Secure document destruction for businesses

Destroy a record only after the longest period that applies has ended and no hold is open. Then destroy it by a method that fits what it contains, and write down what was destroyed, when, how and by whom. This page gives a checklist, the federal disposal rule and two certificate templates.

Checklist before you destroy anything

1. Find the record type in your schedule and note every rule that applies to it.
2. Take the longest period and check that it has ended. Count from the start event, such as the filing date or the last day of employment. The IRS notes that your insurance company or creditors may require you to keep records longer than it does, so check those too.
3. Ask the hold question. Is any audit, claim, charge, investigation or other federal matter pending or contemplated? If so, stop (DS-03, HR-03).
4. If the record is operational, such as a support ticket, SOP, wiki page, CRM history, project file or internal message, review it first. Read what to check before you destroy company records.
5. Get the approval your document retention policy requires.
6. Choose the method, destroy the record, and enter it in the log.

Methods and the FTC Disposal Rule

The Federal Trade Commission (FTC) Disposal Rule says that anyone who maintains or otherwise possesses consumer information for a business purpose must dispose of it properly. That means taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal (16 CFR 682.3).

The rule covers consumer information. It does not cover every record. The FTC’s guidance says it applies to anyone who uses a consumer report for a business purpose, and it names lenders, insurers, employers and landlords among them. Covered information includes consumer reports and information derived from them, such as credit reports and employment background reports (DS-01).

The rule gives examples of reasonable measures. They are illustrative and not exhaustive:

• Burning, pulverizing or shredding paper so the information cannot practicably be read or reconstructed.
• Destroying or erasing electronic media so the information cannot practicably be read or reconstructed.
• After due diligence, hiring a record destruction company and monitoring its compliance. Due diligence could include reviewing an independent audit of the company’s operations, checking references, requiring certification by a trade association or similar third party, or reviewing its information security policies.

The FTC describes the standard as flexible. What counts as reasonable depends on how sensitive the information is, what the methods cost, and how technology changes. This site names no destruction company and ranks none.

Hard drives and other media

Deleting a file does not sanitize the media underneath it. NIST publishes SP 800-88 Rev. 2, Guidelines for Media Sanitization, dated September 2025. It supersedes Rev. 1 and helps organizations and system owners set up a media sanitization program with techniques and controls for sanitization and disposal, based on the sensitivity of their information. Write the method and the standard you followed on the certificate. Our data retention policy guide covers deletion in databases, email and backups.

The destruction log

Keep one log for every destruction, and keep it with the policy owner. Each entry records:

• The date and the place.
• The record type and the schedule row it belongs to.
• The quantity or the container IDs.
• The method.
• Who carried it out, who witnessed it and who approved it.
• That the hold check was done, and by whom.

After a purge of Forms I-9, the worksheet from the I-9 retention calculator shows which forms reached their keep-until date. The log records that they were destroyed.

Certificate of destruction template

A certificate of destruction is good practice. We found no federal rule that requires one. It shows that the retention period had ended, that no hold applied, and how the records were destroyed. Keep each certificate with the log. We found no rule that sets a period for the certificate itself, so give it a row in your schedule. Copy the template and replace each bracketed field.

Certificate of destruction template for a hard drive

For devices, the certificate lists each one. Add the make, model and serial number so the certificate can be matched to the device later.

If the company is closing

Closing a company does not end the retention periods, because they count from events such as a filing date or a termination date. The order is keep, check, then destroy. Keep what the schedule requires, check what is left, and only then destroy.

Some of what is left may be worth more kept.

Next steps

Finish the checklist for each record type, then log what you destroy. If you do not have a schedule yet, the business records guide shows how the federal periods fit together.