Meta description: Learn what the FTC’s Consumer Information Disposal Rule requires, how to dispose of consumer records securely, and why it is different from Regulation N.
The Consumer Information Disposal Rule is a federal requirement for securely disposing of certain consumer information. It applies to businesses and individuals that use consumer reports, including credit reports, for business purposes. Despite the similar-sounding terminology, this rule is not Regulation N: Regulation N concerns mortgage advertising, while the Disposal Rule addresses the destruction or disposal of sensitive information. Knowing which rule applies helps organizations protect consumers and avoid compliance mistakes.
What Is the Consumer Information Disposal Rule?
The Consumer Information Disposal Rule is the common name for the Federal Trade Commission’s rule on the disposal of consumer report information and records. It is part of the Fair and Accurate Credit Transactions Act of 2003, known as FACTA, and is codified at 16 C.F.R. Part 682.
The rule requires people and organizations that maintain or possess consumer information derived from consumer reports for a business purpose to take reasonable measures to dispose of it securely. The FTC adopted the rule to reduce the risk that information discarded carelessly could be retrieved and used for identity theft or fraud.
“Disposal” includes more than throwing paper into a trash can. It can involve destroying, erasing, or otherwise making records unreadable or undecipherable, whether they are on paper, in a computer system, or on another storage medium. The required method depends on the information, its format, and the circumstances.
Why People Confuse the Disposal Rule With Regulation N
Regulation N is a separate federal rule. It addresses deceptive claims and other prohibited practices in mortgage advertising and marketing. The Consumer Financial Protection Bureau (CFPB) identifies its Regulation N as the Mortgage Acts and Practices—Advertising Rule, found at 12 C.F.R. Part 1014. The FTC’s parallel mortgage advertising rule is in 16 C.F.R. Part 321.
The distinction matters because the rules have different purposes and apply to different conduct. A mortgage advertisement that misrepresents loan terms raises Regulation N issues. Leaving consumer report information exposed during disposal raises issues under the Disposal Rule. A company may need to comply with both, but one does not replace the other.
| Rule | Main subject | Primary citation |
|---|---|---|
| Consumer Information Disposal Rule | Secure disposal of certain consumer report information and records | 16 C.F.R. Part 682 |
| Regulation N | Mortgage advertising and marketing practices | 12 C.F.R. Part 1014 |
| FTC Mortgage Acts and Practices Rule | Mortgage advertising practices under the FTC’s jurisdiction | 16 C.F.R. Part 321 |
Who Must Follow the Disposal Rule?
The rule applies to a person or business that maintains or otherwise possesses consumer information, or information derived from a consumer report, for a business purpose. It is not limited to banks or credit bureaus. Covered organizations can include lenders, landlords, employers, insurers, retailers, debt collectors, and other businesses that obtain or use consumer reports.
Coverage depends on the information and how it was obtained or used, not simply on an organization’s industry label. For example, an employer that obtains background information from a consumer reporting agency may have records subject to the rule. A company that never obtains or uses consumer report information may not be covered by Part 682 for its ordinary records, though other privacy, security, or state laws could still apply.
The rule also covers individuals who possess such information for a business purpose. It does not generally impose the same requirements on a person disposing of personal records solely for private, nonbusiness reasons. When the facts are unclear, organizations should review the source and purpose of the records rather than assume all personal information is covered—or that none of it is.
What Information Is Covered?
“Consumer information” under the rule includes information about an individual that is a consumer report or is derived from a consumer report. A consumer report is generally a communication from a consumer reporting agency bearing on a person’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living, when used or expected to be used for an eligible purpose.
Examples may include a credit report, a tenant-screening report, or an employment background report obtained from a consumer reporting agency. Information copied from such a report can remain covered even when it is placed in a different document or system. Simply removing a person’s name may not make a record safe to discard if other details still identify the individual.
The Disposal Rule is not a comprehensive federal data-privacy law for every kind of personal information. Its scope is tied to consumer report information. However, other requirements may govern records that fall outside Part 682, including the Gramm-Leach-Bliley Act safeguards and disposal provisions for certain financial institutions, the Fair Credit Reporting Act, state privacy and breach-notification laws, and contractual obligations.
What Does Secure Disposal Require?
The rule calls for reasonable measures to protect against unauthorized access to or use of information in connection with its disposal. It does not prescribe one mandatory technology or require every business to use a particular shredder, software product, or retention schedule. The approach should be appropriate to the sensitivity and format of the records and the organization’s operations.
The FTC’s examples of reasonable measures include practices such as:
- Burning, pulverizing, or shredding paper records so that consumer information cannot practicably be read or reconstructed.
- Destroying or erasing electronic media so that the information cannot practicably be read or reconstructed.
- Hiring a qualified disposal provider and taking reasonable steps to confirm that the provider uses appropriate disposal procedures.
- Conducting due diligence on a disposal provider, such as reviewing its experience and references, checking relevant certifications, or requiring appropriate contractual protections.
These are examples, not a complete checklist that automatically guarantees compliance. A disposal method that works for one record type may be inadequate for another. For instance, deleting a file from a computer’s visible folder may not permanently remove it from a drive or backup system. Likewise, tearing paper into a few pieces may leave names, account numbers, or other identifying details readable.
Using a Disposal Vendor
Organizations may use outside vendors to shred paper, destroy drives, or manage electronic data. Outsourcing the task does not remove the organization’s responsibility to take reasonable measures. Businesses should assess a vendor before engaging it, set expectations in writing, and maintain a process for confirming that disposal is completed as agreed.
Useful safeguards can include checking the provider’s qualifications and security practices, limiting access to records before destruction, specifying approved disposal methods, requiring prompt reporting of incidents, and documenting completion. The depth of due diligence should be proportionate to the sensitivity and volume of the information and the risks associated with the service.
A contract can support compliance, but a contract alone is not proof that records were securely destroyed. Organizations should consider whether the vendor’s actual practices match the agreement and whether the vendor uses subcontractors or transports materials through additional locations.
Practical Steps for Building a Disposal Program
A written program can help make disposal consistent across departments and locations. The following steps provide a practical starting point:
- Identify covered records. Determine where consumer reports and information derived from them are collected, stored, copied, and shared.
- Set retention and disposal triggers. Define when records should be destroyed, taking account of legal retention duties, business needs, litigation holds, and applicable contracts.
- Choose methods by format. Specify secure procedures for paper, computers, removable drives, mobile devices, cloud systems, and backup media.
- Limit access before disposal. Keep records in controlled areas or systems until destruction, and restrict access to people with a business need.
- Train employees. Explain how to recognize covered information, use approved bins or systems, and report suspected loss or improper disposal.
- Review vendors and document controls. Preserve records of due diligence, contracts, destruction certificates, and periodic checks where appropriate.
- Reassess the program. Update procedures when technology, vendors, business operations, or applicable legal requirements change.
Retention and disposal should be coordinated. Destroying records too soon can conflict with legal or operational obligations, while keeping them indefinitely increases exposure. A documented schedule should account for both needs and be reviewed by appropriate legal, privacy, and information-security personnel.
Common Compliance Mistakes
Assuming only paper needs to be destroyed
Electronic files, email attachments, portable drives, old computers, and other storage media can contain consumer report information. A program focused only on paper may leave important data exposed.
Treating ordinary deletion as secure erasure
Moving a file to a recycle bin or deleting it from a user account may not make the underlying data unrecoverable. The organization should use a method suited to the device and its intended reuse or disposal.
Believing a vendor takes over all responsibility
A third-party provider can perform destruction, but the business should still use reasonable due diligence and oversee the arrangement. The rule expressly recognizes vendor relationships without making outsourcing a blanket exemption.
Confusing the rule with Regulation N
Regulation N is about mortgage advertising, not disposal of credit reports or background information. Searching for “Regulation N consumer information disposal” can therefore lead to the wrong compliance materials. The relevant federal citation for the Disposal Rule is 16 C.F.R. Part 682.
Enforcement and Related Legal Duties
The Disposal Rule is administered by the FTC. A failure to use reasonable disposal measures can create regulatory risk and may also contribute to consumer harm, contractual disputes, or exposure under other applicable laws. The precise consequences depend on the facts, the organization, and the laws governing its activities.
Organizations should not treat Part 682 as their only information-security obligation. The Gramm-Leach-Bliley Act, for example, imposes separate safeguards and disposal requirements on covered financial institutions. State laws may impose additional duties for personal information, and sector-specific rules may apply to healthcare, education, or government records. Requirements can overlap, so a single disposal process may need to satisfy several standards.
For authoritative guidance, consult the FTC’s Disposal of Consumer Report Information and Records materials, the text of 16 C.F.R. Part 682, and the CFPB’s Regulation N provisions when mortgage advertising is involved. Organizations with complex records or overlapping legal duties should obtain advice tailored to their operations.