Secure document destruction for accountants: a how-to

Secure document destruction for accountants means making client records impossible to read or rebuild once the firm no longer needs them. Shred or burn paper, sanitize laptops, drives and copiers before they leave the office, track down cloud copies and backups, and record every destruction in a log tied to the firm's retention schedule.

What does the FTC Disposal Rule expect from accountants?

The FTC Disposal Rule requires anyone who keeps consumer report information for a business purpose to take "reasonable measures" to protect it from unauthorized access when it is thrown away. For accountants, the broader duty usually comes from the FTC Safeguards Rule, which requires secure disposal of customer information and folds the Disposal Rule into the firm's security program.

The Disposal Rule is short. 16 CFR 682.3 on eCFR (current as of October 2026; rule text from 69 FR 68697, November 24, 2004) sets the standard: a person who possesses consumer information "must properly dispose of such information by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal." Its examples include shredding papers "so that the information cannot practicably be read or reconstructed," destroying or erasing electronic media to the same standard, and hiring a destruction company after due diligence.

Its scope is narrower than it sounds. Under 682.1, "consumer information" means records that are, or are derived from, a consumer report, such as a credit report a firm pulled for a client's loan application. IRS Publication 4557, Safeguarding Taxpayer Data (Rev. 6-2024) reflects this when it tells firms to dispose of customer information securely "and, where applicable, consistent with the FTC's Disposal Rule."

The Safeguards Rule fills the gap for all customer information. 16 CFR 314.4(c)(6) on eCFR (current as of October 2026) requires covered firms to have procedures for "the secure disposal of customer information in any format no later than two years after the last date the information is used" for that customer. It allows exceptions where the information is needed for business operations or other legitimate purposes, where law or regulation requires keeping it, or where targeted disposal is not reasonably feasible. It also requires firms to "Periodically review your data retention policy to minimize the unnecessary retention of data." The Disposal Rule, in 682.3(b)(5), says firms subject to the Safeguards Rule should build proper disposal into that same program.

Neither rule sets how long to keep anything. 16 CFR 682.4 says the Disposal Rule does not require keeping or destroying any record beyond what other law imposes. How long client records stay before destruction is a separate question, covered in the document retention policy for CPA firms and the organizing client files category. Whether a given firm is covered, and how, is a question for its own advisers; this post describes what the rules say.

Shredding standards for client paper documents

Shredding client paper means cutting it so finely that no one can read it or piece it back together. The Disposal Rule's test is that information "cannot practicably be read or reconstructed." Judge any shredder or shredding service by that test, decide between shredding in-house and hiring a service, and keep proof that each batch was destroyed.

Cross-cut versus strip-cut

A strip-cut shredder slices a page into long strips running the length of the sheet, and a line of text can survive on a single strip. A cross-cut or micro-cut shredder also cuts across the strips, leaving small pieces. Measured against "cannot practicably be read or reconstructed," the smaller the pieces the better. Test a shredder by feeding a sample W-2 and looking at what comes out: if a Social Security number or an account number is readable on any piece, the machine fails the test for client documents.

Publication 4557 (Rev. 6-2024) gives the IRS baseline: "shred or burn all documents containing taxpayer information before throwing away." Its checklist, drawn from FTC suggestions, adds "Burn, pulverize, or shred papers containing customer information so that the information cannot be read or reconstructed."

In-house versus a shredding service

An office shredder suits a steady trickle of paper: the review copy of a return, a client's spare statement. A shredding service suits the annual purge, when years of closed files leave at once. The Disposal Rule describes the due diligence for a service in 682.3(b)(3): reviewing an independent audit of the company, checking references, "requiring that the disposal company be certified by a recognized trade association or similar third party," or reviewing its security policies. Publication 4557 likewise suggests "checking references or requiring that the company be certified by a recognized industry group."

Until the service collects, paper waiting for destruction is still client data. Keep it in a locked bin, not an open box by the copier.

Certificates of destruction

Ask any shredding service for a certificate for each pickup, showing the date, the volume or container count and the method. File it against the matching entry in the destruction log described below.

Wiping laptops, drives and copiers before secure disposal

Wiping a device before disposal means sanitizing its storage so client data cannot be recovered. NIST, the federal standards agency, describes three levels: clear, purge and destroy. A device that leaves the firm, whether sold, donated, recycled or returned at the end of a lease, should be purged or destroyed, with the result recorded.

The current guide is NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization (September 2025). In plain terms, its three methods are:

• Clear: rewriting the storage, or a factory reset where rewriting is not possible, to protect "against simple, non-invasive data recovery techniques." The device stays usable. NIST notes that clear "is not appropriate for hard copy under any conditions."
• Purge: physical or logical techniques that make recovery "infeasible using state-of-the-art laboratory techniques" while leaving the device potentially reusable. NIST says purge "should be used instead of the clear sanitization method" when possible. Cryptographic erase, which destroys the keys protecting encrypted data, is one purge technique.
• Destroy: making recovery infeasible and the device unusable. NIST lists disintegrating, incinerating, melting, pulverizing and shredding.

Two details matter for small offices. First, older advice to overwrite a drive many times does not carry over to solid-state drives. NIST warns that for some devices, such as SSDs with overprovisioning, repeated overwrite passes "should be avoided as very little confidentiality protection is achieved," and points to dedicated sanitize commands, purge or destroy instead. Second, drilling a hole through a drive is not destruction under NIST's definition; it "may only partly damage" the media.

Copiers and printers count. Publication 4557 (Rev. 6-2024) tells firms to "Wipe clean or destroy old computer hard drives and printers that contain sensitive data," and to "Delete all information from devices, hard drives, USBs (flash drives), printers, tablets or phones before disposing of devices." A leased copier that scanned a season's worth of W-2s should be sanitized before the leasing company takes it back. NIST notes that for office equipment that offers only a factory reset, that reset may be the only clear option, so ask the manufacturer or lessor what purge or destroy options exist.

Phones and tablets follow the same rule. A firm phone that received texted W-2s holds them until it is sanitized. Keep an inventory of every device that ever held client data; the WISP template's data and device inventory section shows how to build one, so no device leaves without being checked.

Cloud deletion edge case: backups that outlive the delete

Cloud deletion rarely removes every copy at once. A file deleted from a cloud folder can survive in a trash folder, in older versions of the same file, in a synced copy on a laptop, and in backups the provider or the firm keeps. Secure destruction means finding each copy and knowing when it goes.

The firm cannot shred a cloud server. NIST SP 800-88 Rev. 2 says that for cloud and other virtual storage, the data owner "has no direct access to the physical" media, and cryptographic erase "may be the only viable purge sanitization technique option." It advises organizations to "clearly understand their purge sanitization technique options and the effectiveness of the technique prior to storing sensitive data" there.

Work through each place a copy can hide:

• Trash or recycle bin. Find out how long deleted files stay recoverable and whether an administrator can empty it early.
• Version history. Check whether older versions of a file are kept separately and whether deleting the file deletes them.
• Synced devices. A file deleted in the cloud may survive on a laptop that was offline when the delete happened, or in a former employee's sync folder.
• Email attachments. The same W-2 may also sit in an inbox, a sent folder and a mail archive. Delete those too.
• Backups. Ask the provider, in writing, how long backups keep deleted data and how backup media is sanitized.
• Exports and duplicates. Spreadsheets built from client statements and duplicate scans are copies too.

Duplicate copies make this harder. A client who sends the same W-2 twice, once as a phone photo and once as a PDF, leaves the firm two files to destroy. Schema CPA flags the same W-2 scanned twice instead of counting it again, which shows the firm which files are copies when it decides what to keep; destroying them stays the firm's job. The documents section of the homepage lists what it reads.

Record the cloud deletion with the date the last copy is expected to expire, not only the date of the delete.

Why keep a document destruction log?

A document destruction log is the firm's record of what client material was destroyed, when, how and by whom. It proves the firm followed its retention schedule, shows that disposal met the Safeguards Rule's requirement for secure disposal, and answers a client who asks years later whether their records still exist.

The log ties destruction to retention. Each entry should point back to the retention rule that made the material eligible, so the firm can show it destroyed nothing too early and kept nothing far too long. NIST SP 800-88 Rev. 2 makes the same point for electronic media: a "certificate of sanitization" should be completed for each sanitized device, recording at least the manufacturer, model, serial number, media type, sanitization method and technique, tool used, verification method, and the name, title, date and signature of the person who did it.

Fold the log into the firm's written information security plan. The plan names who supervises disposal; Publication 4557 (Rev. 6-2024) suggests firms "Consider designating or hiring a records retention manager to supervise the disposal of records containing customer information." The post on the WISP for tax preparers covers where disposal fits among the plan's other elements.

A destruction log template

This example shows a fictional firm's entries. Client names, serial numbers and certificate numbers are made up.

Keep the log for as long as the firm keeps its other security records, and review it at the same time as the retention policy.