Updated November 2026 · Southern New Hampshire
Records destruction policy: how to write one for your NH company
A plain-English template for the records destruction policy that decides when your company’s records are destroyed, who signs off, what stops the shredder during a lawsuit, and what proof you keep. Use the sections below as a starting draft, then have your attorney review the final version.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- Certificate on every job
Quick answer
A records destruction policy is a written company rule that says which records are destroyed, when their retention period ends, who must approve the destruction, how legal holds pause it, which method is used and what proof is kept. A workable version for a small New Hampshire company fits on four to six pages: purpose and scope, roles, a link to your retention schedule, a legal hold procedure, an approval form, approved methods and vendors, and a destruction log with certificates. New Hampshire Document Shredding issues a Certificate of Destruction on every job at 99 cents per pound, plus $34.90 in per-job fees, which gives the log its proof. Pair the policy with our document retention guide for the keep-or-shred periods.
Why a records destruction policy protects your company
Most small companies destroy records the way they clean a garage. Someone gets fed up, fills a dumpster and hopes nothing important went with it. That works until a former employee files a complaint, a customer’s data turns up in a recycling bin, or a lawyer asks why a file vanished the month after a demand letter arrived.
A written records destruction policy turns that habit into a routine. It shows that you destroy records on a schedule, for ordinary business reasons, with someone accountable. Courts, regulators and auditors look for exactly that pattern when they decide whether a missing document was housekeeping or something worse.
Several federal rules expect a written process
The FTC Disposal Rule, 16 CFR 682.3, applies to any business that keeps consumer report information, such as background checks or credit reports on applicants and tenants. Its first example of a reasonable disposal measure is to implement and monitor policies and procedures “that require the burning, pulverizing, or shredding of papers containing consumer information.”
HIPAA covered entities have a parallel duty. Under 45 CFR 164.530(i), a practice must adopt written policies and procedures designed to comply with the Privacy Rule, and paragraph (j) says to keep that documentation for six years from creation or last effective date.
The bigger risk is destroying the wrong thing
Shredding too late is a privacy problem. Shredding at the wrong moment can be a legal one. Federal law at 18 U.S.C. 1519, added by the Sarbanes-Oxley Act in 2002, makes it a crime to knowingly destroy a record with intent to obstruct a federal investigation or bankruptcy case, including one that is only contemplated, with up to 20 years in prison.
A small company is unlikely to face that statute. The lesson still applies at every size: your policy needs a switch that stops destruction the moment trouble appears. That switch is the legal hold, covered below.
The good news is that none of this calls for a compliance department. A records destruction policy for a 10-person office, a dental practice or a property management company can be written in an afternoon and run with a shared spreadsheet and a locked closet. Our FACTA disposal rule guide and our post on HIPAA shredding requirements go deeper on the two federal rules most NH offices meet first.
The sections of a records destruction policy template
Every good policy answers the same questions in the same order. Use these headings as your skeleton. Keep each section short, written in the words your staff actually use, and name a person or job title wherever the policy says “someone.”
1. Purpose and scope
Two sentences on why the policy exists and what it covers: paper, email, scanned files, backups, laptops, phones and removable media. Say that it applies to every employee and contractor.
2. Roles
Name the records owner for each department, the person who approves destruction, the person who issues and lifts legal holds, and the person who keeps the destruction log.
3. Retention schedule
Refer to a separate schedule listing each record type and how long you keep it. Keep the periods out of the policy text so you can update the schedule without rewriting the policy.
4. Legal holds
Say what triggers a hold, who issues it, how staff are told, and that a hold overrides the schedule until the person in charge releases it in writing.
5. Approval
Require a signed authorization before any batch of records is destroyed. List what the form must show: record type, date range, volume, retention basis and a hold check.
6. Methods
Name the approved methods for each format. Paper is cross-cut shredded. Drives and media are physically destroyed. Ordinary recycling bins are never a destruction method for confidential paper.
7. Vendors and custody
Say which outside vendors may destroy records, what you check before hiring one, and how boxes are stored and handed over until they leave your control.
8. Proof, training and review
Keep a destruction log and every certificate. Train new hires and give a refresher each year. Review the whole policy once a year and after any change in law or business.
The table below turns those headings into draft wording you can adapt. Replace the bracketed parts with your own names and periods. It is a starting point, not legal advice, so have your attorney read the final version, especially the legal hold section.
| Section | Sample wording to adapt | Owner |
|---|---|---|
| Purpose | [Company] keeps records only as long as the law and our business require, then destroys them securely and on schedule. | Owner or president |
| Scope | This policy covers all records in any format, including paper, email, electronic files, backups and the devices that store them, held by employees, contractors or vendors for [Company]. | Records coordinator |
| Retention | Each record is kept for the period in the attached retention schedule. When the period ends and no legal hold applies, the record is destroyed within [90] days. | Department heads |
| Legal hold | When litigation, an audit or a government inquiry is reasonably anticipated, [title] issues a written hold. No record covered by a hold may be destroyed until [title] releases it in writing. | Owner or outside counsel |
| Approval | No batch of records is destroyed without a signed Destruction Authorization from the department head and [title]. | Department head plus approver |
| Method | Paper with personal, financial, health or business information is cross-cut shredded. Electronic media is physically destroyed. Records are never placed in open recycling or trash. | Records coordinator |
| Vendors | Outside destruction vendors are approved by [title] after due diligence and must provide a Certificate of Destruction for each job. | Office manager |
| Documentation | The records coordinator keeps a destruction log and every certificate for [six] years. | Records coordinator |
| Review | This policy is reviewed every [January] and after any change in law, ownership or systems. | Owner |
Keep it boring on purpose. A policy staff can follow beats a perfect one nobody reads. If your draft runs past six pages, move the detail into the retention schedule and the forms, and keep the policy itself to rules and roles.
Tie the policy to a retention schedule
The policy says how destruction happens. The retention schedule says when. Keep them as two documents that point at each other, because the schedule changes far more often. A new software system, a new type of contract or a new state rule should not force you to re-approve the whole policy.
A schedule is a table with one row per record type: what it is, who owns it, how long you keep it, what starts the clock and the source of the rule. The “what starts the clock” column is the one most templates forget. Personnel files run from the termination date, tax records from the filing date, and contracts from the date they end.
| Record type | Common minimum | Clock starts | Where the rule lives |
|---|---|---|---|
| Income tax returns and supporting records | 3 years (6 if income was underreported by more than 25 percent, 7 for bad debt or worthless securities) | Date the return was filed | IRS, “How long should I keep records” |
| Employment tax records | At least 4 years | Date the tax was due or paid, whichever is later | IRS, same page |
| Payroll records | At least 3 years | Last date of entry | Fair Labor Standards Act rule, 29 CFR 516.5 |
| Personnel and hiring records | 1 year | Date the record was made or the personnel action, whichever is later. For a terminated employee, the termination date | EEOC rule, 29 CFR 1602.14 |
| Form I-9 | 3 years after hire or 1 year after employment ends, whichever is later | Hire date and end date | USCIS Handbook for Employers, M-274 |
| HIPAA policies, notices and agreements | 6 years | Date created or last in effect, whichever is later | 45 CFR 164.530(j)(2) |
These are federal floors for common business records. Your industry, your contracts, your insurer and your licensing board may require longer, and a charge or lawsuit suspends all of them. The EEOC rule says it plainly: once a discrimination charge is filed, the employer must keep all relevant personnel records until final disposition of the charge or the action.
For the full department-by-department table, start from our record retention schedule template. If tax paper makes up most of your boxes, our post on how long to keep tax records covers the IRS periods row by row.
Legal holds: when the records destruction policy must stop
A legal hold is an instruction to preserve specific records because a lawsuit, audit or investigation is coming or underway. It overrides the retention schedule. A box that was due for the shredder on Friday stays on the shelf until the hold is lifted in writing, even if that takes three years.
The trigger comes early. Federal Rule of Civil Procedure 37(e) lets a court act when electronically stored information “that should have been preserved in the anticipation or conduct of litigation” is lost because a party “failed to take reasonable steps to preserve it.” If the court finds intent to deprive the other side, it may presume the lost information was unfavorable, instruct the jury to do the same, or dismiss the case or enter a default judgment.
Anticipation is the key word. A demand letter, a threat from an angry former employee, a notice of an agency inquiry or an insurance claim you expect to be contested can each start the duty. Your policy should list examples like these so staff recognize a trigger and call the person in charge the same day.
- Recognize the triggerAnyone who receives a demand letter, subpoena, agency notice, complaint or credible threat of a claim tells the hold owner the same day. When in doubt, report it.
- Issue the hold in writingThe hold owner sends a short notice naming the matter, the record types, the date range and the people who hold them, with a plain instruction not to destroy, alter or move anything covered.
- Suspend scheduled destructionPull covered boxes from the shred staging area, tag them “HOLD” with the matter name and pause any automatic email or file deletion for the affected accounts.
- Confirm and trackEach recipient replies to confirm. The hold owner keeps a hold register with the matter, date issued, custodians and records covered.
- Release in writingWhen counsel says the matter is closed, the hold owner sends a written release. Only then do the records go back on the normal schedule.
Keep the hold register forever, or at least as long as your longest retention period. It is your evidence that the company stopped destruction when it should have. We cannot advise you on when a duty to preserve starts in a particular dispute. That is a question for your attorney, and it is worth a phone call before you book any large purge during a dispute.
Approvals and sign-off
Approval is what separates a policy from a suggestion. The rule is simple: no batch of records is destroyed without a signed Destruction Authorization. One signature comes from the person who owns the records. A second comes from the approver named in the policy, usually the owner, the controller or the office manager.
Two signatures sound like overhead. In practice it takes two minutes and catches the common mistakes, such as a department head who does not know about a pending claim or a new hire who boxed up the wrong year.
The form itself is one page. Store the signed copy in the destruction log next to the certificate from the shredding job, so anyone can match what was approved with what was destroyed.
What the Destruction Authorization should show
- Department and records owner.
- Record type and the retention schedule row it falls under.
- Date range of the records, for example “vendor invoices, January to December 2019”.
- Number of boxes or approximate pounds, plus any media in a separate bag.
- A checkbox confirming the hold register was checked on the signing date.
- Approved method and vendor, and whether the job is drop-off, pickup or witnessed.
- Both signatures and dates, then the certificate number added after the job.
Some records deserve a higher level of sign-off. Board minutes, corporate formation papers, deeds, pension plan documents and anything tied to an open claim should need the owner’s signature, or should simply be marked “permanent” in the schedule. Our list of questions to ask a shredding company is a useful attachment for whoever approves new vendors.
Destruction methods and what they cost
Your policy should name approved methods by format rather than by brand. For paper, cross-cut shredding meets the plain wording of the FTC Disposal Rule and the HIPAA disposal guidance, which both point to shredding so information cannot practicably be read or reconstructed. For drives, tapes, USB sticks and phones, physical destruction is the clean answer, quoted per item.
Name the office shredder too, but limit it. A strip-cut machine by the copier is fine for a few sheets of misprints. It is not a method for three years of payroll, and strip-cut is not what you want for confidential paper. Our page on paper shredding security levels explains the difference.
| Option | Price | Fits the policy when |
|---|---|---|
| Drop-off at our Tewksbury office | 99¢ per lb under 10 boxes, $15 small or $20 banker’s box at 10+ boxes, plus $34.90 per job | Routine quarterly or annual batches from a company near the state line. Walk in Monday to Friday, 10 a.m. to 5 p.m. |
| Off-site pickup | Same shredding rates plus $129.95 (Zone 1), $159.95 (Zone 2) or $199.95 (Zone 3), plus $34.90 per job | Large annual purges, or when the policy says boxes must not leave in an employee’s car. Shredded at the Tewksbury office after pickup |
| Witnessed session | $1.99 per lb, $100 minimum, plus $34.90 per job | Records your policy marks as highly sensitive, or when an owner or auditor must watch and sign |
| Drives and media | Quoted per item | Retired laptops, backup tapes and phones listed on the same authorization |
Read the chart from left to right and the policy lesson is clear. The per-job fees are fixed, so one well-planned annual job costs less than a dozen scattered ones. A single box dropped off costs $64.60. Twenty boxes cost $434.90 at drop-off, or $564.85 with a Zone 1 pickup from a border town such as Salem, Pelham, Windham or Plaistow.
Write that rhythm into the policy: a standing destruction date once or twice a year, with small batches held in a locked bin until then. Our shredding rates page lists every price, and our guide to hard drive destruction covers the devices row of the form.
Certificates and the destruction log
Proof is the part of a records destruction policy that pays for itself. If anyone ever asks what happened to a file, you want to open one binder and point to three documents: the signed authorization, the certificate and the log entry. Without them, you are relying on someone’s memory of a day years ago.
The destruction log
A simple spreadsheet with one row per job: date, department, record types, date ranges, boxes or pounds, method, vendor, authorization reference and certificate number. Never delete rows.
The certificate
Every New Hampshire Document Shredding job includes a Certificate of Destruction, covered by the $14.95 HIPAA filing fee inside the $34.90 per-job fees. File it with the matching authorization.
How long to keep proof
Set a period in the policy and stick to it. Six years matches the HIPAA documentation rule for covered entities and is a sensible default for everyone else. Keep logs tied to a legal hold longer.
Chain of custody matters as much as the certificate. Your policy should say where boxes wait before destruction, who holds the key and how they are handed over. A taped box in a locked closet is good. An open box in a hallway with “SHRED” written on it is an invitation. Our post on chain of custody shredding follows a box from your office to the bale.
For what the document itself should show, see our guide to the certificate of destruction. If your auditor wants to see destruction happen rather than read about it, book witnessed shredding and the certificate is signed in front of you at the Tewksbury office.
Rolling out the policy in a small NH company
A policy only works once people use it. For a company of 5 to 50 people, rollout is a one-month project. You do not need software. You need a draft, a meeting, a locked bin and a date on the calendar.
- Inventory what you haveWalk the office, the basement and the storage unit. List record types, rough box counts and the oldest year in each pile. This becomes the first draft of your retention schedule.
- Draft the policy and scheduleUse the sections above. Fill in names and periods, mark permanent records, and send it to your attorney and accountant for a read.
- Approve and announceHave the owner sign the policy. Walk staff through it in a 20-minute meeting, with extra time on the legal hold triggers and the “no recycling bins for confidential paper” rule.
- Set up the physical sidePut a locked bin or a lockable closet near the people who produce the most paper. Tape and label boxes before they leave a desk.
- Run the first purgeSign authorizations for everything past its period, check the hold register, and book one drop-off or one pickup for the whole backlog. Log it and file the certificate.
- Calendar the reviewPut the annual review and the next scheduled destruction date on the owner’s calendar before the meeting ends.
Electronic records belong in the same rollout. New Hampshire’s notice of security breach law, RSA 359-C:20, applies to computerized data containing personal information and requires notice to affected people and, for most businesses, the attorney general’s office. Old laptops and backup drives sitting in a closet are exactly the kind of data that law reaches, so put them on the first authorization. Our post on the New Hampshire data breach law covers the notice rules.
Picking the first purge
For three or four boxes from a company near Salem or Pelham, drive them down. Tewksbury is about 15 minutes south of the state line via I-93 or Route 38, staff help you unload, and paper is shredded the same business day. Our drop-off shredding page has the details.
When a pickup fits better
Thirty boxes in a basement call for a pickup, so your staff keep working. Zone 2 covers greater Nashua and Manchester at $159.95, and the zone for other towns is confirmed when you book. The off-site shredding page explains how pickups are scheduled.
After year one, the policy mostly runs itself. A big backlog becomes a predictable annual job, the log grows by a row or two a year, and the question “can we throw this out” has a written answer. Our post on the annual document purge shows how to run that yearly job in an afternoon.
Frequently asked questions
Is a records destruction policy required by law in New Hampshire?
No single New Hampshire statute requires every company to have one. Federal rules push most businesses toward it. The FTC Disposal Rule at 16 CFR 682.3 gives written disposal policies as its first example of reasonable measures, and HIPAA covered entities must keep written privacy policies under 45 CFR 164.530(i). A written policy is also your best evidence that destruction happened in the ordinary course of business.
What is the difference between a retention schedule and a destruction policy?
The retention schedule lists each record type and how long you keep it. The records destruction policy sets the rules around it: who approves destruction, how legal holds pause it, which methods and vendors are allowed, and what proof you keep. Keep them as two linked documents so you can update retention periods without re-approving the whole policy.
What triggers a legal hold?
A legal hold starts when litigation, an audit or a government inquiry is reasonably anticipated, not only when papers are served. Federal Rule of Civil Procedure 37(e) refers to information that should have been preserved “in the anticipation or conduct of litigation.” Demand letters, subpoenas, agency notices and credible threats of a claim are common triggers. Ask your attorney when the duty starts in a specific dispute.
Who should approve records destruction in a small company?
Use two signatures. The person who owns the records confirms the retention period has run. A second approver, usually the owner, controller or office manager, confirms no legal hold applies and signs off. For permanent records such as corporate formation papers, deeds and board minutes, require the owner’s signature or mark them never to be destroyed.
Does a Certificate of Destruction satisfy the policy’s proof requirement?
It covers the vendor’s part. Every New Hampshire Document Shredding job includes a Certificate of Destruction at no charge beyond the $14.95 HIPAA filing fee. Your policy should also require a signed internal authorization and a log entry, so you can show what was approved, what left the office and what was destroyed. File all three together.
How much does a scheduled purge cost?
At our Tewksbury drop-off, one banker’s box costs about $64.60, five boxes about $183.40, 10 boxes $234.90 and 20 boxes $434.90, including the $34.90 per-job fees. Pickups add $129.95, $159.95 or $199.95 by zone. Because the per-job fees are fixed, one planned annual job usually costs less than many small ones. Call (978) 636-0301 for a quote.
Should the policy cover email and computers?
Yes. Write the scope to cover records in any format, including email, shared drives, backups and the devices that store them. New Hampshire’s breach notice law, RSA 359-C:20, applies to computerized personal information. Retired laptops, drives, USB sticks and phones should go on the same authorization form and be physically destroyed. We quote media destruction per item.
How often should we review the policy?
Once a year, plus any time the law, your ownership, your systems or your lines of business change. Put the review on the owner’s calendar alongside the annual destruction date. Update the retention schedule more often if needed, since new record types appear whenever you add software, services or contracts.
Sources
- GovInfo: 16 CFR 682.3, FTC Disposal Rule, proper disposal of consumer information (checked November 2026)
- GovInfo: 45 CFR 164.530, HIPAA administrative requirements, paragraphs (i) and (j) (checked November 2026)
- GovInfo: 29 CFR 1602.14, preservation of employment records (checked November 2026)
- GovInfo: 18 U.S.C. 1519, destruction, alteration or falsification of records (checked November 2026)
- Federal Rules of Civil Procedure, Rule 37(e), failure to preserve electronically stored information (checked November 2026)
- IRS: How long should I keep records? (checked November 2026)
Put your first scheduled purge on the calendar
Sign the authorizations, check the hold register and book one job for the whole backlog. Drop off in Tewksbury, book a pickup by zone or watch it shredded, and file the Certificate of Destruction with your log.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.