How Do You Securely Destroy Old Business Records?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

Destroy old records so no one can read them or piece them back together. Shred, burn, or pulverize paper. Wipe or physically destroy computers, phones, and drives, because normal deleting can leave files recoverable. Keep a simple log of what you destroyed, when, and how, and never destroy anything on legal hold.

What this means

The Federal Trade Commission (FTC) has a Disposal Rule for anyone who uses consumer reports, like credit or background checks, for a business purpose. That includes small businesses that run checks on job applicants, tenants, or contractors. The FTC says covered businesses must take reasonable steps to dispose of that information. Its examples:

Paper: burn, pulverize, or shred it so it can’t be read or rebuilt.
Electronic: destroy or erase files and media so they can’t be read or rebuilt.
Outside company: hire a document destruction company after checking it out, for example by reviewing references, an independent audit, or trade group certification.

Even if the Disposal Rule doesn’t cover you, the FTC’s general guide for protecting personal information gives the same advice for all businesses. It also says to use wipe tools on old computers and storage devices, and to make sure remote workers follow the same steps. Many states have their own disposal laws, too.

Made-up example: Sunrise Property Care keeps a locked shred bin in the office. A shredding company empties it every month and leaves a certificate. When the owner replaced two laptops, she used the built-in reset with full erase, then took the old drives to a recycler that gave a destruction receipt. Both go in the log.

Why it matters

Identity theft. Tossed records with Social Security numbers or bank details are a gift to thieves.
Legal duties. Federal and state rules can require proper disposal.
Breach costs. A leak can mean notices, investigations, and lost trust (see 11.9.4 Data Breach Response).
Proof you followed your schedule. A log shows you destroyed records on purpose, on time, and not to hide anything.

Who this applies to

Every business that holds personal or financial information about customers, employees, or vendors. The FTC Disposal Rule applies to anyone who uses consumer reports for a business purpose. Health care, finance, and other regulated businesses may have stricter rules. Check your state’s disposal law through your state attorney general’s website.

How to do it

Check the schedule. Once a year, pull records past their “keep until” date (see 9.8.2 Record Retention Periods).
Check for legal holds before destroying anything (see 9.8.6 Legal Hold).
Shred paper. Use a cross-cut shredder or a shredding company. Keep a locked bin for papers waiting to be shredded.
Delete digital records from the cloud drive, then empty the trash or recycle bin so they’re gone for good.
Wipe devices before they leave. Use the device’s full erase or a wipe tool. For drives you can’t wipe, physically destroy them or use a recycler that gives a receipt.
Don’t forget copiers and printers. Many store images of what they scanned or printed. Ask the vendor how to clear them before you return a lease.
Vet any shredding company. Ask for references, certifications, and a certificate of destruction for each pickup.
Cover remote workers. Give them a shredder or a way to send papers in.
Log it. Date, record type, date range, method, and who did it.

What proof to keep

The destruction log
Certificates of destruction from vendors
Receipts from device recyclers
Your written disposal steps

Common mistakes

Throwing paper in the regular trash or recycling.
Deleting files but not emptying the trash.
Selling or donating a laptop without wiping it.
Forgetting the copier. Its storage can hold years of scans.
Using a strip-cut shredder for sensitive papers. Strips can be taped back together.
Destroying records under legal hold. That can bring serious penalties in a lawsuit.
No log. Without one, you can’t show you followed your schedule.

When to get help from a pro

IT specialist: for wiping servers, drives, or many devices. Attorney: if you’re in a regulated industry or unsure about a legal hold. Questions to ask:

Does my state have a disposal law that applies to my records?
Is my device wiping method good enough for the data I hold?
What should a shredding company contract include?

Bill’s note

[Bill: add a short lesson. For example, an old laptop or phone you found still had client data on it, or how you handle disposal for SiteSmarty.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: how SiteSmarty shreds paper and wipes old devices]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: the destruction log or a certificate of destruction]
[Result so far:]

Questions people ask

Is deleting a file enough? No. The FTC notes that deleted files can often be recovered. Empty the trash and wipe devices before they leave your hands.

Do I have to shred customer and employee records? If you use consumer reports, the FTC Disposal Rule requires reasonable disposal. Many state laws cover other personal data. Shredding is the safe habit for all of it.

How do I choose a shredding company? Check references and certifications, review its security practices, and ask for a certificate of destruction for each pickup.

What do I do with old phones and laptops? Use the full erase or a wipe tool, then recycle with a company that gives a receipt. Physically destroy drives you can’t wipe.

Should I keep a destruction log? Yes. It shows you followed your retention schedule.

Audit check

Question: Are expired records and old devices destroyed so the data can’t be recovered, with a log for each batch?
Pass looks like: Written disposal steps. Cross-cut shredding or a vetted vendor. Devices wiped or destroyed. Legal holds checked first. A dated log and vendor certificates.
Fail looks like: Records in regular trash. Old laptops sold or donated unwiped. No log. Records destroyed while a dispute was pending.
Evidence to collect: Destruction log, vendor certificates, recycler receipts, and the written disposal steps.

Where this fits

Do this first: 9.8.2 Record Retention Periods, 9.8.3 Record Storage and Access

Do this next: 9.8.6 Legal Hold

Sources

FTC, "Disposing of Consumer Report Information? Rule Tells How" (checked October 17, 2026)
FTC, "Disposal of Consumer Report Information and Records" (16 CFR Part 682) (checked October 17, 2026)
FTC, "Protecting Personal Information: A Guide for Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.