How do I safely dispose of paper documents that contain personal information?

Disposing of paper that contains personal information is not just throwing it away. Personally identifiable information (PII) such as names paired with Social Security numbers, account numbers, dates of birth, or health details remains sensitive until the paper is destroyed beyond reconstruction. Doing this correctly protects individuals from identity theft and protects your organization from breach liability.

Confirm the records are eligible for disposal

Before destroying anything, verify the records have met their required retention period and are not subject to a legal hold, audit, investigation, or open records request. Destroying records too early can violate recordkeeping obligations; keeping PII longer than necessary increases risk. Follow your approved records schedule and document the authorization to destroy.

Choose a destruction method that prevents reconstruction

The goal is irreversibility. Practical methods include:

• Cross-cut or micro-cut shredding rather than strip-cut, which can be reassembled.
• Pulping or incineration for high-volume or highly sensitive batches.
• Secured collection bins with locked openings if destruction is not immediate, so documents are protected while they await shredding.

Avoid recycling or trashing intact documents, and never let sensitive paper sit unattended in open bins or boxes.

Maintain chain of custody and documentation

Whether you destroy in-house or use a vendor service, keep the records secure from the moment they leave active use until destruction is complete. If a third party handles destruction, require a certificate of destruction and confirm their safeguards. Create and retain a destruction log noting what was destroyed, the date, the method, and who authorized it. This documentation demonstrates that you followed policy and acted in good faith.

Build it into ongoing practice

Treat secure disposal as part of the records lifecycle, not an afterthought. A written retention-and-disposition policy, routine “shred days,” staff training, and minimizing how much PII you collect and copy all reduce exposure. Frameworks for managing privacy risk emphasize identifying where personal data lives and disposing of it responsibly once it is no longer needed.

For related guidance on handling sensitive personal data across its lifecycle, see the privacy and PII topic hub.