the printer, a note with a phone number on a sticky. At the office there are arrangements for that, but at home any structure is often missing. That is exactly where data breaches arise, not through hackers but through everyday carelessness.

This article explains why home working is a privacy risk, what the GDPR thinks of it and how staff and employers manage and destroy confidential documents safely at home. With practical tips and a clear route from kitchen table to safe destruction.

Why home working is a privacy risk

An office is set up for confidentiality, with locked cabinets, a destruction bin and colleagues who know how it should be done. A living room is not. At home work documents lie among the private post, housemates or visitors read along and paper soon ends up with the ordinary household waste. Those who work in a cafe or on the train add reading-along risk and the chance of forgotten documents. The result is that sensitive data ends up in places you would never allow at the office.

On top of that, at home no one is watching whether it is going well. On a team, colleagues see a pile that lingers; at home no one notices. A mistake therefore stays unnoticed longer, sometimes until a person concerned comes forward or a neighbour finds something. The risk is not that home workers are sloppier than at the office, but that the natural oversight of an office environment is missing. With a few simple arrangements you fill that gap without home working becoming cumbersome.

Which documents do staff take home?

• Printed client or patient files with names and data.
• Payslips and personnel documents with ID numbers.
• Contracts and quotes with commercially sensitive information.
• Notes and stickies with passwords or phone numbers.
• Meeting documents prepared at home.

What the GDPR thinks of it

The GDPR makes no distinction between office and kitchen table. Article 5 requires storage limitation, you do not keep data longer than needed, at home too. Article 32 requires appropriate measures to protect personal data, wherever work is done. Importantly, the employer remains the data controller, even when an employee works from home. A data breach because a neighbour finds a discarded client file is therefore down to the organisation. How this fits the wider GDPR picture is in GDPR requirements for SMEs.

The home workspace: six risks and solutions

• Paper on the kitchen table. Use a lockable drawer for work documents.
• Housemates or visitors reading along. Lock your screen and turn paper over when you walk away.
• Work paper with the household waste. Collect it separately and take it to the office.
• Home prints that linger. Print only what is really needed.
• Working in a cafe or train. Avoid sensitive documents in public spaces.
• Old devices. Hand in a replaced laptop for safe destruction.

The route from kitchen table to safe destruction

The core is simple. Whatever confidential paper arises at home does not belong with your own waste paper but back to the organisation for safe destruction. Agree that staff collect work paper in a separate folder or envelope and take it to the office, where it goes in the locked destruction bin. Those who rarely or never come to the office can shred at home to a high level, see destroying confidential documents at home. For larger amounts the employer has it collected periodically, with a certificate as proof. Whichever route you choose, the main thing is that home-work paper has a fixed destination and is not left to chance.

Which DIN level do you need?

How finely paper must be shredded is set out by the DIN 66399 standard in levels. For home-work documents these mainly matter.

Level	Particle size	Suitable for
P-2	Strips	General print without data
P-4	Small particles	Client documents, contracts, notes
P-5	Very small particles	Payslips with ID numbers and special data

A cheap strip-cut shredder at home does not reach P-4 or P-5. For really sensitive documents it is therefore safer to collect them and have them destroyed professionally at the office or via a collection.

A data breach at home: what if it goes wrong?

Imagine an employee throws a printed client file out with the waste paper at home, which stands at the kerb a week later. A passer-by takes it. That is a data breach. Because the employer is the data controller, the reporting duty lies with the organisation. A serious data breach you report within 72 hours to the data protection authority and inform the people concerned where needed. The annoying thing is that such incidents at home often go unnoticed until it is too late. That is exactly why a fixed route for home-work paper is so important, because what disappears into a locked bin cannot end up on the street.

Working from home in a public place

Not every home-working day is at home. More and more people work in a cafe, on the train or at a flex spot. The same rules apply there, but the risks are greater. A screen can be read from the side, a conversation overheard and paper lingers faster. So avoid sensitive documents in public spaces and use a privacy screen for your laptop where needed. Print nothing on the go and take back everything you bring along. A forgotten folder on the train is a data breach you could easily have prevented.

The digital side of home working

Not everything is paper. A home worker logs into systems, sometimes saves files locally and uses their own devices. Lock the screen when leaving the workspace, at home too, so housemates do not read along. Do not save work files locally unnecessarily and delete downloads you no longer need. If a personal or company laptop is replaced, hand over the old carrier for physical destruction, because deleting a file does not really remove the data. The approach is in data destruction.

Sensitive professions call for extra care

If you work in healthcare, an HR department or financial services, you often take special personal data home. Medical data, an ID number on a payslip or financial files fall under stricter rules. For those documents a high destruction level and extra care at home apply. Keep them no longer than the task needs and keep them separate from your private records. In doubt the simple rule applies, treat work paper at home as if your manager is watching.

Policy for employers

An employer cannot leave home working to chance. Set out in a simple policy how staff handle confidential paper, from a lockable drawer to taking it to the office for destruction. This dovetails seamlessly with a clean desk policy, see clean desk policy and destruction. Communicate the policy, include it in onboarding and facilitate it, for example with a locked bin at the office where home workers can leave their paper. The general rules around destruction are in destroying confidential documents.

A real-world example

Imagine an HR employee works two days a week from home and regularly prints payslips and employment contracts for checking. Without arrangements those end up after use in the paper bin with the household waste, ID numbers and all. With a clear route the employee collects the documents in a lockable folder and brings them in every office day, where they go in the destruction bin. The employer has that bin collected and destroyed periodically, with a certificate. A small habit that prevents a data breach with sensitive personnel data.

Costs and process for the employer

Organising destruction for home workers is no big expense. The employer places a locked bin at the office and has it collected periodically, at a fixed price and with no call-out fee within 20 km of Amsterdam. The material is destroyed to the agreed DIN level and recycled, with a certificate within a few working days. Data carriers such as replaced laptops can come along in the same collection. A price guide is in what does archive destruction cost.

A fixed routine for hybrid work

Most people now work partly at home and partly at the office. Make that alternation an advantage. Agree that confidential home-work paper comes back every office day, so it never lingers long at home. Someone who is at the office on Mondays brings the folder every Monday. That creates a rhythm in which sensitive documents end up in the right place by themselves, without anyone having to think about it separately. A routine is stronger than a rule you have to remember each time.

What does a client expect?

Clients and staff assume their data is safe, whether it is processed at the office or at home. A client who hears their file lay on a dining table loses trust, even if nothing went wrong. An organisation that can show home working happens just as carefully as at the office projects professionalism. A clear home-working policy and a certificate of destruction are concrete proof that you take privacy seriously, wherever your people work.

Practical tips for home workers

• Print as little as possible, work digitally where you can.
• Use a lockable drawer for paper with personal data.
• Lock your screen when leaving the workspace.
• Never bin work paper with the household waste, but collect it separately.
• Take it to the office for the locked destruction bin.

Common mistakes

• Work paper with your own waste paper. With personal data that is a data breach at the organisation.
• Keeping everything at home just in case. What can go should be destroyed confidentially.
• Making no arrangements. Without a policy everyone just does their own thing.
• Forgetting the old laptop. It holds work data just as much.

The proof: certificate of destruction

If the employer has the collected paper picked up, a certificate of destruction comes with it, showing the date, quantity and DIN level. That is the proof that documents arising at home too were destroyed carefully, handy towards the data protection authority or an auditor.

Frequently asked questions

Can I bin confidential work paper at home with the waste paper?

No. Work documents with personal data do not belong with your own waste paper. Take them to the office for destruction or shred them to a high level.

Who is responsible for a data breach at home?

The employer remains the data controller, even when an employee works from home. So an employer should make arrangements about paper and screens at home.

How do I store work documents safely at home?

Use a lockable drawer or cabinet for paper with personal data and leave nothing unattended on the kitchen table. Lock your screen too.

Must I destroy home-printed documents separately?

Yes. A home print of a client file or payslip is just as sensitive as at the office and should be destroyed confidentially.

Which DIN level do I need?

For ordinary work documents DIN 66399 P-4 is the workable minimum. For payslips with ID numbers P-5 is indicated.

What should an employer do best?

Make a simple home-working policy, facilitate a locked bin at the office and have the gathered paper collected and destroyed periodically with a certificate.

Conclusion

Home working need not be a privacy risk, provided there are clear arrangements. Print as little as possible, keep paper with personal data in a lockable drawer and never bin it with the household waste. Take work paper to the office for the destruction bin and have the employer collect that periodically, with a certificate. That keeps the kitchen table a safe workspace and your organisation GDPR-proof, wherever your people work. It takes little effort and prevents a data breach that would cost your organisation far more time and trust.

---

Arrange safe destruction for your home workers? Request a quote via desnipperaar.nl or see how to have paper shredded. Within 5 minutes you have a fixed price.