What Is the FACTA Disposal Rule? Requirements, Penalties, and Compliance

The FACTA Disposal Rule is a federal regulation that requires any business or individual who possesses consumer report information for a business purpose to destroy it securely once it is no longer needed. Codified at 16 CFR Part 682, the rule implements Section 216 of the Fair and Accurate Credit Transactions Act of 2003 and sets a functional standard: your destruction method has to make the data impossible to practicably read or reconstruct.¹ Getting it wrong is expensive. Consumers can sue for statutory damages of $100 to $1,000 each, and the FTC can seek civil penalties of up to $4,983 per knowing violation.²

Who Has to Comply

The rule reaches anyone under FTC jurisdiction who holds consumer information for a business purpose.³ The language is deliberately broad. Credit bureaus, banks, mortgage lenders, and insurers are the obvious targets, but the rule also covers:

Landlords who pull a tenant’s credit history
Employers who run background checks on applicants
Debt collectors who receive consumer reports during collection
Attorneys who obtain reports for litigation
Individuals in a business capacity — a homeowner who orders a background check on a prospective nanny is possessing consumer information for a business purpose and must dispose of it properly

One limit worth knowing: the FTC’s version of the rule applies to entities within FTC jurisdiction. Federal and state government agencies generally sit outside that scope, though a government contractor otherwise subject to FTC authority still has to comply.

What Counts as Consumer Information

Consumer information under the rule means any record about an individual that is a consumer report or is derived from one, in any format.⁴ Credit scores, payment histories, outstanding debts, employment records pulled from a reporting agency, and any staff notes or summaries built on a consumer report are all covered. So are compiled databases containing that data.

The format is irrelevant. A printed credit report in a filing cabinet, a PDF on a laptop, a spreadsheet on a shared drive, an old backup tape — the rule treats them the same. The one carve-out is aggregate or “blind” data that doesn’t identify any individual.⁴

What “Reasonable Measures” Actually Means

The rule doesn’t hand you a single approved method. It requires “reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal,” and the test is whether the data can practicably be read or reconstructed afterward.⁵ What is reasonable depends on the sensitivity of the information, the volume you handle, and the resources available to you.

Paper Records

The regulation specifically names burning, pulverizing, and shredding as acceptable methods for paper, so long as the result cannot be reassembled or read.⁵ Cross-cut shredding is the standard practical approach. A basic strip-cut shredder may not clear the bar for highly sensitive records because strip-cut output can sometimes be pieced back together. High-volume operations usually turn to a commercial shredding service.

Electronic Records

Electronic records must be destroyed or erased so the data cannot be recovered.⁵ Deleting files or reformatting a drive is not enough; standard recovery tools can pull that data right back. Meeting the standard usually means degaussing magnetic media, using cryptographic erasure, or physically destroying the drive. Wiping a laptop before donating it would not comply if consumer reports had been stored on it.

Hiring a Destruction Vendor

You are allowed to outsource destruction, but the responsibility stays with you. Before signing with a vendor, the FTC’s guidance describes the due diligence to perform:⁶

Review an independent audit of the vendor’s destruction operations or compliance with the rule
Obtain information about the vendor from multiple reliable sources
Require certification from a recognized trade association, such as NAID AAA
Review the vendor’s information security policies and procedures

Due diligence isn’t a one-time task. The regulation also expects you to monitor ongoing compliance with the contract.⁵

When You Have to Destroy Records

The rule tells you how to dispose of records but not when. The underlying statute is clear that nothing in it requires you to keep or destroy any record on a particular timeline; the rule only governs how you dispose of records once you decide to.⁷

Holding on longer than necessary carries its own risk, because a breach exposes everything still on hand. At the same time, other laws impose their own retention schedules. The EEOC requires employers to keep certain hiring records for at least a year, and banking regulators have separate retention rules. Your disposal timing has to respect every applicable retention requirement, not just this one. A documented retention schedule that identifies when each category of consumer information becomes eligible for destruction is the cleanest way to reconcile them.

What Noncompliance Costs

The FTC enforces the Disposal Rule under its authority over unfair or deceptive practices. A violation is treated as a violation of Section 5 of the FTC Act, opening up the commission’s full investigative and enforcement toolbox.⁸ For knowing violations that form a pattern or practice, the FTC can seek civil penalties of up to $4,983 per violation as of 2025, an amount that carries through 2026 because the annual inflation adjustment was not updated.² For a company that mishandled thousands of records, those per-violation figures compound quickly.

The Fair Credit Reporting Act also lets individual consumers sue, and the exposure depends on whether the violation was intentional or careless.

Willful Noncompliance

When a business knowingly or recklessly fails to comply, each affected consumer can recover actual damages or statutory damages between $100 and $1,000, whichever is greater. Courts can also award punitive damages, attorney’s fees, and costs.⁹ This is what makes class actions dangerous. Even at the $100 statutory minimum, mishandled records for 10,000 consumers put a company on the hook for at least $1 million before punitive damages come in.

Negligent Noncompliance

Without intent, a business is still liable for the actual damages a consumer suffered, plus attorney’s fees and costs.¹⁰ There are no statutory minimum damages here, so the consumer has to prove they lost money. When improperly discarded records lead to identity theft, actual damages can include fraudulent charges, lost wages spent fixing the problem, and credit monitoring costs.

How Long Consumers Have to Sue

A consumer has two years from the date they discover the violation to file suit, with an outer limit of five years from the date the violation occurred.¹¹ Improper disposal often surfaces long after it happens, so sloppy practices from years back can still generate liability today.

Building a Compliant Disposal Program

The rule doesn’t explicitly require a written policy, but its structure practically demands one. You have to implement procedures and monitor compliance with them, which is difficult without documentation.⁵ A workable policy covers a few core elements:

Scope — which departments and roles handle consumer report information, and what records they create or receive
Methods — the destruction procedure for each media type, from cross-cut shredding for paper to physical destruction for hard drives
Vendor management — your due diligence process and contractual requirements for any third-party destruction service
Training — protocols every employee who touches consumer information understands, with new hires trained before they handle these records
Verification and logging — a process for confirming destruction and keeping records of what was destroyed and when

Records of your own compliance are what let you defend against a later claim. Given that consumers have up to five years to sue after a violation, keeping a durable trail of destruction logs, vendor certifications, and training records is as much a part of compliance as the shredding itself.

1
eCFR. 16 CFR Part 682 – Disposal of Consumer Report Information and Records
2
Federal Register. Adjustments to Civil Penalty Amounts
3
eCFR. 16 CFR 682.2 – Purpose and Scope
4
eCFR. 16 CFR 682.1 – Definitions
5
eCFR. 16 CFR 682.3 – Proper Disposal of Consumer Information
6
Federal Trade Commission. Disposing of Consumer Report Information? Rule Tells How
7
Office of the Law Revision Counsel. 15 USC 1681w – Disposal of Records
8
Office of the Law Revision Counsel. 15 USC 1681s – Administrative Enforcement
9
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
10
Office of the Law Revision Counsel. 15 USC 1681o – Civil Liability for Negligent Noncompliance
11
Office of the Law Revision Counsel. 15 USC 1681p – Jurisdiction of Courts; Limitation of Actions