Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

Secure Destruction of Paper and Digital Records: Meeting the FTC's Reasonable Measures Standard

16 Jul 2026 · 4 min

Watch on YouTube

3:30

The video presents an instructional overview of the FTC’s disposal rule, emphasizing the “reasonable measures” standard for protecting sensitive information during the destruction of paper and digital records. The speaker explains that reasonable measures depend on data sensitivity and volume, and the key test is whether the information can be practically read or reconstructed. For paper, the FTC recommends burning, pulverizing, or using cross‑cut/micro‑cut shredders to produce confetti‑like fragments, noting that standard strip‑cut shredding is insufficient for high‑security data. For digital media, the speaker warns that simply deleting files is ineffective; instead, approved wiping/overwriting software, degaussing, or physical destruction (crushing, drilling, shredding) must be used to render data unrecoverable. The narrative highlights compliance risks, such as donating computers with residual data, and cites Department of Defense standards as a benchmark. A brief promotional interjection advertises Atlantic Training’s Wave HR platform, but the core content remains focused on practical, compliant disposal methods.

Chapters

Now for the methodology. The disposal rule does not mandate a specific brand of machinery. The FTC requires you to take reasonable measures to protect against unauthorized access during disposal. Reasonable Measures is a flexible standard based on the sensitivity and volume of your data. However, crumpling a document and tossing it in the recycling bin is not a reasonable measure. The standard is simple: can the information be practically read or reconstructed? If the answer is yes, you have failed. Let's discuss paper. The FTC suggests burning, pulverizing, or shredding papers so that the information cannot be reconstructed. Note the emphasis on reconstructed. Many university IT security policies specify that standard strip-cut shredding is insufficient for high-security data. Cross-cut or micro-cut is the standard. You want confetti, not ribbons. Then we have the digital realm. This is where complacency sets in.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom Plan now.
Dragging a file to the trash icon and hitting empty is digital theater. It does almost nothing. The data remains on the drive, easily recoverable by anyone with basic software. The FTC guidance for digital media requires destroying or erasing electronic media so that the information is unrecoverable. Proper digital data destruction includes Wiping/Overwriting. This involves approved software that overwrites the storage space with random binary code so the data cannot be recovered. University IT departments have historically cited Department of Defense standards for this. Think of it as painting over a canvas until the original image is gone. Degaussing. This uses a high-powered magnet to scramble the magnetic fields on hard drives. It renders the drive completely unusable. Physical destruction, the most definitive method. Crushing the drives, drilling through the platters, or shredding them into scrap metal. If you are donating old office computers to a local school, you must securely wipe the drives using approved methods so the information is unrecoverable. Handing over a laptop containing cached background checks isn't charity, it's a compliance violation.