Overview
Personal identifying information is often collected by businesses and government and is stored in various formats--digital and paper. At least 35 states and Puerto Rico have enacted laws that require either private or governmental entities or both to destroy, dispose, or otherwise make personal information unreadable or indecipherable.
The Federal Trade Commission's Disposal Rule also requires proper disposal of information in consumer reports and records to protect against “unauthorized access to or use of the information.” The rule applies to consumer reports or information derived from consumer reports. HIPAA also has disposal requirements for electronic protected health information.
PLEASE NOTE: NCSL serves state legislators and their staff. This site provides general comparative information only and should not be relied upon or construed as legal advice.
Data Disposal Laws
|
STATE
|
Applies to Government?
|
Applies to Businesses?
|
Statute
|
| Alabama |
Yes |
Yes |
Ala. Code § 8-38-10 |
|
Alaska
|
Yes
|
Yes
|
Alaska Stat. § 45.48.500 et seq.
|
|
Arizona 1
|
Yes
|
Yes
|
Ariz. Rev. Stat. § 44-7601
|
|
Arkansas
|
Yes
|
Yes
|
Ark. Code §§ 4-110-103, -104
|
|
California
|
No
|
Yes
|
Cal. Civ. Code §§ 1798.81, 1798.81.5, 1798.84
|
|
Colorado
|
No
|
Yes
|
Colo. Rev. Stat. § 6-1-713
|
|
Connecticut
|
No
|
Yes
|
Conn. Gen. Stat. § 42-471
|
|
Delaware2
|
2 |
Yes |
Del. Code tit. 6 § 5001C to -5004C, tit. 19 § 736 |
|
Florida
|
No |
Yes |
Fla. Stat. § 501.171(8) |
|
Georgia
|
No
|
Yes
|
Ga. Code § 10-15-2
|
|
Hawaii
|
Yes
|
Yes
|
Haw. Rev. Stat. §§ 487R-1, 487R-2, 487R-3
Haw. Rev. Stat. § 261-17.7(d), Haw. Rev. Stat. § 52D-14(c) -- (2018 S.B. 2738) 3
|
|
Illinois
|
Yes
|
Yes
|
20 ILCS 450/20, 815 ILCS 530/30, 815 ILCS 530/40
|
|
Indiana
|
No
|
Yes
|
Ind. Code §§ 24-4-14-8, 24-4.9-3-3.5(c)
|
|
Kansas
|
Yes
|
Yes
|
Kan. Stat. § 50-7a01
Kan. Stat. § 50-7a03
Kan. Stat. § 50-6, 139b(2)
|
|
Kentucky
|
No
|
Yes
|
Ky. Rev. Stat. § 365.725
|
Louisiana
|
No |
Yes |
La. R.S. 51:3074(B) |
|
Massachusetts
|
Yes
|
Yes
|
Mass. Gen. Laws Ch. 93I, § 2
|
|
Maryland
|
Yes
|
Yes
|
Md. Com. Law § 14-3502
Md. State Govt. Code §§ 10-1303
|
|
Michigan
|
Yes
|
Yes
|
MCL § 445.72a
|
|
Montana
|
No
|
Yes
|
Mont. Code Ann. § 30-14-1703
|
|
Nevada
|
No
|
Yes
|
Nev. Rev. Stat. § 603A.200
|
|
New Jersey
|
Yes
|
Yes
|
N.J. Stat. § 56:8-161, -162
|
| New Mexico |
No |
Yes |
N.M. Stat.§ 57-12C-3 |
|
New York
|
No
|
Yes
|
N.Y. Gen. Bus. Law § 399-H
|
|
North Carolina
|
No
|
Yes
|
N.C. Gen. Stat. § 75-64
|
|
Oregon
|
Yes
|
Yes
|
Ore. Rev. Stat. § 646A.622
|
|
Rhode Island
|
No
|
Yes
|
R.I. Gen. Laws § 6-52-2
|
|
South Carolina
|
Yes
|
Yes
|
S.C. Code § 37-20-190, S.C. Code 30-2-310
|
| Tennessee |
No |
Yes |
Tenn. Code § 39-14-150(g) |
|
Texas
|
No
|
Yes
|
Tex. Bus. & Com. Code § 72.004, § 521.052
|
|
Utah
|
No
|
Yes
|
Utah Code § 13-44-201
|
|
Vermont
|
No
|
Yes
|
9 Vt. Stat. § 2445
|
| Virginia |
Yes |
No |
Va. Code § 2.2-2009 (F) |
|
Washington
|
Yes
|
Yes
|
Wash. Rev. Code § 19.215.020
|
|
Wisconsin 4
|
No
|
Yes
|
Wisc. Stat. § 134.97
|
| Puerto Rico |
|
|
2014 Law #234-2014 |
1 Applies to paper records only.
2 Applies to employers.
3 Requires police and airport officials to destroy personal information on lost devices before the device is disposed of by auction.
4 Applies to financial institutions, medical businesses or tax preparation businesses.
Additional Resources