Texas Information Disposal Act

The Texas Information Disposal Act (IDA), sometimes known as the Texas Shred Law, is a state law that went into effect in 2005. It addresses the disposal of business records that contain personal identifying information. Personal identifying information is defined here as an individual’s first name or initial and last name in combination with any of the following:

• Date of birth
• Social security number or other
• Government-issued identification number
• Mother’s maiden name
• Unique biometric data including
  • Fingerprint
  • Voiceprint
  • Retina or iris image
• Unique electronic identification number
• Address or routing code
• Telecommunication access devices including
  • Debit and credit card information
• Financial institution account number
• Other financial information.

Requirements and Penalties

IDA does not set guidelines for how long records should be retained or override any other record retention requirements. It simply requires that when a business does dispose of a business record (physical or digital) that contains personally identifying information of a customer of the business, the business must first render that information unreadable or undecipherable. According to the law, this goal can be accomplished by “shredding, erasing or other means.”

A business that fails to comply with the standard, is liable in civil damages for a penalty of up to $500 per record. The Texas attorney general also has the power to recover the civil penalty, obtain a remedy, including injunctive relief, and recover costs and reasonable attorney’s fees incurred in bringing an action. Read the full text of Texas IDA (HB 698).