Document-security guide · Updated August 2026
Choose P-4 for everyday confidential paper and P-5 when higher-consequence information calls for materially smaller particles. A P-number describes destroyed paper size; it does not create compliance by itself, and it cannot replace secure retention, collection and disposal controls.

Quick answer
- P-4: paper particles no larger than 160mm² and no wider than 6mm under the level’s stated limits.
- P-5: paper particles no larger than 30mm² and no wider than 2mm—a substantially smaller permitted maximum.
- Choose by harm: consider identity, financial, employment, health, legal and intellectual-property consequences.
- Control the whole path: secure retention, locked collection, complete shredding and protected disposal matter alongside cut size.
P-4 versus P-5 is a measurable particle-size difference
The P category in ISO/IEC 21964 and the related DIN 66399 system applies to information represented on paper and similar printed material. The higher level allows smaller output particles. It is more precise than shopping labels such as “cross-cut” or “micro-cut,” which are not enough to identify a standard level.
| Level | Maximum particle area | Maximum particle width | Common example cut | Practical starting use |
|---|---|---|---|---|
| P-4 | 160mm² | 6mm | 4 × 40mm | Routine confidential and personal paper |
| P-5 | 30mm² | 2mm | 2 × 15mm | Higher-consequence information intended to remain secret |
Example dimensions illustrate products that can fit within each limit; the standard is defined by the permitted area and width, not by one mandatory rectangle. Check the exact machine’s declared P-rating and cutting size rather than assuming every P-4 makes 4 × 40mm pieces.
Interpretation: P-5 permits at most 30mm², 18.75% of P-4’s 160mm² maximum. This compares classification ceilings, not the exact output of every shredder or the probability of reconstructing a particular document.
Standard claim: ISO/IEC 21964-2:2018 specifies requirements for data-carrier destruction equipment and was confirmed current in 2025. Manufacturer classification guides publish the P-4 and P-5 particle limits above. Product compliance should be supported by the maker’s declaration for the exact model.
Choose the level from the information, threat and consequence
Start with what an unauthorized reader could do with the paper. A name and delivery address may support targeted fraud; a payroll file can expose identity and bank details; a patient record can cause privacy harm; an unfiled patent or acquisition plan can damage an organization. The same sheet count can therefore justify different controls.
| Paper type | Reasonable starting level | Question before disposal |
|---|---|---|
| Routine bills, statements and customer contact details | P-4 | Has the retention period ended, and is any original still required? |
| Internal working papers with ordinary personal or account data | P-4 | Would exposure create more than routine privacy or fraud risk? |
| Detailed medical, legal, payroll or investigation files | Consider P-5 | Does policy classify the information as secret or high consequence? |
| Strategy, unreleased design or sensitive research documents | Consider P-5 or higher | Is a certified destruction service or stricter approved level required? |
| Government-classified material | Agency-approved method | Which binding destruction standard and approved equipment apply? |
P-5 reduces particle size, not every disposal risk
A P-5 shredder beside an unlocked recycling bin does not secure documents waiting to be destroyed. Nor does it correct premature destruction of a record under a legal hold or retention schedule. Assign owners for retention, collection, shredding and final waste handling; restrict access to each stage; and document exceptions.
Do not mix media categories
The P level is for paper. Optical discs, magnetic media, electronic cards, film and hard drives have separate category letters and destruction limits. A machine advertised to accept cards or CDs may simply prevent jams; that claim does not grant those items the same security level as its paper output. Read the complete model declaration.
No federal disposal rule in these sources says “buy P-5”
The FTC Disposal Rule covers certain consumer-report information and uses an outcome-based standard: reasonable and appropriate measures to prevent unauthorized access or use. The FTC lists burning, pulverizing or shredding paper so that it cannot be read or reconstructed as examples. It also says reasonableness depends on sensitivity, costs and benefits, and changing technology.
HHS takes a similar outcome approach for paper protected health information. Its HIPAA guidance describes shredding or otherwise destroying paper so the PHI is essentially unreadable, indecipherable and cannot otherwise be reconstructed before disposal. It also discusses secure collection and qualified vendors.
A P-rating can support a risk-based destruction policy, but it is not legal advice or a compliance certificate. A regulated organization should map applicable laws, contracts, retention rules and incident risks to a written method, then have counsel or the responsible compliance owner approve it.
If a destruction vendor collects the material, review locked-container controls, chain of custody, employee screening, subcontracting, destruction method, certificate language and what happens to the residue. For HIPAA-covered work, determine whether the vendor relationship creates business-associate obligations.
The shredder you consistently use can be safer than a stalled “high-security” workflow
Smaller particles require more cutting. Within comparable product families, that can mean fewer sheets per pass or different throughput, but there is no universal P-4-to-P-5 performance ratio. Compare exact manufacturer specifications for sheet capacity, duty cycle, cool-down behavior, bin size and continuous-feed design.
Worked example: size the weekly job
- Count a representative week of eligible paper after removing documents that must still be retained.
- Suppose the office has 120 sheets and plans to feed six sheets at a time, below the selected machine’s stated maximum for that paper weight.
- 120 ÷ 6 produces 20 feed cycles. Test whether staff can complete that batch within the model’s documented duty cycle without rushing.
- If the queue routinely exceeds the workflow, compare a larger continuous-duty machine, an auto-feed model with secure access, or a vetted collection service.
- Place the approved collection point where sensitive waste is generated, then empty and dispose of residue according to policy.
The six-sheet planning load is an illustrative workflow assumption, not a shredder benchmark. Paper weight, folds, staples, envelopes, humidity and wear affect real capacity. Follow the exact manual and reduce the load at the first sign of strain.
Manual feed versus auto feed
Auto feed can make a large batch practical, but it introduces a holding tray that may contain readable documents. Look for access control if several people share the machine, and confirm whether stapled, folded or mixed paper is allowed in the automatic path. Manual-feed capacity and auto-feed capacity are different specifications.
P-4 and P-5 shredder buying checklist
- Declared level: a documented P-4 or P-5 rating for the exact model, plus its stated cut dimensions.
- Paper basis: sheet capacity at the paper weight you use; many headline capacities are tied to a specified grams-per-square-meter stock.
- Duty cycle: run and cool-down behavior that covers the representative batch without encouraging unsafe shortcuts.
- Feed design: manual or automatic capacity, throat width, jam reverse, bin-full sensing and safe handling of allowed staples or clips.
- Collection: bin volume, pull-out handling, bags if permitted and a route that prevents readable pages escaping around the cutters.
- Maintenance: the maker’s oil or lubricant-sheet procedure, cleaning instructions, warranty and service access.
- Safety: feed-entry protection, automatic stop and placement away from children, loose clothing, hair and unauthorized use.
- Non-paper claims: separate accepted-media list and destruction rating; never infer them from the P-number.
Noise figures, sheet capacities and run times should be compared only when manufacturers state equivalent test conditions. A higher headline sheet count is not useful if it applies to thinner paper than the office actually uses.
Common shredder mistakes and safer fixes
The shredder jams repeatedly
Stop feeding, use the documented reverse procedure and unplug the unit before any manual intervention allowed by its instructions. Reduce sheet count, flatten folds and remove unsupported materials. Never reach into the feed opening or use aerosol lubricant.
The motor stops during a batch
A thermal protection cycle may have activated. Follow the stated cool-down period rather than repeatedly restarting. If the normal workload exceeds the duty cycle, resize the equipment or schedule smaller controlled batches.
Paper strips or readable corners appear in the bin
Stop using the output as completed destruction. Confirm the material entered the cutters rather than falling beside them, inspect for damage using the safe procedure in the manual, and arrange secure re-destruction. Contact service if the cut no longer matches the model specification.
The bin fills sooner than expected
Fine particles can mound near the cutter outlet and trigger a full sensor before the bin looks evenly packed. Level residue only by the safe method the manufacturer permits, empty before material reaches the cutter and never compress shreds with a hand inside the machine.
Staff leave sensitive pages beside the machine
This is a process failure. Add a locked collection console or relocate the shredder, define an owner and service frequency, and train staff not to abandon documents. The best P-level cannot protect paper that never reaches the cutters.
Popular questions
Is P-5 more secure than P-4?
Yes for the paper particle limits: P-5 permits a maximum particle area of 30mm² and width of 2mm, versus 160mm² and 6mm for P-4. Overall security still depends on retention, access, collection and disposal controls.
Is P-4 enough for home financial documents?
P-4 is a strong practical starting point for routine confidential household paper, but “enough” depends on the information and threat. Retain records for the required period, shred only when eligible for disposal and keep unshredded papers secured.
Does HIPAA require a P-5 shredder?
The cited HHS disposal guidance does not prescribe P-5. It requires appropriate safeguards and describes destroying paper PHI so it is essentially unreadable, indecipherable and cannot otherwise be reconstructed. Covered organizations should follow their documented legal and risk requirements.
Are “cross-cut” and “micro-cut” official security levels?
No. Those are broad marketing descriptions. Compare the exact P-rating and stated cut dimensions, because products using the same cut-style term can produce different particle sizes.
Can a P-5 paper shredder securely destroy credit cards or discs?
Not on the P-rating alone. P applies to paper-based information. ISO/DIN systems use separate media categories, and the machine specification must identify which non-paper materials it accepts and the relevant destruction level.
Compare paper shredders
Verify the exact P-rating, cut dimensions, sheet-capacity basis, duty cycle, bin and maintenance requirements before choosing a machine for the approved disposal policy.
Sources and further reading
- ISO: ISO/IEC 21964-2:2018 destruction-equipment requirements
- Kobra: P-level paper particle-size overview
- Fellowes: DIN paper-shredder level classification
- Federal Trade Commission: Disposal Rule guidance
- HHS: disposal of paper protected health information
- r/privacy: recurring buyer questions about P-ratings, upkeep and alternatives
Editorial disclosure: ISO, manufacturer and government sources support the standard, particle-size and disposal-guidance statements above. Community threads were used to identify real questions about P-ratings, maintenance, batch size and using a destruction service, not as evidence that a particular shredder is secure or compliant. Jar Hearts did not test reconstruction resistance or shredder throughput.


