Anthony LaFaziaCEO, Atlantic Training · CEO at Atlantic Training | EdTech & Safety Compliance Leader

What Data Does the Disposal Rule Actually Apply To?

8 Jul 2026 · 2 min

Watch on YouTube

2:18

In this video, Anthony LaFazia explains the FTC Disposal Rule’s scope, clarifying which types of data must be disposed of under the rule. He defines “consumer information” as any record—paper, digital, or otherwise—derived from a consumer report, such as credit reports from Equifax, Experian, or TransUnion. He contrasts this with personally identifiable information (PII) that is collected directly from an individual (e.g., name and address for a mailing list), which is not subject to the Disposal Rule. The speaker emphasizes that once a business extracts or copies consumer‑report data into its own systems—like internal spreadsheets or email threads—that material becomes subject to the disposal requirements and must be erased when no longer needed. The segment also contains a brief promotional read for Atlantic Training’s Wave HR platform.

We've established who must comply. Now, what exactly are we destroying? The FTC defines consumer information under this rule quite specifically. It is any record about an individual—paper, digital, or otherwise—that is derived from a consumer report. It helps to distinguish this from other data organizations commonly collect.
Is your employee training scattered across spreadsheets and emails? There's a better way to grow your team. Atlantic Training provides world-class HR and soft skills courses, all hosted inside our Wave management platform. From onboarding automation to tracking leadership development, Wave tracks it all. And you get the software for free when you choose your training plan. Click the link below to build your custom plan now.
If a client provides their name and address to sign up for a mailing list, that information is personally identifiable information, or PII, and it still must be protected. But because it was collected directly from the individual, it is not consumer report information, and is not governed by the Disposal Rule. However, if you utilize a third party, like Equifax, Experian, or TransUnion, to verify if that client pays their bills on time, the resulting record is "consumer information" and must be disposed of in accordance with the Disposal Rule. This includes compilations. If you extract data from a credit report and copy it into your own internal spreadsheet, that spreadsheet is now subject to the disposal rule. Essentially, if you borrowed the truth from a consumer reporting agency to make a business decision, that truth needs to be erased when you are done with it.