Data Disposal Laws

8/27/2021

Overview

Personal identifying information is often collected by businesses and government and is stored in various formats—digital and paper. At least 35 states and Puerto Rico have enacted laws that require either private or governmental entities or both to destroy, dispose of, or otherwise make personal information unreadable or indecipherable.

The Federal Trade Commission's Disposal Rule also requires proper disposal of information in consumer reports and records to protect against “unauthorized access to or use of the information.” The rule applies to consumer reports or information derived from consumer reports. HIPAA also has disposal requirements for protected health information.

PLEASE NOTE: NCSL serves state legislators and their staff. This site provides general comparative information only and should not be relied upon or construed as legal advice.

Data Disposal Laws

State

Applies to Government?

Applies to Businesses?

Statute

Alabama

Yes

Yes

Ala. Code § 8-38-10

Alaska

Yes

Yes

Alaska Stat. § 45.48.500 et seq.

Arizona 1

Yes

Yes

Ariz. Rev. Stat. § 44-7601

Arkansas

Yes

Yes

Ark. Code §§ 4-110-103, -104

California

No

Yes

Cal. Civ. Code §§ 1798.81, 1798.81.5, 1798.84

Colorado

No

Yes

Colo. Rev. Stat. § 6-1-713

Connecticut

No

Yes

Conn. Gen. Stat. § 42-471

Delaware2

No2

Yes

Del. Code tit. 6 § 5001C to -5004C, Del. Code tit. 19 § 736

Florida

No

Yes

Fla. Stat. § 501.171(8)

Georgia

No

Yes

Ga. Code § 10-15-2

Hawaii

Yes

Yes

Haw. Rev. Stat. §§ 487R-1, 487R-2487R-3Haw. Rev. Stat. § 261-17.7(d)Haw. Rev. Stat. § 52D-14(c) 3

Illinois

Yes

Yes

20 ILCS 450/20815 ILCS 530/30815 ILCS 530/40

Indiana

No

Yes

Ind. Code §§ 24-4-14-824-4.9-3-3.5(d)

Kansas

Yes

Yes

Kan. Stat. § 50-6, 139b(2)

Kentucky

No

Yes

Ky. Rev. Stat. § 365.725

Louisiana 

No

Yes

La. R.S. 51:3074(B)

Maryland

Yes Yes Md. Com. Law § 14-3502Md. State Govt. Code § 10-1303

Massachusetts

Yes

Yes

Mass. Gen. Laws Ch. 93I, § 2

Michigan

Yes

Yes

MCL § 445.72a

Montana

No

Yes

Mont. Code Ann. § 30-14-1703

Nebraska

No

Yes

Neb. Rev. Stat. § 87-808(1)

Nevada

No

Yes

Nev. Rev. Stat. § 603A.200

New Jersey

Yes

Yes

N.J. Stat. § 56:8-161, -162

New Mexico

No

Yes

N.M. Stat.§ 57-12C-3

New York

No

Yes

N.Y. Gen. Bus. Law § 399-H

North Carolina

No

Yes

N.C. Gen. Stat. § 75-64

Oregon

Yes

Yes

Ore. Rev. Stat. § 646A.622

Rhode Island

No

Yes

R.I. Gen. Laws § 6-52-2

South Carolina

Yes

Yes

S.C. Code § 37-20-190, S.C. Code 30-2-310

Tennessee

No

Yes

Tenn. Code § 39-14-150(g)

Texas

No

Yes

Tex. Bus. & Com. Code § 72.004, § 521.052

Utah

No

Yes

Utah Code § 13-44-201

Vermont

No

Yes

9 Vt. Stat. § 2445

Virginia

Yes

No

Va. Code § 2.2-2009 (F)

Washington

Yes

Yes

Wash. Rev. Code § 19.215.020

Wisconsin 4

No

Yes

Wisc. Stat. § 134.97

Puerto Rico

 

 

2014 Law #234-2014

1 Applies to paper records only.

 2  Applies to employers, including government.

3  Requires police and airport officials to destroy personal information on lost devices before the device is disposed of by auction.

4  Applies to financial institutions, medical businesses or tax preparation businesses.

Additional Resources