Get a clear, actionable overview of Washington’s current data destruction, digital privacy, and e-waste laws for 2025. Explore how the My Health My Data Act, state breach reporting, and robust e-waste mandates impact every step of handling end-of-life IT assets and hard drives, and what your organization must do to remain fully compliant and defensible.

Washington’s Data Privacy and Security Landscape

Washington does not have a comprehensive state privacy law in effect as of 2025. Instead, businesses face a patchwork of sector-specific rules and evolving obligations. Regulatory attention focuses on consumer health data, breach response, and e-waste management—each with distinct compliance triggers.

Digital Data Destruction and Hard Drive Disposal: Legal Triggers

If your organization collects, stores, or processes personal or regulated data—especially health data or financial information—Washington law demands robust, documented disposal practices. This includes digital data destruction, secure hard drive disposal, and defensible IT asset disposition (ITAD) procedures.

Key triggers for secure data destruction in Washington include:

Consumer health data under the My Health My Data Act (MHMD)
Personal information subject to breach notification
Covered electronic products banned from landfill disposal

My Health My Data Act (MHMD)

Enacted: April 27, 2023
Codified: RCW 19.373
Effective for Non-Small Businesses: March 31, 2024
Effective for Small Businesses: June 30, 2024
No major 2025 amendments.

MHMD provides some of the strongest protections for health-related consumer data in the U.S. It:

Applies to any business handling consumer health data of Washington residents, including non-medical data inferred from device/app usage or location.
Requires:
- Affirmative consent for collection, sharing, or sale.
- Separate, published health data privacy policies.
- Security measures to protect all consumer health data.
- Valid authorization for any health data sales.
Empowers consumers to access, delete, or withdraw consent for their health data, pushing organizations to have defensible, auditable destruction processes ready.
Enforcement is via the State Attorney General and private right of action, with severe penalties for mishandling.

Key compliance best practice: Implement NIST SP 800-88–aligned sanitization and documented hard drive destruction processes whenever deleting or disposing of health-related data. Learn more about NIST SP 800-88.

Data Breach Notification Law (RCW 19.255, RCW 42.56.590)

Any entity that suffers a data breach exposing personal information of Washington residents—including combinations of name with Social Security number, driver’s license number, or financial account data—must:

Notify affected residents without unreasonable delay.
Report breaches affecting over 500 residents to the Attorney General within 30 days.
Maintain reasonable security procedures to prevent unauthorized access.

Reasonable security includes employing robust data disposal, end-of-life wiping, and permanent hard drive destruction procedures for any unneeded or obsolete systems. Find WA data breach details.

Comprehensive Privacy Law Attempts in 2025

No broad state privacy framework—like the California Consumer Privacy Act (CCPA)—exists in Washington as of 2025. The latest bill, HB 1671 (“People’s Privacy Act”), would have limited data collection, banned sensitive data sales, and granted broad deletion rights, but it did not pass. Rights to deletion or correction remain sector-specific—not general consumer rights.

Your organization must still address health data, breach, and e-waste triggers for compliance.

E-Waste and Electronics Recycling Compliance

E-Cycle Washington (RCW 70A.500)

Since 2009, Washington law bans disposal of covered electronic products (CEPs) such as computers, laptops, monitors, TVs, tablets, and e-readers in landfills. Manufacturers must fund and operate free recycling programs (E-Cycle WA) for households, small businesses, schools, and nonprofits.

Key Compliance Points:

All CEPs must be returned via permitted collectors/processors following WAC 173-900 standards.
Proper data sanitization and certified hard drive destruction are required before recycling to prevent data remanence.

Find e-cycle info for businesses.

Right to Repair Act (Signed: May 19, 2025; Effective: Jan 1, 2026)

This law will require electronics manufacturers to provide parts, tools, and instructions for consumer repairs, promoting e-waste reduction through extended device lifespans.

Impact: IT asset managers should plan now for expanded device lifecycles and develop repeatable, compliant data destruction workflows for assets repaired, resold, or recycled. See official Right to Repair summary.

The Recycling Reform Act – NOT E-Waste

Washington’s 2025 Extended Producer Responsibility program applies to residential packaging—not electronics.

Best Practices for Secure Data Destruction in Washington

Hard Drive & Device Sanitization:

Always use destruction methods aligned with NIST SP 800-88:

Clear: (Software overwriting, least defensible for regulated data)
Purge: (Advanced overwriting, cryptographic erasure)
Destroy: (Physical shredding; required for hard drives/SSDs with regulated, sensitive, or health data)
Certificate of Destruction: Mandate detailed documentation—asset serials, method, witness, date—for audit defense.

Chain of Custody & Audit Trails:

Secure, serialized tracking and documented transfers are critical to proving regulatory compliance—especially under MHMD and breach rules.

E-Waste Vendor Certification:

Use only vendors with NAID AAA Certification and environmental certifications (R2v3) for electronics recycling.

Local Program Alignment:

If operating in King County, Seattle, or similar, verify local program alignment with state standards—but state laws set the minimum bar.

Why Choose Data Destruction, Inc. in Washington State

Data Destruction, Inc. delivers fully compliant, NIST-aligned data destruction and e-waste solutions for Washington clients:

Guaranteed Compliance: Services mapped to MHMD, breach laws, and E-Cycle WA requirements.
NIST SP 800-88 Process: Only proven, auditable data erasure and shredding methods—never obsolete techniques.
NAID AAA Certified: Documented, annually audited operations for maximum defense.
End-to-End Chain of Custody: From onsite shredding to full serialized tracking and environmental reporting.
Immediate, Expert Response: Local teams ready for urgent asset disposition, breach response, or regular ITAD.

Contact Data Destruction, Inc. for a risk-free assessment and certified end-of-life IT asset solutions in Washington:

Frequently Asked Questions

1. Does Washington have a comprehensive data privacy law like California?

No. As of 2025, Washington has no general consumer privacy law. Covered entities must still comply with sector laws like MHMD for health data and breach notification statutes.

2. What is required before recycling computers or hard drives in Washington?

All data must be permanently destroyed using methods such as physical shredding or NIST SP 800-88–aligned erasure before utilizing E-Cycle Washington or any permitted recycling program.

3. What is the My Health My Data Act (MHMD)?

MHMD is Washington’s health data privacy law safeguarding consumer health information—including app and location data. It mandates strict consent, security, the right to delete, breach response, and proper destruction practices.

4. How soon must I report a data breach in Washington?

Within 30 days to the Attorney General if over 500 residents are affected; residents must be notified without unreasonable delay. Failing to employ secure data destruction can increase breach risk.

5. Are hard drives and SSDs banned from Washington landfills?

Yes. Covered electronics (including hard drives, laptops, desktops, tablets) must be recycled compliance with E-Cycle Washington regulations—never landfill disposed.

6. Are there 2025 updates to Washington’s e-waste recycling law?

No major updates. E-Cycle Washington remains the framework. The Right to Repair Act (effective 2026) and EPR for packaging (not electronics) passed in 2025.

7. Is a certificate of destruction required?

While not specifically named in WA statutes, a detailed, auditable Certificate of Destruction is essential for HIPAA, MHMD, and breach compliance. It’s a best practice strongly recommended for legal and audit defense.

8. How does Right to Repair affect e-waste and data destruction?

The law will extend device lifespans, requiring IT asset managers to prepare for more repair and resale cycles—each requiring secure, verifiable data destruction.

9. How do I ensure my IT asset disposition process meets Washington requirements?

Partner with an NAID AAA–certified, NIST-aligned vendor who provides documented processes, serialized chain of custody, and compliance mapping for all regulated data and e-waste disposal.

10. Can local programs (Seattle, King County) override state e-waste laws?

No, but they may add supplemental rules. State statutes set the base compliance standards for all cities and counties.