Data Disposal Laws

1/4/2019

Overview

Personal identifying information is often collected by businesses and government and is stored in various formats--digital and paper. At least 35 states and Puerto Rico have enacted laws that require either private or governmental entities or both to destroy, dispose, or otherwise make personal information unreadable or undecipherable.

The Federal Trade Commission's Disposal Rule also requires proper disposal of information in consumer reports and records to protect against “unauthorized access to or use of the information.” The rule applies to consumer reports or information derived from consumer reports. HIPAA also has disposal requirements for electronic protected health information.

 

PLEASE NOTE: NCSL serves state legislators and their staff. This site provides general comparative information only and should not be relied upon or construed as legal advice.

Data Disposal Laws

STATE

Applies to Government?

Applies to Businesses?

Statute

Alabama Yes Yes 2018 S.B. 318

 Alaska

Yes

Yes

 Alaska Stat. § 45.48.500 et seq.

 Arizona 1

Yes

Yes

 Ariz. Rev. Stat. § 44-7601

 Arkansas

Yes

Yes

 Ark. Code §§ 4-110-103, -104

 California

No

Yes

 Cal. Civ. Code §§ 1798.81, 1798.81.5, 1798.84

 Colorado

No

Yes

 Colo. Rev. Stat. § 6-1-713

 Connecticut

No

Yes

 Conn. Gen. Stat. § 42-471

 Delaware2

2 Yes  Del. Code tit. 6 § 5001C to -5004C, tit. 19 § 736

 Florida

No Yes  Fla. Stat. § 501.171(8)

 Georgia

No

Yes

 Ga. Code § 10-15-2

 Hawaii

Yes

Yes

 Haw. Rev. Stat. §§ 487R-1, 487R-2, 487R-3
 Haw. Rev. Stat. § 261-17.7(d), Haw. Rev. Stat. § 52D-14(c) -- (2018 S.B. 2738) 3

 Illinois

Yes

Yes

 20 ILCS 450/20, 815 ILCS 530/30, 815 ILCS 530/40

 Indiana

No

Yes

 Ind. Code §§ 24-4-14-8, 24-4.9-3-3.5(c)

 Kansas

Yes

Yes

 Kan. Stat. § 50-7a01
 Kan. Stat. § 50-7a03
 Kan. Stat. § 50-6, 139b(2)

 Kentucky

No

Yes

 Ky. Rev. Stat. § 365.725

 Louisiana
 
No Yes La. R.S. 51:3074(B)

 Massachusetts

Yes

Yes

 Mass. Gen. Laws Ch. 93I, § 2

 Maryland

Yes

Yes

Md. State Govt. Code §§ 10-1303

 Michigan

Yes

Yes

 MCL § 445.72a

 Montana

No

Yes

 Mont. Code Ann. § 30-14-1703

 Nevada

No

Yes

 Nev. Rev. Stat. § 603A.200

 New Jersey

Yes

Yes

 N.J. Stat. § 56:8-161, -162

 New Mexico No Yes  N.M. Stat.§ 57-12C-3

 New York

No

Yes

 N.Y. Gen. Bus. Law § 399-H

 North Carolina

No

Yes

 N.C. Gen. Stat. § 75-64

 Oregon

Yes

Yes

  Ore. Rev. Stat. § 646A.622

 Rhode Island

No

Yes

 R.I. Gen. Laws § 6-52-2

 South Carolina

Yes

Yes

 S.C. Code § 37-20-190, S.C. Code 30-2-310

 Tennessee No Yes  Tenn. Code § 39-14-150(g)

 Texas

No

Yes

 Tex. Bus. & Com. Code § 72.004, § 521.052

 Utah

No

Yes

 Utah Code § 13-44-201

 Vermont

No

Yes

 9 Vt. Stat. § 2445

 Virginia Yes No  Va. Code § 2.2-2009 (F)

 Washington

Yes

Yes

 Wash. Rev. Code § 19.215.020

 Wisconsin 4

No

Yes

 Wisc. Stat. § 134.97

Puerto Rico     2014 Law #234-2014

 

1 Applies to paper records only.

 2  Applies to employers.

Requires police and airport officials to destroy personal information on lost devices before the device is disposed of by auction.

Applies to financial institutions, medical businesses or tax preparation businesses.

Additional Resources