FACTA Compliance Document Shredding NJ
Reviewed October 8, 2026. For a New Jersey employer reviewing applicant screening reports or a landlord handling tenant credit reports, secure disposal is more than putting papers through a shredder. The FTC’s Disposal Rule addresses consumer-report information, and its contractor example includes due diligence, a contract, and monitoring compliance. A destruction certificate can help document a job; it does not automatically establish compliance with every requirement.
This guide explains the federal rule’s scope and practical questions to ask before arranging document destruction. It is general information, not legal advice or a promise that one service satisfies all of your organization’s obligations.
What information does the FACTA Disposal Rule cover?
The Fair and Accurate Credit Transactions Act directed adoption of disposal rules for consumer-report information. The FTC’s business guidance says its rule applies to businesses and individuals using consumer reports for a business purpose. Both large and small organizations can be covered. Section 682.2 limits this FTC rule to persons within the Commission’s jurisdiction; regulated organizations should confirm which agency’s rules apply.
Under 16 CFR 682.1, consumer information includes records about an individual, in paper, electronic, or other form, that are a consumer report or are derived from one. The definition excludes information that does not identify individuals, such as aggregate information or blind data.
- Employers: applicant or employee background reports obtained from consumer reporting companies can be covered.
- Landlords and property managers: tenant credit reports and screening reports can be covered.
- Other users: lenders, insurers, and others using consumer reports should assess their records and applicable regulator’s requirements.
Not every financial document, medical record, or internal personnel note is a consumer report merely because it contains sensitive information. Other laws and security duties may still apply. Identify the record’s source and use instead of assuming that FACTA covers every document your business holds.
Retention and legal holds come before disposal
The Disposal Rule is not a retention schedule. Section 682.4 says it neither creates a recordkeeping or destruction requirement not imposed under other law nor changes other legal requirements to retain or destroy a record.
Before authorizing destruction, check the applicable retention requirements, your approved schedule, pending requests, and any litigation or investigation hold with the responsible records owner or adviser. Separate approved material from records that must remain available. Our New Jersey customer-record retention and destruction guide explains why retention review and secure end-of-life handling are separate decisions.
What counts as reasonable disposal?
Section 682.3 requires reasonable measures to protect against unauthorized access to or use of consumer information during disposal. Its examples are illustrative, not an exclusive checklist. For paper, examples include policies and procedures for burning, pulverizing, or shredding so information cannot practicably be read or reconstructed. For electronic media, examples include destruction or erasure achieving that outcome.
The FTC describes a flexible standard informed by information sensitivity, the costs and benefits of disposal methods, and changes in technology. The rule does not prescribe one universal paper-shred size. For electronic records, do not assume paper shredding also addresses copies on laptops, shared drives, scanning systems, or backups; assess those separately with your IT and records teams.
Questions to ask a document-destruction contractor
The rule’s contractor example calls for due diligence before entering into a contract and monitoring compliance afterward. The following questions translate that example into a practical vendor review; they are not a claim that every listed document is legally mandatory.
| Review area | Ask the provider | Keep in your file |
|---|---|---|
| Independent evidence | Can we review a relevant independent audit, current third-party certification, or references? | The evidence reviewed, its scope and date, and your assessment. |
| Security procedures | How are records protected during collection, transport, storage, and destruction? | Relevant written procedures and agreed handling terms. |
| Contract scope | Does the agreement identify the material as consumer-report information and specify its disposal? | The signed scope, responsibilities, and permitted handling arrangements. |
| Ongoing oversight | How will completion, exceptions, or changes to the agreed process be reported? | Service records, exception follow-up, and periodic review notes. |
The FTC lists audits, references, recognized trade-association certification, and security-policy review as possible due-diligence measures. It does not say every contractor must hold one named certification. Verify any certification’s current status and service scope rather than treating a logo as sufficient evidence.
Ask who handles the records and when responsibility transfers. Our chain-of-custody guide provides additional questions about the handoff and destruction record. Confirm the actual arrangements for your job in writing.
Build a disposal file, not just a certificate folder
A useful internal file connects the reason records were approved for destruction with the service performed. Consider keeping the authorization, record categories, vendor-review evidence, contract, collection or service record, completion documentation, and any exception resolution. Avoid unnecessarily reproducing personal information in logs.
If a certificate is provided, check that its date, material description, and service details match the job you authorized. Ask for corrections where needed. A certificate documents the reported destruction; it does not replace retention decisions, vendor due diligence, or monitoring the agreement.
Frequently asked questions
Is this a new New Jersey law?
No. This page explains the FTC’s federal Disposal Rule, effective June 1, 2005. The October 2026 review date is not a new enactment date. Separate New Jersey laws may also apply to your records.
Must every business hire a shredding company?
The FTC rule does not universally require outsourcing. Its examples include internal disposal policies and a contractor approach. The chosen measures must be reasonable for the covered information and circumstances.
Can a shredding provider choose our retention period?
Your organization should determine when records are eligible for disposal with its records owner and appropriate advisers. A service schedule does not override a retention requirement or legal hold.
Request a quote for your approved records
Compare New Jersey paper-shredding service options, then request a quote with your location, approximate paper volume, preferred service arrangement, and documentation needs. Ask the team to confirm available handling procedures and service terms before committing. Keep the compliance decision with your organization, supported by primary guidance and documented vendor review.
