The FACT Act disposal requirements include adding which element to the disposal procedures?

• A. Adding the definition of 'consumer information' to existing disposal procedures.
• B. Deleting all retention policies
• C. Publishing reports publicly
• D. Extending storage of data indefinitely

Answer: (A)

Disposal requirements under the FACT Act hinge on clearly identifying what counts as consumer information so that every piece of data that could identify a consumer is safeguarded when no longer needed. By adding the definition of “consumer information” to existing disposal procedures, an organization ensures that all relevant data—any data that can identify a consumer—falls under the proper destruction methods. This makes staff aware of what must be shredded, destroyed, or otherwise disposed of, reducing the risk of leftover sensitive information and potential misuse.

The other options don’t fit because deleting retention policies would weaken data governance, publishing reports publicly would expose sensitive information, and extending storage indefinitely would unnecessarily increase risk and does not align with the protective safeguards required.