01
State Data Destruction Laws Create Organization-Specific Obligations
Unlike Canada's federal PIPEDA framework, the United States has no single federal data destruction mandate for private organizations outside regulated industries. Instead, more than 35 states have enacted data breach notification and data destruction requirements. California's CCPA, New York's SHIELD Act, and Texas's Identity Theft Enforcement and Protection Act each impose specific obligations on how organizations must handle end-of-life devices containing personal information. The documentation standard required to demonstrate compliance varies by state and by the nature of the data involved.