What does the Disposal Rule require?

• A. Archiving old records indefinitely
• B. Encrypting only electronic records
• C. Sharing records with third parties
• D. Secure disposal of records containing consumer information to prevent unauthorized access or reconstruction

Answer: (D)

Secure disposal of records containing consumer information to prevent unauthorized access or reconstruction is what the Disposal Rule requires. This means you must dispose of both paper and electronic records in ways that make it impossible for someone to access or reconstruct the information later—for example, shredding paper, wiping electronic media, or physically destroying backups. The rule applies to anyone who maintains consumer information and discards records containing it, not just the primary data, and it focuses on disposing of information safely rather than archiving it, encrypting alone, or sharing it with others. This helps protect privacy and reduce the risk of identity theft by ensuring discarded data can’t be retrieved or rebuilt.