There is a drawer in most church offices that nobody thinks about.
It holds background-check results. Every volunteer who has ever worked with children, going back as far as the church has been screening people. Some of them are printouts stapled at the corner. Some are in a folder on the shared drive called Screening. Most of them, if we’re honest, are still sitting in the office administrator’s email as PDF attachments, because that’s how the screening company delivered them and nobody ever moved them anywhere else.
You did the screening because you take child safety seriously. That was the right call, and your insurer and your denomination probably required it.
But the screening created something new: a small, concentrated archive of the most sensitive personal information your organization will ever touch, held by an office that was never set up to hold it.
This post is about what to do with that archive.
What’s actually inside one of those reports
A background check is not a yes-or-no answer. It’s a document, and the document is dense.
Depending on the provider and the level of check, it typically contains the person’s full legal name and any former names, date of birth, current and previous home addresses, and often all or part of a Social Security number — because that number is how the provider matches records to the right human being. Then it contains the results: county and state criminal records, sex offender registry checks, sometimes driving records, sometimes credit information.
That combination is unusual. Plenty of organizations hold names and addresses. Far fewer hold a name plus a date of birth plus a Social Security number plus a home address, all in one file, for dozens of people at once.
That specific combination is everything someone needs to open credit in another person’s name. It is, in practical terms, the highest-value data a small church holds — more valuable to a thief than your giving records.
And there’s a second harm on top of the financial one. These files may contain criminal history for volunteers your church screened, considered, and welcomed anyway. A leak doesn’t just expose an identity. It exposes something a person told you in confidence, about the hardest part of their life, in order to serve. Losing that is a pastoral failure as much as a technical one.
Where these files actually end up
None of the following is negligence. Every one of them is what happens when a small office handles a task it was given without being given a system.
In an inbox, forever. The screening company emails a PDF — a PDF is just a document file, and one that keeps its formatting and can be opened by anyone, with no protection unless someone deliberately adds it. It arrives, gets read, gets acted on, and stays in the mailbox. Five years later it’s still searchable by typing a volunteer’s last name, and if that mailbox is ever compromised, so is every report in it.
In a shared drive folder open to everyone. Cloud drives default to convenient, not restrictive. A folder created by one person is very often visible to every staff account, and sometimes to every volunteer who was ever added to the team drive.
In a filing cabinet in an unlocked office. The cabinet may lock. The question is whether it is locked at 4pm on a Thursday when the building is open for choir practice and a dozen people are walking past the door.
For people who left a decade ago. This is the most common one. Nobody ever decided to keep the file of a nursery volunteer who moved away in 2014. Nobody decided to delete it either. Absent a decision, records simply accumulate.
On a former administrator’s laptop. Someone downloaded the reports to work from home during a busy screening season. That laptop left with them.
The rule that fixes most of this
Here it is, and it’s simpler than any policy document:
Keep the decision. Don’t keep the report.
Your organization needs to be able to prove that a volunteer was screened, when, by whom, and that they were approved. That’s a single line in a roster: Name — screened 14 March 2026 — provider — cleared — approved by [name].
What your organization almost never needs is the underlying report sitting in your building. The screening company already has it. That’s their business, they’re built for it, and they carry insurance for it.
So the default should be: the provider holds the report; you hold the record of the decision.
Most screening platforms let you view results in their portal rather than emailing them out, and many will let you turn off attachment delivery entirely. Ask your provider two questions: Can results stay in your system instead of being emailed to us? and How long do you retain them, and can we retrieve them later if we need to?
If the answer to the first is yes, you have just removed the entire problem from your building.
Where you genuinely must keep something — because your insurer, your denomination, or your state’s volunteer rules require a copy — keep the smallest version that satisfies the requirement, and store it in one place, not four.
What the law expects, in general terms
Some real caution here: this is the shape of the rules, not advice about your situation. Requirements differ meaningfully by state, by whether you use a screening company, by the type of work the volunteer does, and by whether the person is an employee or a volunteer. Your attorney and your insurance carrier should confirm your policy before you adopt it.
With that said, three things are worth knowing.
Reports from a screening company are usually “consumer reports.” When you buy a background check from a third-party screening company, that report generally falls under the Fair Credit Reporting Act (FCRA) — the federal law governing how consumer reporting information is obtained, used, and disposed of. The FTC and EEOC’s joint guidance for employers walks through the obligations that come with it, including giving the person a clear written notice and getting written permission before you run the check, and giving them a copy of the report and a statement of their rights before you turn them down because of it.
There is a federal rule specifically about throwing these away. The FTC’s Disposal Rule (16 CFR Part 682) requires anyone who maintains or possesses consumer information for a business purpose to dispose of it “by taking reasonable measures to protect against unauthorized access to or use of the information in connection with its disposal.” The FTC’s own business guidance states plainly that “any business or individual who uses a consumer report for a business purpose is subject to the requirements of the Disposal Rule,” and names employers among them. Its examples of reasonable measures: “burn, pulverize, or shred papers,” and “destroy or erase electronic files or media” so the information “cannot be read or reconstructed.”
Retention floors exist and they’re shorter than you’d guess. The FTC/EEOC guidance points to the EEOC’s requirement that personnel and employment records be “preserved for one year after the records were made, or after a personnel action was taken, whichever comes later.” That is an employment rule, and whether it reaches your organization at all depends on your size, on whether the person is an employee or a volunteer, and on how the exemptions for religious employers apply to you. Other floors may apply too — from your state, your denomination, or your insurer. Ask. But notice the direction of the surprise: the legal floor is often low, and the reason churches keep these files for fifteen years is habit, not law.
Building a retention rule you’ll actually follow
A retention policy that lives in a binder is not a control. Keep it to five sentences someone can act on.
Name two people. Access to screening results is limited to two named individuals — typically the safeguarding lead and one other. Not “the office.” Not “staff.” Two people, by name, written down. Everyone else sees the roster line, not the report.
Pick one location. One folder, one cabinet, one portal. Multiple copies in multiple places is the actual failure mode, because you can clean up the one you remember and miss the three you don’t.
Write the period down. Something like: background-check results are retained for [X] years after the volunteer’s service ends, then destroyed, with X confirmed by your attorney and insurer. The number matters less than the fact that a number exists.
Put it on the calendar. A recurring annual reminder — “review screening files” — is what turns a policy into a practice. Without it, nothing is ever destroyed.
Write down what you’ll keep forever. Usually just the roster: who was screened, when, and that they were cleared. That’s the record that protects the church years later, and it contains no Social Security numbers at all.
Destroying them properly
Destruction is where good intentions quietly fail, because “delete” means less than people think.
On paper: cross-cut shred, or use a bonded destruction service that gives you a certificate. Do not put them in the recycling bin. Do not put them in the dumpster behind the fellowship hall.
In email: deleting the message is not enough. Empty the trash or deleted-items folder too, and remember that most mail systems keep a further recoverable copy for a period after that. Check whether your provider offers a permanent-delete option, and if attachments were forwarded to anyone, delete them from those mailboxes as well.
On a shared drive: delete the file, then empty the drive’s own trash, which usually runs on a separate timer from your email trash. Then check whether anyone downloaded a copy.
In backups: this is the one everyone forgets. Your backup exists precisely to make deletion reversible. A file removed today may sit in backups for months. You usually can’t and shouldn’t surgically remove it, and that’s fine — but you should know the rotation period, and note that the file isn’t fully gone until that period has passed.
On old hardware: a retiring laptop or copier can hold every report ever printed. Have drives wiped or destroyed before anything leaves the building.
What to do this week
Search your own mailbox for the name of your screening provider, and see how many reports come back. That number, whatever it is, is the honest starting point — and finding it takes about five minutes.
Then do one thing: call the provider and ask whether they can stop emailing results and let you view them in their portal instead. That single change stops the pile from growing while you decide what to do about the files you already have.
Sensitive records are one of several places churches carry more risk than they realise. MissionDefend’s free assessment asks plain-English questions about how your organization handles email, donations, member data, and accounts — including where sensitive records like these actually live — and returns a baseline score with a ranked list of what to fix first.
No spam and no sales calls — just one email when it’s live.
Related reading
- building a retention rule you will actually follow
- the care files that deserve the same restraint
- what exposure of a Social Security number triggers
MissionDefend provides cybersecurity readiness assessments and educational guidance for churches and nonprofits. It is not a penetration test, a security audit, legal advice, or an incident response service.
Sources: Federal Trade Commission and Equal Employment Opportunity Commission, Background Checks: What Employers Need to Know; Federal Trade Commission, Disposing of Consumer Report Information? Rule Tells How; Electronic Code of Federal Regulations, 16 CFR § 682.3 — Proper disposal of consumer information.
