The FTC Disposal Rule’s 16 CFR § 682.3 addresses reasonable measures against unauthorized access to or use of consumer information during disposal. Its listed methods are examples, not an exclusive list. Whether the rule applies depends on the information and the entity’s circumstances.
Say which records the procedure covers
Identify the paper, electronic media, and other record types your organization actually handles. A broad sentence can point to a retention schedule or records inventory, but it should not leave staff guessing which records follow the disposal procedure.
Name the methods and the person responsible
Section 682.3 gives illustrative examples involving shredding, destroying or erasing electronic media, and managing a disposal contractor. A policy should describe the methods your organization has adopted and the role that authorizes or performs them. Do not copy an example as a promise if it does not reflect current practice.
Explain how completion is checked
The regulation’s examples include implementing and monitoring compliance with disposal procedures. Where a contractor is used, the examples discuss due diligence and monitoring a contract. Consider whether your procedure names the records kept, exception handling, and who reviews the disposal work.
Keep retention and disposal distinct
A disposal method does not answer when a record may be destroyed. If your organization also follows the FTC Safeguards Rule, 16 CFR § 314.4(c)(6) addresses secure-disposal procedures and periodic review of data retention. Check applicable retention duties before setting a destruction date.