Employers that run background checks must dispose of those reports properly under the FTC Disposal Rule

The FTC’s Disposal Rule applies to anyone who uses a consumer report for a business purpose, including employers that run background checks. Paper must be burned, pulverized or shredded, electronic files destroyed or erased so they cannot be reconstructed, and shredding vendors vetted.

Source facts

The FTC’s Disposal Rule guidance says any business or individual who uses a consumer report for a business purpose is subject to the Rule, which requires proper disposal to protect against unauthorized access to or use of the information. Those who must comply include employers, landlords, lenders, insurers and service providers that maintain consumer report information for covered organizations.

Consumer reports include credit reports and scores and reports with employment background, check writing, insurance claims, tenant or medical history. Reasonable measures include policies to burn, pulverize or shred papers and to destroy or erase electronic files or media so the information cannot be read or reconstructed.

Businesses can hire a document destruction contractor after due diligence, such as reviewing an independent audit of its operations, checking references, requiring certification by a recognized trade association, or evaluating its security policies. The standard is flexible, and the FTC encourages similar measures for any records containing consumers’ personal or financial information. The Rule became effective June 1, 2005.

Applicability

Use this for any organization that obtains consumer reports, including through a background screening vendor. Financial institutions subject to the GLB Safeguards Rule should fold these practices into their Safeguards program.

DSE recommendation

DSE recommends adding background-check reports to the records disposal schedule and requiring certified destruction for paper and media that hold them. Keep reports in a restricted folder or system rather than email, delete digital copies when retention ends, sanitize drives and copiers before disposal, and keep the shredding vendor’s due-diligence file and certificates of destruction.

Verification

Audit HR and hiring folders, shared drives and email for stray background reports twice a year, confirm destruction certificates match the disposal schedule, and check that retired drives and copier storage were sanitized before leaving the building.

Official reference

Federal Trade Commission — Disposing of Consumer Report Information? Rule Tells How. Reviewed October 18, 2026.