LexLint

Know the law where your app runs.

Law / United States / Alaska

Alaska Personal Information Protection Act, disposal of records duty

Alaska Stat. Secs. 45.48.500-45.48.590

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

In force since 1 July 2009.

A security baseline statutes rule binding public and private bodies.

As of 16 September 2026.

What it requires

  • This binds any business or governmental agency that disposes of records containing personal information on an Alaska resident; a business already complying with the Gramm-Leach-Bliley Act's disposal rule or the Fair Credit Reporting Act's disposal rule, 15 U.S.C. 1681w, is exempt, as is disposal that federal law requires to be done in a manner this duty does not permit.
  • When disposing of records containing personal information, take all reasonable measures necessary to protect against unauthorized access to or use of the records, including burning, pulverizing, or shredding paper documents and destroying or erasing electronic and nonpaper media so the personal information cannot practicably be read or reconstructed.
  • Adopt written policies and procedures relating to the adequate destruction and proper disposal of records containing personal information.
  • Before contracting with a third party to destroy records, complete due diligence, such as reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.
  • A knowing violation draws a civil penalty of up to $3,000 payable to the state, and a person damaged by a violation may separately sue to enjoin further violations and recover actual economic damages, court costs, and full reasonable attorney fees.

If you get it wrong

Criminal exposureNo

Private right of actionYes

Penalty structure

Civil penalty under AS 45.48.550(a), payable to the state, for a knowing violation of AS 45.48.500-45.48.590; the statute states no per-resident multiplier the way the Act's own breach-notification penalty at AS 45.48.080 does. A person damaged by a violation may separately bring a civil action under AS 45.48.560 to enjoin further violations and recover actual economic damages, court costs allowed by the rules of court, and full reasonable attorney fees, which carries no fixed cap of its own.

Rule
Fixed only
As of
16 September 2026
Currency
USD
Fixed cap
3,000

Who enforces it

Enforcement body

AS 45.48.500-590 names no dedicated enforcement agency. A knowing violation is liable to the state for a civil penalty not to exceed $3,000 under AS 45.48.550, and an individual damaged by a violation may separately bring a civil action under AS 45.48.560.

What it reaches

Obligation class

Security

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

A business and a governmental agency that disposes of records containing personal information on an Alaska resident must take all reasonable measures necessary to protect against unauthorized access to or use of the records. The business or governmental agency must also adopt written policies and procedures relating to the adequate destruction and proper disposal of those records.

Permitted measures include burning, pulverizing, or shredding paper documents, and destroying or erasing electronic and nonpaper media, so that the personal information cannot practicably be read or reconstructed.

Where a business or governmental agency instead contracts with a third party engaged in the business of record destruction, it must first complete due diligence, ordinarily reviewing an independent audit of the third party's operations, checking references or trade-association certification, or reviewing the third party's own information security policies and procedures.

It is not liable for the disposal once it has relinquished control of the records to that third party or to the individual to whom the records pertain.

A business is exempt if it is subject to and complying with the Gramm-Leach-Bliley Financial Modernization Act, or if the manner of its disposal is subject to and complies with the Fair Credit Reporting Act's disposal rule, 15 U.S.C. 1681w. A business or governmental agency is also exempt to the extent federal law requires a manner of disposal the Alaska duty does not permit. A knowing violation is liable to the state for a civil penalty not to exceed $3,000.

Separately, an individual damaged by a violation may bring a civil action to enjoin further violations and recover actual economic damages, court costs, and full reasonable attorney fees. This duty is distinct from the Act's breach-notification duty, AS 45.48.010 to 45.48.070, which is this jurisdiction's privacy-topic row.

When LexLint raises it

  • crawls_web
  • trains_models
  • deploys_chatbot
  • automated_outreach
  • high_risk_decisions
  • processes_voice
  • processes_biometrics
  • serves_minors
  • operates_social_platform
  • ships_mobile_app
  • distributes_software_product

Read the law

official Alaska Statutes text, Alaska State Legislature

Back to the example  ·  Lint your app