Under disposal requirements, what modification is part of the FACT Act rules?

• A. Add the definition of 'consumer information' to the existing disposal procedures.
• B. Extend data storage indefinitely.
• C. Delete all data after 90 days.
• D. Publicly post disposal policies.

Answer: (D)

Disposal requirements under FACT Act rules emphasize destroying consumer information in a way that makes it unrecoverable. A modification that aligns with this focus is publicly posting disposal policies. Making the disposal policy accessible publicly promotes transparency and accountability, showing consumers and regulators exactly how the organization safeguards sensitive data when it’s discarded. It also reinforces consistent practices across the organization by documenting the procedures everyone follows.

The other options don’t fit the disposal-focused requirement. Simply adding a definition of consumer information isn’t about how disposal is carried out. Extending data storage indefinitely runs contrary to the goal of secure disposal. Setting a fixed 90-day deletion rule isn’t a mandated standard under FACTA disposal requirements.