Reg S-P disposal rule: how to retire laptops, copiers and phones

A copier lease ends, a departing adviser hands back a firm phone, or five laptops are due for replacement. Under Regulation S-P, each of those is a disposal event, and with both compliance dates for the 2024 amendments now passed, an SEC examiner can ask you to show the written procedure and the record for each device.

What does the Reg S-P disposal rule require?

The Reg S-P disposal rule requires every covered institution, other than a notice-registered broker-dealer, to properly dispose of consumer information and customer information by taking reasonable measures to protect against unauthorized access to or use of that information in connection with its disposal. The firm must also adopt and implement written policies and procedures that address proper disposal. Both obligations sit in 17 CFR 248.30(b).

The rule is short and does not list approved methods. It sets a standard (reasonable measures) and a documentation duty (written policies and procedures). Everything else, including which tools you use and who touches the device, is left for the firm to decide and defend. For an RIA, broker-dealer or dual-registered firm, that means the question at an exam is rarely "did you shred it?" and more often "show me the procedure and show me that you followed it for this device."

What changed when the 2024 amendments took effect?

The amendments widened the disposal rule from consumer report information to customer information, and they added a recordkeeping duty that covers it. Both compliance dates have now passed: December 3, 2025 for larger entities and June 3, 2026 for smaller entities, measured from the rule's June 3, 2024 publication in the Federal Register.

Before the amendments, the disposal rule reached consumer report information, the kind of data that comes from a credit report or background check. The SEC's fact sheet on the 2024 amendments says they "expand and align the safeguards and disposal rules" to cover nonpublic personal information a firm collects about its own customers and information it receives about customers of other financial institutions. For most advisory firms, that is nearly every client file: account numbers, Social Security numbers, custodial statements, tax documents and onboarding packets.

The fact sheet also says covered institutions must make and maintain written records documenting compliance with the safeguards rule and the disposal rule. For advisers, that duty is in Rule 204-2. For broker-dealers, it is in Rule 17a-4. In practice, an examiner who asks about disposal will want the written procedure plus evidence that specific devices were handled under it. The full adopting release explains the reasoning behind both changes, and our guide to Reg S-P recordkeeping under Rule 204-2 covers which records to keep and for how long.

Which devices hold customer information when they leave the firm?

Any device that ever stored, cached or synced client data holds customer information when it leaves the firm. In a typical advisory office that includes laptops and desktops, external drives and USB sticks, firm phones and tablets, multifunction copiers and scanners, and servers or network storage being decommissioned. The rule's definition of customer information also reaches paper, electronic and other forms, so paper files belong in the same procedure.

If you have not yet traced where customer information lives across your systems, a customer information data map gives you the device list your disposal procedure has to cover.

Laptops are the obvious case. Copiers and phones are the ones firms forget, and the rule does not distinguish among them. A device leaves your control in several ways: a lease return, a sale or donation, a trade-in, an employee's departure with a firm phone, a warranty swap, or a recycler pickup. Each is a disposal event, and each needs to be covered by the written procedure.

How should laptops and desktops be retired?

Sanitize the storage with a method that makes recovery infeasible, verify that it worked, and record the result before the device leaves your custody. NIST's SP 800-88 Rev. 2, published in September 2025, is the federal reference for how to do that.

SP 800-88 Rev. 2 describes three methods. Clear uses logical techniques to sanitize all user-addressable storage and protects against basic recovery. Purge applies physical or logical techniques that make recovery of the target data infeasible while leaving the media potentially reusable. Destroy renders recovery infeasible even with state-of-the-art laboratory techniques, and the media can no longer store data afterward. The publication says purge should be used instead of clear when possible.

For a modern laptop with full-disk encryption, cryptographic erase is a purge technique: you destroy the keys, and the encrypted data becomes unreadable. NIST attaches two conditions. Sensitive data must never have been stored on the drive in plaintext, and the technique should not be trusted where keys were backed up or escrowed unless you understand where those copies live. If encryption was turned on after the laptop was already in use, or recovery keys sit in a directory you do not control, choose a different purge technique or physical destruction.

NIST also separates verification (did the technique complete?) from validation (was the target data actually sanitized?). A rejected validation means repeating the process with a different or stronger method.

How do you wipe a copier hard drive before a lease return?

Have the dealer or a qualified technician overwrite or remove the copier's internal hard drive before the machine leaves your office, and get written confirmation for that serial number. Many digital copiers and multifunction printers store images of scanned, copied and faxed pages on that drive, and the images go with the machine unless someone handles the drive first.

The FTC's copier data security guide gives practical steps that map well to a Reg S-P procedure. Check with the manufacturer, dealer or servicing company for options on securing the drive. Write into the lease or purchase agreement that the firm keeps the drive at end of life or that the provider will overwrite it. Work with skilled technicians rather than pulling the drive yourself, since copier drives often hold firmware the machine needs. The guide also notes that deleting files or reformatting the drive does not remove the underlying data.

If the dealer or a destruction company handles the drive, that vendor is part of your disposal process. The FTC's Disposal Rule under FACTA, at 16 CFR 682.3, gives a useful model: after due diligence, a firm may contract with a record destruction company and then monitor its compliance. Due diligence there can include reviewing audits, checking references and evaluating the company's security policies. A vendor that handles drives holding customer information is also likely a service provider under the amended Reg S-P, so check that its contract meets the service provider notice requirements.

How should firm phones and tablets be wiped before disposal?

Wipe firm phones and tablets as storage media, since NIST lists phones and mobile computing devices among the media that need sanitization. They can hold both on-board memory and removable memory, so each component may need its own approach.

For a managed smartphone, a remote or local wipe through your device management platform, followed by a factory reset and removal of the device from the management console, is the usual starting point. Remove and separately handle any memory card. Confirm the device is no longer tied to a firm account before it is handed back, traded in or recycled. For staff who used personal phones under a bring-your-own-device policy, the disposal step is a selective wipe of firm data at departure, and the record should show it happened.

Does a certificate of destruction satisfy the rule?

No single document satisfies the rule on its own, and 17 CFR 248.30(b) never mentions a certificate of destruction. A per-device certificate is still the strongest evidence that a specific device was handled under your written procedure. The rule requires reasonable measures and written policies, and the 2024 amendments require records documenting compliance. A certificate that ties a specific serial number to a specific method is the simplest way to meet that recordkeeping duty for a single device.

NIST SP 800-88 Rev. 2 lists the fields a certificate of sanitization should carry. A certificate that includes them will answer most examiner follow-up questions:

• Manufacturer, model and serial number, plus your asset tag if you use one
• Media type and media source (for example, the laptop the drive came from)
• Sanitization method (clear, purge or destroy) and the specific technique, such as cryptographic erase or physical shredding
• The tool used, including its version
• The verification method
• Name, title, date, location, contact information and signature of the person who performed and verified the work

A bulk recycler receipt that says "40 lbs of electronics" does not tie a device to a method. Ask your vendor for per-device certificates before you sign the contract, since that is when you have leverage.

Do California rules add anything?

Yes, for firms with California clients. California Civil Code section 1798.81 requires businesses to take all reasonable steps to dispose of customer records containing personal information by shredding, erasing or otherwise modifying the information to make it unreadable or undecipherable. A procedure built to the Reg S-P standard and NIST methods will generally cover the same ground, and it is worth confirming the scope with counsel.

What should you do this quarter?

Start with the procedure and the inventory, then fix the vendor terms. A short list for a compliance officer or COO:

• Pull your written disposal procedure (your data disposal policy) and confirm it names customer information, covers every device type above and paper files, and says who approves a device leaving the firm.
• Reconcile your asset inventory with what is physically in the office, in storage closets and with former employees.
• Read your copier lease for end-of-term drive handling. If it is silent, ask the dealer for written terms before the next return.
• Confirm full-disk encryption has been on since deployment for every laptop you plan to retire with cryptographic erase, and that you know where recovery keys are stored.
• Require per-device certificates with the NIST fields from any recycler or destruction vendor, and keep them with your Reg S-P compliance records.
• Add disposal to your annual Reg S-P review so the procedure, the records and the vendor list are tested together.

How does s90 help?

s90 works with RIAs, broker-dealers and dual-registered firms in Los Angeles and Orange County to turn Reg S-P requirements into procedures that leave a record. For disposal, that means tracking each device from deployment to retirement, sanitizing it to a documented NIST method, and keeping the certificates where your compliance team can find them when an examiner asks. If you want a second look at your disposal procedure, we are happy to review it with you.