New Jersey Customer Records: When Retention Ends, Secure Destruction Begins

New Jersey organizations handling personal information face two related—but different—responsibilities: keep records for as long as a valid legal, operational, or contractual need requires, then dispose of them securely when they are no longer required. The state’s customer-record destruction law addresses the second part. It does not say to shred every customer file immediately, or set one universal retention period for every kind of record.

Sequence matters: identify the records, confirm retention and holds, approve disposition, then choose a secure method and document it.

What New Jersey’s customer-records law requires

New Jersey’s Identity Theft Prevention Act includes a destruction requirement at N.J.S.A. 56:8-162. In general, a business or public entity covered by the section must destroy—or arrange for the destruction of—customer records containing personal information when the records are no longer to be retained. Destruction must make the personal information unreadable, undecipherable, or non-reconstructable through generally available means. The statute identifies shredding, erasing, or otherwise modifying the information as examples of ways to do that.^[1]

The statute is about secure end-of-life handling of covered customer records. It is not a direction to discard records as soon as they become inconvenient, a universal retention schedule, or an endorsement of one particular destruction vendor. A disposal method should fit the information and medium, and the organization remains responsible for deciding when a record is eligible to be destroyed.

Retention and legal holds come before the shred bin

Before a purge, consult the approved retention schedule and rules for that record type and industry. Tax, employment, contract, regulatory, and insurance needs can require different periods; internal policy cannot shorten a legal minimum.

A legal hold, audit, investigation, subpoena, or reasonably anticipated litigation can suspend routine destruction. If a hold may apply, pause disposal and consult counsel or the records lead. The process should flag held records and document when a hold is released and routine disposition resumes.

For New Jersey public records, the State Treasury’s records guidance says an agency must obtain prior written authorization through the state’s records-disposition process before destroying records, regardless of medium.^[2] Public agencies should follow their applicable schedules and approvals; a service provider cannot determine that a government record is eligible for destruction.

A practical retention-to-destruction workflow

Use a repeatable process:

1. Inventory and classify. Identify record series, owners, formats, and whether the records include personal information. Avoid treating a box or cabinet as one category if it contains mixed records.
2. Confirm the clock. Use the applicable retention schedule and identify the triggering event—for example, contract expiration or a defined date. Do not rely on a generic “keep seven years” rule for every file.
3. Screen for holds and exceptions. Check for litigation holds, audits, investigations, regulatory requests, and operational needs. Pause destruction of affected material.
4. Approve and record the disposition. Have the authorized records or compliance owner document what is eligible, the basis, date, and approval.
5. Choose a suitable destruction method. Paper with personal information may be shredded or otherwise rendered unreadable. Electronic records and media require a method suited to the specific storage technology and the organization’s security requirements.
6. Keep evidence of the process. Record the categories and quantities destroyed, date, approving owner, and method. If an outside provider is used, retain the service documentation and confirm what it covers.

Update the schedule to prevent expired records from accumulating. For tax records, see the existing IRS retention guide and current IRS guidance.

Quick comparison: keep, pause, or destroy?

Situation	Appropriate next step	Why
A record is still within its approved retention period	Keep it in the controlled location	A secure destruction duty does not cancel a retention duty.
A legal hold, audit, or investigation may cover it	Pause routine destruction; confirm with counsel or the records owner	A hold can override the ordinary disposal calendar.
The retention period has expired and no hold or other need applies	Obtain approval and arrange secure destruction	N.J.S.A. 56:8-162 addresses covered customer records that are no longer to be retained.
Eligibility is unclear or records are mixed together	Segregate and get a qualified records/legal review	Uncertainty is a reason to pause, not to guess.

Frequently asked questions

Does New Jersey law require every business document to be shredded?

No. N.J.S.A. 56:8-162 addresses covered customer records containing personal information that are no longer to be retained. It does not impose one universal destruction date for every record or require shredding in every case.

Can we destroy a customer file as soon as the customer relationship ends?

Not automatically. Other laws, contracts, internal requirements, or a legal hold may require retention. Determine the applicable schedule first; the destruction provision applies after the record is no longer to be retained.

Does the statute require a commercial shredding service?

The statute permits a covered organization to destroy records or arrange for their destruction and lists shredding as one example. It does not require use of a particular provider. Organizations choosing an outside service should assess whether its process and documentation meet their own requirements.

What if we are not sure whether a hold applies?

Pause destruction of the potentially responsive records and consult counsel or the designated records/compliance owner. Do not use a routine purge to resolve uncertainty.

Put the policy into practice

A clear retention schedule and hold process should come before any destruction appointment. Once records are approved for disposal, organizations can compare secure handling options and request details about collection, destruction methods, and documentation. See the current document-retention policy service page for related service information, or request a quote to discuss a project.

This article is general information, not legal advice. Retention and hold requirements depend on the record, industry, facts, and current law. Consult qualified counsel or your records professional before approving destruction.

Sources

1. New Jersey Division of Consumer Affairs, Identity Theft Prevention Act (PDF), including N.J.S.A. 56:8-162.
2. New Jersey Department of the Treasury, Records Retention, Disposition and Storage.