50-State Document Shredding & Data Privacy Laws
State-by-state record disposal statutes, mandatory unreadable cross-cut shredding standards, and civil penalties for improper disposal of personal identifying information (PII).
| State | Primary Data Privacy & Disposal Statute | Mandatory Destruction Standard | Covered Entities | Max Civil Penalty (Improper Disposal) |
|---|---|---|---|---|
| Alabama | AL Data Breach Notification Act (§ 8-38-1) | Shredding to make unreadable / undecipherable | All commercial businesses | Up to $500,000 / breach event |
| Alaska | Alaska Personal Information Protection Act (§ 45.48) | Physical shredding or burning of PII | Businesses & state agencies | Up to $500 / individual ($50k max) |
| Arizona | ARS § 44-7601 (Destruction of Records) | Shredding, erasing or modifying PII | Commercial entities | Up to $10,000 / violation |
| Arkansas | Arkansas Code § 4-110-104 (Personal Info Protection) | Shredding to render PII completely unreadable | All commercial businesses | Up to $10,000 under Deceptive Trade |
| California | Cal. Civ. Code § 1798.81 (Customer Records Destruction) | Cross-cut shredding, erasing or modifying | All businesses holding CA records | Actual damages + civil penalties |
| Colorado | C.R.S. § 6-1-713 (Disposal of Personal Identifying Info) | Physical destruction / cross-cut shredding | Sole proprietorships to corporations | Up to $500,000 under AG enforcement |
| Connecticut | Conn. Gen. Stat. § 42-471 (Safeguarding Personal Data) | Shredding of social security / financial records | All entities in CT | Up to $500 / violation ($500k max) |
| Delaware | 6 Del. C. § 12B-100 (Destruction of Records) | Physical shredding or electronic erasure | Commercial enterprises | Civil action for actual damages |
| Florida | Florida Statute § 501.171 (Florida FIPA) | Shredding customer records prior to disposal | All businesses & state bodies | Up to $500,000 for systemic violations |
| Georgia | O.C.G.A. § 10-15-2 (Disposal of Business Records) | Shredding to make PII completely unreadable | All commercial businesses | Up to $10,000 / violation |
| Hawaii | HRS § 487R-2 (Destruction of Personal Info Records) | Cross-cut shredding or incineration | Businesses & government agencies | Up to $1,000 / individual |
| Idaho | Idaho Code § 28-51-104 (Identity Theft Protection) | Reasonable physical destruction | Commercial entities | Up to $25,000 under Idaho AG |
| Illinois | 815 ILCS 530/40 (Personal Information Protection Act) | Shredding of paper records containing PII | All businesses & universities | Up to $50,000 under Consumer Fraud |
| Indiana | Ind. Code § 24-4-14 (Disposal of Customer Records) | Shredding, incinerating, or pulverizing | Commercial enterprises | Up to $10,000 under AG civil action |
| Iowa | Iowa Code § 715C.2 (Personal Info Security Breach) | Permanent unreadable destruction | Businesses & non-profits | Up to $40,000 / day of violation |
| Kansas | K.S.A. § 50-7a03 (Destruction of Consumer Records) | Shredding or erasing consumer records | All commercial holders of PII | Up to $10,000 / violation |
| Kentucky | KRS § 365.732 (Notice of Security Breach) | Physical destruction of confidential files | Commercial entities | Injunctive relief + actual damages |
| Louisiana | La. R.S. § 51:3074 (Database Security Breach & Disposal) | Shredding or modifying PII to be unreadable | All Louisiana businesses | Up to $5,000 / day under AG |
| Maine | 10 M.R.S. § 1347 (Notice of Risk to Personal Data) | Certified physical destruction / shredding | Commercial enterprises | Up to $100,000 under AG action |
| Maryland | Md. Commercial Law § 14-3502 (Maryland PIPA) | Shredding, burning or pulverizing records | All Maryland businesses | Up to $1,000 / violation ($5k max) |
| Massachusetts | 201 CMR 17.00 (Standards for Protection of Data) | Cross-cut shredding of paper documents | All businesses holding MA resident PII | Up to $5,000 / violation |
| Michigan | MCL § 445.72 (Social Security Number Privacy Act) | Shredding documents containing SSNs | All employers and businesses | Up to $1,000 / violation + criminal |
| Minnesota | Minn. Stat. § 325E.64 (Security of Customer Data) | Permanent unreadable destruction | Commercial businesses | Civil action for actual damages |
| Mississippi | Miss. Code § 75-24-29 (Notice of Security Breach) | Reasonable physical destruction | Commercial entities | Up to $5,000 under AG action |
| Missouri | Mo. Rev. Stat. § 407.1500 (Notice of Security Breach) | Shredding to render PII undecipherable | Commercial businesses | Up to $150,000 / breach event |
| Montana | Mont. Code Ann. § 30-14-1703 (Disposal of Records) | Shredding, burning, or electronic wipe | All Montana businesses | Up to $10,000 under AG action |
| Nebraska | Neb. Rev. Stat. § 87-808 (Destruction of Records) | Physical shredding of customer PII | Commercial enterprises | Injunctive relief + actual damages |
| Nevada | NRS § 603A.200 (Destruction of Records Containing PII) | Cross-cut shredding or permanent erasure | All businesses operating in NV | Civil action + actual damages |
| New Hampshire | RSA § 359-C:20 (Notice of Security Breach) | Permanent physical destruction | Commercial businesses | Up to $10,000 under AG action |
| New Jersey | N.J.S.A. § 56:8-162 (Destruction of Customer Records) | Shredding, erasing or modifying PII | All commercial entities in NJ | Up to $10,000 under Consumer Fraud |
| New Mexico | NMSA § 57-12C-3 (Data Breach Notification & Disposal) | Shredding paper records to be unreadable | All commercial holders of PII | Up to $150,000 under AG action |
| New York | N.Y. Gen. Bus. Law § 399-H (Disposal of Records) / SHIELD | Shredding, destroying or modifying PII | All businesses holding NY resident PII | Up to $250,000 under SHIELD Act |
| North Carolina | N.C.G.S. § 75-64 (Destruction of Personal Records) | Cross-cut shredding or incineration | All businesses in NC | Up to $5,000 / violation |
| North Dakota | N.D.C.C. § 51-30-01 (Notice of Security Breach) | Reasonable physical destruction | Commercial entities | Up to $10,000 under AG action |
| Ohio | ORC § 1349.19 (Security Breach Notification) | Physical shredding of sensitive records | All commercial enterprises | Up to $10,000 / day under AG |
| Oklahoma | 74 O.S. § 3113.1 (Destruction of Records) | Cross-cut shredding to make undecipherable | State bodies & contractors | Up to $10,000 under AG action |
| Oregon | ORS § 646A.622 (Oregon Consumer Identity Protection) | Shredding of customer identifying files | All businesses in OR | Up to $500,000 under AG action |
| Pennsylvania | 73 P.S. § 2301 (Breach of Personal Information Act) | Physical destruction / cross-cut shredding | Commercial enterprises | Up to $50,000 under AG action |
| Rhode Island | R.I. Gen. Laws § 11-49.3 (Identity Theft Protection) | Shredding, incinerating, or pulverizing | All commercial entities | Up to $200 / record destroyed unlawfully |
| South Carolina | S.C. Code § 39-1-90 (Notice of Security Breach) | Reasonable physical disposal | Commercial businesses | Up to $5,000 under AG action |
| South Dakota | SDCL § 22-40-19 (Notice of Breach) | Permanent physical destruction | Commercial entities | Up to $20,000 / day under AG |
| Tennessee | Tenn. Code § 47-18-2107 (Destruction of Records) | Shredding, erasing or modifying PII | All businesses in TN | Up to $10,000 under Consumer Protection |
| Texas | Tex. Bus. & Com. Code § 521.052 (Destruction of Records) | Cross-cut shredding, erasing or burning PII | All commercial entities in TX | Up to $500 / record ($50,000 max) |
| Utah | Utah Code § 13-44-201 (Protection of Personal Info) | Shredding to make PII unreadable | All commercial businesses | Up to $100,000 under AG action |
| Vermont | 9 V.S.A. § 2445 (Destruction of Personal Info) | Cross-cut shredding or permanent erasure | Businesses & state agencies | Up to $10,000 under AG action |
| Virginia | Va. Code § 59.1-575 (Consumer Data Protection Act - CDPA) | Certified physical destruction & erasure | Commercial businesses in VA | Up to $7,500 / violation under AG |
| Washington | RCW § 19.215.020 (Disposal of Personal Information) | Cross-cut shredding or burning records | All businesses in WA | Civil action + actual damages |
| West Virginia | W. Va. Code § 46A-2A-102 (Breach of Security) | Reasonable physical destruction | Commercial enterprises | Up to $5,000 under AG action |
| Wisconsin | Wis. Stat. § 134.97 (Disposal of Customer Records) | Shredding to make records undecipherable | All Wisconsin businesses | Up to $1,000 / customer affected |
| Wyoming | Wyo. Stat. § 40-12-502 (Notice of Breach) | Permanent unreadable destruction | Commercial entities | Up to $10,000 under AG action |