Updated November 2026 · Southern New Hampshire
FACTA disposal rule: what NH dealers, landlords and employers must do
If your New Hampshire business pulls credit reports, tenant screenings or background checks, a federal rule tells you how to throw them away. Here is what the FACTA disposal rule, 16 CFR Part 682, actually says, who it reaches, and what a simple, defensible disposal routine costs.
99¢ per pound at our Tewksbury drop-off. Certificate of Destruction on every job.
- 99¢ per pound
- Since 2007
- BBB A+ rated
- Certificate on every job
Quick answer
The FACTA disposal rule, 16 CFR Part 682, says anyone who keeps consumer report information for a business purpose must take reasonable measures to protect it when they dispose of it, such as burning, pulverizing or shredding paper so it cannot practicably be read or reconstructed. It has applied since June 1, 2005 to car dealers, landlords, employers, lenders, insurers and even individuals who screen a tenant or a nanny. New Hampshire Document Shredding destroys those files by cross-cut document shredding at 99 cents per pound plus $34.90 per job, with a Certificate of Destruction you can file.
What the FACTA disposal rule actually says
The Fair and Accurate Credit Transactions Act of 2003 added a disposal section to the Fair Credit Reporting Act. That section, now 15 U.S.C. 1681w, told the Federal Trade Commission and the banking agencies to write rules requiring anyone who holds information derived from consumer reports to dispose of it properly. The FTC’s version is 16 CFR Part 682, and it took effect on June 1, 2005.
The rule is short. Five sections, most of them a sentence or two. The core is 682.3(a): anyone who “maintains or otherwise possesses consumer information for a business purpose must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.”
The examples the FTC gives
Section 682.3(b) lists illustrations, not a closed list. Paper should be burned, pulverized or shredded “so that the information cannot practicably be read or reconstructed.” Electronic media should be destroyed or erased to the same standard.
A business can also hire a records destruction company, after due diligence, under a contract covering material “specifically identified as consumer information.” The rule suggests reviewing an audit, checking references, or evaluating the vendor’s security policies.
What “dispose” means
Section 682.1(c) defines disposal two ways. The first is obvious: discarding or abandoning consumer information. The second catches people out: the “sale, donation, or transfer of any medium, including computer equipment,” that stores it.
So the old office PC you donate, the copier you return at lease end and the filing cabinet you sell at a yard sale with folders still in the bottom drawer are all disposals under the rule.
The rule does not set a retention period. Section 682.4 says it does not require anyone to keep or destroy a record that another law does not already address, and it does not change those other laws. FACTA tells you how to throw consumer information away, not when.
Who the FACTA disposal rule reaches in New Hampshire
Scope is in 682.2(b): any person under FTC jurisdiction that “for a business purpose, maintains or otherwise possesses consumer information.” The FTC’s business guide names lenders, insurers, employers, landlords, government agencies, mortgage brokers, automobile dealers, attorneys and private investigators, debt collectors and consumer reporting companies. It also names individuals who pull a credit report on a prospective nanny, contractor or tenant.
Auto dealers
Every financed or leased sale starts with a credit pull. The deal jacket in the back office holds the report, the score and the application.
Landlords
Tenant screening reports cover credit, rental history and sometimes eviction records. A landlord with one duplex in Manchester is covered as much as a property manager with 400 units.
Employers
A background check from a screening company is a consumer report. Copies in personnel files, hiring binders and HR inboxes all count.
Lenders and brokers
Credit unions, mortgage brokers, finance companies and their service providers hold reports, scores and the notes built from them.
Service providers are caught too. Section 682.3(b)(4) covers anyone who holds consumer information because they provide services to a covered business, such as a payroll firm, a screening vendor or a records storage company. They need their own disposal procedures.
Real estate offices often sit at the edge of this. Agents who collect rental applications or credit reports for landlords should treat those files the same way, and our page on real estate office shredding covers the rest of a brokerage’s paper.
What counts as consumer information
Section 682.1(b) defines consumer information as any record about an individual, in paper, electronic or other form, “that is a consumer report or is derived from a consumer report,” plus compilations of those records. The FTC guide adds that this includes credit reports and scores, employment background reports, check writing history, insurance claims, residential or tenant history and medical history from a reporting company.
| Paper in the file | Covered by 16 CFR 682? | Our advice |
|---|---|---|
| Credit report pulled for a car loan, lease or mortgage | Yes, it is a consumer report | Shred when your retention period ends |
| Tenant screening report | Yes | Shred, including reports on applicants you turned down |
| Employment background check from a screening company | Yes | Shred with the hiring file, never in the office recycling |
| Notes, spreadsheets or scores copied from a report | Yes, derived from a consumer report | Treat exactly like the report itself |
| Aggregate data with no names, such as approval rates | No, the rule excludes information that does not identify individuals | Recycle normally |
| Applicant’s own form with SSN and bank details | Not on its own, unless report data is written on it | Shred anyway. The FTC encourages the same care for any personal or financial records |
In practice, nobody sorts a deal jacket page by page. The report, the application and the stipulations travel together, so the whole folder goes in the shred box. That is cheaper than paying someone to decide which sheet is “derived.”
Auto dealers and lenders: the disposal rule plus the Safeguards Rule
Many dealers and lenders answer to two FTC rules at once. Section 682.3(b)(5) says businesses covered by the Gramm-Leach-Bliley Act and the FTC’s Safeguards Rule, 16 CFR Part 314, should fold disposal of consumer information into the security program the Safeguards Rule already requires.
The Safeguards disposal clock
Section 314.4(c)(6) requires procedures for secure disposal of customer information “in any format no later than two years after the last date the information is used” for that customer. The exceptions are information still needed for the business, information another law requires you to keep, and records where targeted disposal is not reasonably feasible.
That is a real deadline, and it is the one FACTA lacks. A dealer that keeps every deal jacket since 2012 in a back room is likely out of step with it.
Who counts as a financial institution
The definitions in 16 CFR 314.2 give an example: a dealership that, as a usual part of its business, leases automobiles for longer than 90 days is a financial institution for its leasing business. Dealers that arrange financing should ask their compliance adviser how the rule applies to them.
The small-business exception in 314.6 trims a few requirements for institutions with customer information on fewer than 5,000 consumers. The disposal paragraph is not one of them.
Paper is only half of it. Retired desktops in the F&I office and drives pulled from copiers hold the same reports. Our page on hard drive destruction covers devices, which we physically destroy and quote per item.
Landlords and employers: the files that get forgotten
Small landlords are the group most surprised by this rule. If you own a three-family in Nashua and ran a screening report on the last applicant, that report is consumer information held for a business purpose. When you are done with it, it has to be destroyed so it cannot be read.
The trouble spot is the applicants you turned down. Their reports sit in a folder or an email download long after the unit is rented. Set a date to purge them and stick to it.
Employers have the same problem with background checks. The report lands in a hiring folder, a copy goes to a manager, and a third sits in a shared drive. Each copy is a disposal you will eventually have to make. Other employment laws may set how long hiring records stay, so confirm that period first.
- Keep screening and background reports in one locked drawer, not spread across desks and cars.
- Write the date you will purge each batch on the outside of the folder.
- Delete downloaded PDFs and email attachments when you shred the paper.
- Do not hand a report to a property manager or recruiter without telling them how to dispose of it.
For a few sheets a quarter, a cross-cut home shredder meets the rule. For a filing cabinet of old applications, bring the boxes to our Tewksbury counter. The drop-off desk takes walk-ins on weekdays from 10 a.m. to 5 p.m. with no appointment, and our drop-off shredding page has the details.
What happens if consumer report paper ends up in a dumpster
The Disposal Rule sits inside the Fair Credit Reporting Act, so the FCRA’s liability sections apply. Under 15 U.S.C. 1681n, a person who willfully fails to comply with a requirement of the subchapter is liable to the consumer for actual damages or statutory damages of $100 to $1,000, plus punitive damages and attorney’s fees. Under 1681o, negligent noncompliance means actual damages and attorney’s fees.
The federal side
The FTC enforces the rule against businesses under its jurisdiction. The dollar exposure on the private side scales with the number of consumers in the box. One carton of tenant applications can hold dozens of people, and each one is a potential claim.
Our post on improper document disposal fines collects the federal penalty provisions that reach paper.
The New Hampshire side
New Hampshire’s notice of security breach law, RSA 359-C:19 to 359-C:21, is written around “computerized data.” A box of paper reports in a dumpster is not a security breach under that definition, but a lost laptop with the same reports may be. If a breach requires notice to more than 1,000 people, RSA 359-C:20 also requires notice to the nationwide consumer reporting agencies.
Our guide to the New Hampshire data breach law explains notice, timing and the attorney general’s role.
The rule asks for reasonable measures, not perfection. A written policy, locked collection, a vendor you checked out and a certificate for every job is the kind of record that shows reasonableness if anyone asks.
A FACTA disposal program in six steps
Most New Hampshire businesses covered by the rule are small: a used-car lot, a property manager, a ten-person company that runs background checks. The program does not need to be long. It needs to exist on paper and be followed.
- Name an ownerOne person decides when files are purged and signs off on the vendor. In a dealership that is often the F&I manager. For a landlord, it is you.
- Find every copyList where reports live: deal jackets, applicant folders, personnel files, email, downloads, the scanner’s hard drive. You cannot dispose of what you cannot find.
- Set the clockWrite down how long each file type stays and why. For Safeguards Rule businesses, start from the two-year rule in 314.4(c)(6) and its exceptions.
- Lock the collectionUse a locked box or closet for paper waiting to be shredded. Open recycling totes are where most disposal failures start.
- Check the vendorThe rule’s due diligence list includes references, audits and the vendor’s security policies. Visit our Tewksbury office and ask how a box moves from counter to shredder.
- File the proofEvery job comes with a Certificate of Destruction. Keep it with your written policy and the purge log.
Good questions for any shredding vendor, ours included, are in our post on questions to ask a shredding company. The custody side, who touches the box and when, is covered in our guide to chain of custody shredding.
What compliant disposal costs a small NH business
Pricing is the same for every business. Drop-off is 99 cents per pound. At 10 boxes or more, the flat rate is $15 per small box or $20 per large banker’s box. Every job adds $34.90: a $14.95 filing fee that covers the Certificate of Destruction paperwork and a $19.95 environmental fee for recycling the shred.
| Large boxes | Drop-off | Zone 1 pickup | Zone 2 pickup | Zone 3 pickup |
|---|---|---|---|---|
| 1 box (about 30 lb) | $64.60 | $194.55 | $224.55 | $264.55 |
| 5 boxes (about 150 lb) | $183.40 | $313.35 | $343.35 | $383.35 |
| 10 boxes ($20 each) | $234.90 | $364.85 | $394.85 | $434.85 |
| 20 boxes ($20 each) | $434.90 | $564.85 | $594.85 | $634.85 |
Zone 1, at $129.95, covers the border towns such as Salem, Pelham, Windham and Plaistow. Zone 2, at $159.95, covers greater Nashua and Manchester. Zone 3, at $199.95, covers the Seacoast and points farther north, and any other town’s zone is confirmed when you book. Pickup prices assume ground-level or elevator access.
Our view: a Salem dealer with five boxes should drive them down Route 28 or I-93 and skip the transport fee. A Concord property manager clearing ten years of applicant files should book the off-site shredding pickup. If you want to see it happen, a witnessed shredding session runs $1.99 per pound with a $100 minimum, plus the $34.90.
Frequently asked questions
What is the FACTA disposal rule?
It is the FTC’s rule at 16 CFR Part 682, issued under section 216 of the Fair and Accurate Credit Transactions Act of 2003. It requires anyone who keeps consumer report information for a business purpose to take reasonable measures to protect it when disposing of it. The FTC’s examples include burning, pulverizing or shredding paper so it cannot practicably be read or reconstructed. It took effect June 1, 2005.
Does the rule apply to a small landlord in New Hampshire?
Yes, if you pull a credit or tenant screening report. The FTC’s business guide names landlords and also individuals who obtain a credit report on a prospective tenant, nanny or contractor. Size does not matter. Once you are done with the report, including reports on applicants you turned down, it must be destroyed so it cannot be read or reconstructed.
How long do I have to keep credit reports before shredding them?
The Disposal Rule does not say. Section 682.4 leaves retention to other laws. Businesses covered by the FTC Safeguards Rule must have procedures to dispose of customer information no later than two years after it was last used for that customer, with exceptions for business need, legal retention duties and records where targeted disposal is not feasible. Check with your compliance adviser.
Is recycling consumer reports enough?
No. Recycling whole pages leaves them readable to anyone who handles the bin, truck or sorting line. The rule’s examples are burning, pulverizing or shredding papers so they cannot practicably be read or reconstructed. Cross-cut shredding first, then recycling the shred, meets that description. All of the paper we shred in Tewksbury is recycled after it is shredded.
Does FACTA cover old computers and copiers?
Yes. The rule defines disposal to include the sale, donation or transfer of any medium, including computer equipment, that stores consumer information. Before you donate a PC or return a leased copier, the drive has to be destroyed or erased so the data cannot practicably be read. We physically destroy drives and media and quote them per item.
What are the penalties for violating the Disposal Rule?
The rule sits inside the Fair Credit Reporting Act. Under 15 U.S.C. 1681n, a willful violation can mean actual damages or statutory damages of $100 to $1,000 per consumer, plus punitive damages and attorney’s fees. Under 1681o, negligent violations can mean actual damages and attorney’s fees. The FTC also enforces the rule against businesses under its jurisdiction.
Do you shred at our dealership or office?
No. All shredding happens at our office at 1215 Main Street, Unit 115, Tewksbury, Massachusetts, about 15 minutes south of the NH line. You can drive boxes down on a weekday, book a pickup by zone, or book a witnessed session and watch your files go through the shredder. We have no truck that shreds at the curb.
What proof do we get for our compliance file?
Every job includes a Certificate of Destruction, covered by the $14.95 filing fee. Keep it with your written disposal policy and a short purge log showing the date, number of boxes and the file types that went out. That paper trail is how you show you took reasonable measures. Call (978) 636-0301 if you need help setting up the log.
Sources
- govinfo: 16 CFR Part 682, Disposal of Consumer Report Information and Records (checked November 2026)
- FTC: Disposing of Consumer Report Information? Rule Tells How (checked November 2026)
- govinfo: 15 U.S.C. 1681n, civil liability for willful noncompliance (checked November 2026)
- govinfo: 15 U.S.C. 1681w, disposal of records (checked November 2026)
- govinfo: 16 CFR 314.4, Safeguards Rule elements, including (c)(6) disposal (checked November 2026)
- New Hampshire General Court: RSA 359-C:20, notification of security breach (checked November 2026)
Get the old reports out of the back room
Box up the deal jackets, screening reports and hiring files that have aged out, and bring them to Tewksbury on any weekday or book a pickup by zone. You get a Certificate of Destruction for your compliance file on every job.
Visit or call
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38 near the I-495 interchange, about 15 minutes south of the NH line. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
Three ways to shred: walk-in drop-off at 99¢ per pound, pickup by zone, or a witnessed session at $1.99 per pound.
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.