FTC Disposal Rule — consumer-report information and records
Enacted in force
Fields requiring verification
- enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
- penalty amount: Unverified — Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description. Primary source
In plain English
- Persons within FTC jurisdiction that maintain or otherwise possess consumer information derived from consumer reports for a business purpose; can include users of consumer reports and service providers. Primary source
- This is not a universal disposal rule for every type of personal information. Primary source
- Take reasonable measures to prevent unauthorized access to or use of covered consumer information in connection with its disposal. Primary source
- Implement and monitor appropriate paper-destruction and electronic-media erasure or destruction practices; the rule’s examples are illustrative rather than exclusive safe harbors. Primary source
- Where using a disposal contractor, perform appropriate due diligence and monitor contractual compliance; preserve retention duties imposed by other law. Primary source
Dates and phased obligations
Legal effective date: 2005-06-01; principal compliance date: 2005-06-01. Primary source
The June 1, 2005 legal effective date is explicit. Section 682.4 neither creates a new retention period nor alters other legal retention or destruction duties. No fixed vendor-audit method is presented as compulsory: the examples are illustrative. Source and qualifications
Questions from this record
Who does 16 CFR 682; 69 FR 68690 cover?
Persons within FTC jurisdiction that maintain or otherwise possess consumer information derived from consumer reports for a business purpose; can include users of consumer reports and service providers. This is not a universal disposal rule for every type of personal information. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
Legal effective date: 2005-06-01; principal compliance date: 2005-06-01. Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
- FTC final rule, 69 FR 68690DATES; 16 CFR 682.1–682.5, especially 682.3 examples and 682.4
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.