The FTC’s Disposal Rule applies to anyone who uses a consumer report for a business purpose, including employers that run background checks. Paper must be burned, pulverized or shredded, electronic files destroyed or erased so they cannot be reconstructed, and shredding vendors vetted.
\nThe FTC’s Disposal Rule guidance says any business or individual who uses a consumer report for a business purpose is subject to the Rule, which requires proper disposal to protect against unauthorized access to or use of the information. Those who must comply include employers, landlords, lenders, insurers and service providers that maintain consumer report information for covered organizations.
\nConsumer reports include credit reports and scores and reports with employment background, check writing, insurance claims, tenant or medical history. Reasonable measures include policies to burn, pulverize or shred papers and to destroy or erase electronic files or media so the information cannot be read or reconstructed.
\nBusinesses can hire a document destruction contractor after due diligence, such as reviewing an independent audit of its operations, checking references, requiring certification by a recognized trade association, or evaluating its security policies. The standard is flexible, and the FTC encourages similar measures for any records containing consumers’ personal or financial information. The Rule became effective June 1, 2005.
\nUse this for any organization that obtains consumer reports, including through a background screening vendor. Financial institutions subject to the GLB Safeguards Rule should fold these practices into their Safeguards program.
\nDSE recommends adding background-check reports to the records disposal schedule and requiring certified destruction for paper and media that hold them. Keep reports in a restricted folder or system rather than email, delete digital copies when retention ends, sanitize drives and copiers before disposal, and keep the shredding vendor’s due-diligence file and certificates of destruction.
\nAudit HR and hiring folders, shared drives and email for stray background reports twice a year, confirm destruction certificates match the disposal schedule, and check that retired drives and copier storage were sanitized before leaving the building.
\nFederal Trade Commission — Disposing of Consumer Report Information? Rule Tells How. Reviewed October 18, 2026.
", "content_text": "The FTC’s Disposal Rule applies to anyone who uses a consumer report for a business purpose, including employers that run background checks. Paper must be burned, pulverized or shredded, electronic files destroyed or erased so they cannot be reconstructed, and shredding vendors vetted.\nSource facts\nThe FTC’s Disposal Rule guidance says any business or individual who uses a consumer report for a business purpose is subject to the Rule, which requires proper disposal to protect against unauthorized access to or use of the information. Those who must comply include employers, landlords, lenders, insurers and service providers that maintain consumer report information for covered organizations.\nConsumer reports include credit reports and scores and reports with employment background, check writing, insurance claims, tenant or medical history. Reasonable measures include policies to burn, pulverize or shred papers and to destroy or erase electronic files or media so the information cannot be read or reconstructed.\nBusinesses can hire a document destruction contractor after due diligence, such as reviewing an independent audit of its operations, checking references, requiring certification by a recognized trade association, or evaluating its security policies. The standard is flexible, and the FTC encourages similar measures for any records containing consumers’ personal or financial information. The Rule became effective June 1, 2005.\nApplicability\nUse this for any organization that obtains consumer reports, including through a background screening vendor. Financial institutions subject to the GLB Safeguards Rule should fold these practices into their Safeguards program.\nDSE recommendation\nDSE recommends adding background-check reports to the records disposal schedule and requiring certified destruction for paper and media that hold them. Keep reports in a restricted folder or system rather than email, delete digital copies when retention ends, sanitize drives and copiers before disposal, and keep the shredding vendor’s due-diligence file and certificates of destruction.\nVerification\nAudit HR and hiring folders, shared drives and email for stray background reports twice a year, confirm destruction certificates match the disposal schedule, and check that retired drives and copier storage were sanitized before leaving the building.\nOfficial reference\nFederal Trade Commission — Disposing of Consumer Report Information? Rule Tells How. Reviewed October 18, 2026.", "content_markdown": "The FTC’s Disposal Rule applies to anyone who uses a consumer report for a business purpose, including employers that run background checks. Paper must be burned, pulverized or shredded, electronic files destroyed or erased so they cannot be reconstructed, and shredding vendors vetted.\n\n## Source facts\n\nThe FTC’s [Disposal Rule guidance](https://www.ftc.gov/business-guidance/resources/disposing-consumer-report-information-rule-tells-how) says any business or individual who uses a consumer report for a business purpose is subject to the Rule, which requires proper disposal to protect against unauthorized access to or use of the information. Those who must comply include employers, landlords, lenders, insurers and service providers that maintain consumer report information for covered organizations.\n\nConsumer reports include credit reports and scores and reports with employment background, check writing, insurance claims, tenant or medical history. Reasonable measures include policies to burn, pulverize or shred papers and to destroy or erase electronic files or media so the information cannot be read or reconstructed.\n\nBusinesses can hire a document destruction contractor after due diligence, such as reviewing an independent audit of its operations, checking references, requiring certification by a recognized trade association, or evaluating its security policies. The standard is flexible, and the FTC encourages similar measures for any records containing consumers’ personal or financial information. The Rule became effective June 1, 2005.\n\n## Applicability\n\nUse this for any organization that obtains consumer reports, including through a background screening vendor. Financial institutions subject to the GLB Safeguards Rule should fold these practices into their Safeguards program.\n\n## DSE recommendation\n\nDSE recommends adding background-check reports to the records disposal schedule and requiring certified destruction for paper and media that hold them. Keep reports in a restricted folder or system rather than email, delete digital copies when retention ends, sanitize drives and copiers before disposal, and keep the shredding vendor’s due-diligence file and certificates of destruction.\n\n## Verification\n\nAudit HR and hiring folders, shared drives and email for stray background reports twice a year, confirm destruction certificates match the disposal schedule, and check that retired drives and copier storage were sanitized before leaving the building.\n\n## Official reference\n\n[Federal Trade Commission — Disposing of Consumer Report Information? Rule Tells How](https://www.ftc.gov/business-guidance/resources/disposing-consumer-report-information-rule-tells-how). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/", "url": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Employers that run background checks must dispose of those reports properly under the FTC Disposal Rule", "item": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/#article", "identifier": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/", "url": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/", "headline": "Employers that run background checks must dispose of those reports properly under the FTC Disposal Rule", "description": "The FTC’s Disposal Rule applies to anyone who uses a consumer report for a business purpose, including employers that run background checks. Paper must…", "abstract": "The FTC’s Disposal Rule applies to anyone who uses a consumer report for a business purpose, including employers that run background checks. Paper must be burned, pulverized or shredded, electronic files destroyed or erased so they cannot be reconstructed, and shredding vendors vetted.", "articleBody": "The FTC’s Disposal Rule applies to anyone who uses a consumer report for a business purpose, including employers that run background checks. Paper must be burned, pulverized or shredded, electronic files destroyed or erased so they cannot be reconstructed, and shredding vendors vetted.\nSource facts\nThe FTC’s Disposal Rule guidance says any business or individual who uses a consumer report for a business purpose is subject to the Rule, which requires proper disposal to protect against unauthorized access to or use of the information. Those who must comply include employers, landlords, lenders, insurers and service providers that maintain consumer report information for covered organizations.\nConsumer reports include credit reports and scores and reports with employment background, check writing, insurance claims, tenant or medical history. Reasonable measures include policies to burn, pulverize or shred papers and to destroy or erase electronic files or media so the information cannot be read or reconstructed.\nBusinesses can hire a document destruction contractor after due diligence, such as reviewing an independent audit of its operations, checking references, requiring certification by a recognized trade association, or evaluating its security policies. The standard is flexible, and the FTC encourages similar measures for any records containing consumers’ personal or financial information. The Rule became effective June 1, 2005.\nApplicability\nUse this for any organization that obtains consumer reports, including through a background screening vendor. Financial institutions subject to the GLB Safeguards Rule should fold these practices into their Safeguards program.\nDSE recommendation\nDSE recommends adding background-check reports to the records disposal schedule and requiring certified destruction for paper and media that hold them. Keep reports in a restricted folder or system rather than email, delete digital copies when retention ends, sanitize drives and copiers before disposal, and keep the shredding vendor’s due-diligence file and certificates of destruction.\nVerification\nAudit HR and hiring folders, shared drives and email for stray background reports twice a year, confirm destruction certificates match the disposal schedule, and check that retired drives and copier storage were sanitized before leaving the building.\nOfficial reference\nFederal Trade Commission — Disposing of Consumer Report Information? Rule Tells How. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:00:59+00:00", "dateModified": "2026-10-18T22:22:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/ftc-disposal-rule-consumer-report-background-check-destruction/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Employers that run background checks must dispose of those reports properly under the FTC Disposal Rule" }, "articleSection": [ "Business Continuity", "Cybersecurity" ], "keywords": [ "Business Continuity", "Cybersecurity", "Checklist", "Advisory priority" ], "genre": "Checklist", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" } ], "wordCount": 353, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Federal Trade Commission — Disposing of Consumer Report Information? Rule Tells How", "url": "https://www.ftc.gov/business-guidance/resources/disposing-consumer-report-information-rule-tells-how" } } ] } }