Business Relocation · Nationwide · Updated August 2026
Your data-protection checklist for a commercial move
A commercial move puts every file, drive and password your business owns into hallways, trucks and dumpsters. Here is the working checklist for protecting sensitive information during commercial moves, from inventory to secure disposal.
By Michael McGovern, Founder | 25+ Years in Commercial LendingCommercial Mortgage Connection · Yonkers, NY The short answer
Protecting sensitive information during commercial moves comes down to three disciplines: inventory what you hold before anything is packed, keep a named chain of custody on every sensitive container during the move, and destroy what you no longer need instead of paying to relocate it.
And stated plainly up front: Commercial Mortgage Connection is a commercial mortgage brokerage, not a security or moving company. This is the checklist we walk relocating borrowers through; for regulated data such as health or cardholder records, bring in a compliance professional.
- Before the move: data inventory, scan the critical set, shred what the retention rules let you shred.
- During the move: sealed, numbered containers, one named custodian per step, highest-risk items in your own vehicle.
- After the move: reconcile every container against the log, sanitize or destroy old devices, update access.
- Related read: our guide to managing debt during a move covers the financing side of the same relocation.
Guidance on protecting sensitive information during commercial moves checked against FTC, NIST and IRS sources on 31 August 2026. Data-breach and disposal rules vary by state and industry.
What this page covers
- Start with a data inventory
- Chain of custody during the move
- Devices: deleting is not destroying
- What to shred before the truck arrives
- What you must keep, and for how long
- When this is beyond do-it-yourself
- Where this meets your financing
- Does this apply in your state?
- Protecting sensitive information during commercial moves: FAQ
Start with a data inventory, not with boxes
The Federal Trade Commission's data security guide for businesses is built on 5 principles, and the first one is the one moves skip: take stock. You cannot protect what you have not listed, and protecting sensitive information during commercial moves begins with that list.
Before anything is packed, walk every cabinet, drive and cloud account and list where sensitive information actually lives. In most businesses it hides in more places than anyone expects: HR files, old payroll binders, signed lease agreements, customer applications, backup drives in desk drawers, and the fileserver nobody has opened since the last office.
When protecting sensitive information during commercial moves, sensitive means anything that could identify or harm a person or expose the business: Social Security numbers, bank account details, payroll records, customer financial applications, medical information, contracts, and your own loan and tax files. The inventory does double duty: it becomes your packing manifest for the move and your reconciliation list after it. That single list drives everything else in protecting sensitive information during commercial moves.
Chain of custody during the move: 5 rules
A move is the one week when your records leave locked rooms and travel through hallways, loading docks and trucks. The fix is a written chain of custody, the backbone of protecting sensitive information during commercial moves, and it has 5 rules:
1. Seal and number. Sensitive files travel in sealed, numbered containers, never open boxes.
2. One named custodian per step. Every sensitive container has a person responsible for it at packing, in transit, and at receiving. A role is not a name; write the name.
3. Log every handoff. Who sealed it, who loaded it, who opened it.
4. Highest-risk items ride with you. Servers, backup drives and the most sensitive files go in a locked vehicle driven by your own people, not in the general moving stream.
5. Reconcile on arrival. Check every numbered container against the log the same day it arrives. A missing box discovered in week three is a much bigger problem than one discovered in hour three. The same-day check is what makes protecting sensitive information during commercial moves verifiable rather than assumed.
| Item | The risk in transit | How to secure it |
|---|---|---|
| HR and payroll files | Social Security numbers and bank details in open boxes | Sealed numbered containers, named custodian |
| Customer records and applications | Breach-notification exposure if lost | Move under your own custody, never with general freight |
| Servers, laptops, backup drives | One lost drive can hold every record you have | Locked vehicle, your own driver, inventory by serial number |
| Contracts, leases, loan files | Expensive to replace, needed for financing | Scan the critical set before loading, then sealed containers |
| Keys, badges, passwords on paper | Physical access to the old and new space | Collect and reissue; never pack them with furniture |
Devices: deleting is not destroying
Moves are when old computers, copiers and drives finally get retired, and device disposal is where protecting sensitive information during commercial moves most often fails. Emptying the recycle bin or reformatting does not remove data from a drive; ordinary recovery tools can bring it back.
The federal reference here is NIST Special Publication 800-88 Rev. 2, the media sanitization guideline updated in September 2025, which defines 3 levels: clear (overwrite so ordinary recovery fails), purge (make laboratory recovery infeasible), and destroy (shred, disintegrate or pulverize the media itself).
Practical version for protecting sensitive information during commercial moves: any device leaving your control gets purged or destroyed, not just deleted. That includes the easy one to forget: office copiers and printers, most of which contain hard drives that store images of what they scanned. If a leased copier is going back to the vendor during the move, ask in writing how its drive will be sanitized. Overlooked drives are the most common gap in protecting sensitive information during commercial moves.
What to shred before the truck arrives
Every file you shred before the move is a file you do not pay to transport and cannot lose in transit, which makes disposal the cheapest part of protecting sensitive information during commercial moves.
Disposal is regulated: the FTC's Disposal Rule requires businesses that use consumer report information to take reasonable measures when discarding it, such as burning, pulverizing or shredding paper so it cannot be read or reconstructed, and destroying or erasing electronic media. Tossing intact files in a moving-day dumpster is exactly what the rule exists to prevent.
| Media | Wrong way | Right way |
|---|---|---|
| Paper files | Dumpster, recycling bin, intact | Cross-cut shredding, or a certified shredding vendor with a certificate of destruction |
| Hard drives and SSDs | Deleting files, quick reformat | NIST purge-level wipe, or physical destruction |
| Copiers and printers | Returning to vendor as-is | Written confirmation of drive sanitization |
| Phones and tablets | Factory reset only on old devices | Encrypted device plus factory reset, then remove from account access |
| Cloud access | Leaving old logins active after the move | Revoke old-office credentials, rotate shared passwords |
If you use an outside shredding company, ask for a certificate of destruction and keep it with your move records. It is the paper trail that shows you disposed of records properly if anyone ever asks. A certificate of destruction closes the disposal loop in protecting sensitive information during commercial moves.
What you must keep, and for how long
Shredding has a limit: protecting sensitive information during commercial moves also means keeping the records you are required by law to keep. The IRS's small-business recordkeeping guidance says employment tax records should be kept for at least 4 years, and records supporting income and deductions generally for at least 3 years, longer in specific situations.
Loan documents, leases and anything tied to property basis should be kept for as long as they matter to a return or an asset, plus the limitation period.
The practical move-week rule: when in doubt, do not shred; scan and keep. Digitizing the keep-pile before the move gives you a backup if a container is lost, and it is exactly the set of records your next financing application will ask for: tax returns, financial statements, rent rolls and existing loan documents. Our guide on how a business plan strengthens a commercial mortgage application shows how those same records get used. Retention is the quieter half of protecting sensitive information during commercial moves: what you keep matters as much as what you shred.
When this is beyond do-it-yourself: three honest cases
You handle regulated data. If your files include health records, cardholder data or anything under industry-specific privacy law, this checklist is not enough. Bring in a compliance professional before the move; the penalty regimes are their specialty, not a moving checklist's, and not ours.
The move is large. Past a certain scale, bonded commercial movers with documented procedures beat any staff-run move. Vet them on protecting sensitive information during commercial moves: ask how they handle sealed containers, whether their staff are background-checked, and what their loss process is. Then still keep the sensitive set in your own custody.
You are reading this on a mortgage brokerage's website. Fair question: why is it here? Because relocations are where financing and paperwork collide, and Commercial Mortgage Connection is paid when loans close, not when moves go well. This page exists because relocating borrowers ask us, and the honest scope is: we can protect the financing side of your move; a security consultant protects the rest. Knowing where that line sits is itself part of protecting sensitive information during commercial moves.
Where this meets your financing
A commercial move usually means a property decision: a new lease, a purchase, or an expansion. That is the part Commercial Mortgage Connection actually does. CMC is a commercial mortgage brokerage headquartered in Yonkers, NY, working a 750+ lender network with 500K+ loan programs across all 50 states, with more than $1 billion originated, every engagement led personally by founder Michael McGovern, and a loan review response within 4 hours.
The connection between protecting sensitive information during commercial moves and your next loan file is direct: the records you protect during the move, tax filings, financial statements, rent rolls and loan files, are the same records that get your next property financed. Borrowers who arrive with a clean, complete document set move through the commercial financing process faster than borrowers reconstructing lost files. Good habits in protecting sensitive information during commercial moves protect your financing timeline too.
If the move is part of growth, our guide on using commercial mortgages to expand your business covers the financing routes, and the loan calculator gives you indicative numbers before any lender does. If the deal is an unusual one, or a lender has already said no, our guide on what to do after a commercial mortgage denial covers the harder scenarios.
Two questions
What is the most sensitive data in your files?
Who is handling the physical move?
Does this apply in your state?
Commercial Mortgage Connection is headquartered in Yonkers, NY and works with relocating businesses through its 750+ lender network in all 50 states. The custody and disposal practices on this page apply to protecting sensitive information during commercial moves anywhere in the country.
The legal details are not uniform: all 50 states have data breach notification laws, and their definitions, deadlines and penalties differ, as do industry rules layered on top. Commercial lending itself is also regulated federally and at the state level, so confirm the specifics for the states you are moving from and to before the trucks roll. State rules change the details, not the discipline, of protecting sensitive information during commercial moves.
Protecting sensitive information during commercial moves: FAQ
What counts as sensitive information during a commercial move?
Anything that could identify or harm a person or expose the business: Social Security numbers, payroll and HR files, customer financial applications, medical information, contracts and leases, passwords and access badges, and your own tax and loan records. Devices count too, because servers, laptops, backup drives, and even copier hard drives carry the same data in electronic form.
Should I move sensitive records myself or let the movers handle them?
Seal and number sensitive containers yourself, keep the custody log yourself, and carry the highest-risk items, such as servers, backup drives and the most sensitive files, in your own locked vehicle. Professional movers are the right choice for scale and furniture, but they should never be the custodians of your sensitive data, and a reputable mover will not object to that split. That split of duties is standard practice for protecting sensitive information during commercial moves.
How do I dispose of old business documents before a move?
Cross-cut shred paper records, or use a certified shredding vendor and keep the certificate of destruction. The FTC's Disposal Rule requires businesses discarding consumer report information to make it unreadable and unreconstructable, so intact files in a moving-day dumpster are a compliance problem as well as a security one. Check retention rules first; some records must be kept. Done in that order, disposal supports protecting sensitive information during commercial moves instead of undermining it.
Is deleting files enough before recycling office computers?
No. Deleting files or reformatting a drive leaves the data recoverable with ordinary tools. NIST SP 800-88 Rev. 2, the federal media sanitization guideline, defines the standards: clear, purge or destroy. For any device leaving your control during a move, use a purge-level wipe or physically destroy the drive, and remember that copiers and printers usually contain hard drives too.
How long should I keep financial records after a move?
Follow the IRS recordkeeping guidance: employment tax records at least 4 years, records supporting income and deductions generally at least 3 years, and property and loan documents for as long as they affect a return or an asset. When in doubt during a move, scan and keep rather than shred; those same records are what your next financing application will require. Keeping them secure is part of protecting sensitive information during commercial moves, not separate from it.
Sources
- FTC, Protecting Personal Information: A Guide for Business. Checked 31 August 2026.
- FTC, Disposing of Consumer Report Information? Rule Tells How. Checked 31 August 2026.
- NIST Special Publication 800-88 Rev. 2, Guidelines for Media Sanitization. Checked 31 August 2026.
- IRS, How Long Should I Keep Records? Checked 31 August 2026.
Michael McGovernFounder, Commercial Mortgage Connection. Michael wrote this guide on protecting sensitive information during commercial moves from what CMC walks relocating borrowers through, drawing on a career that began at Bear Stearns & Co. in 1997 and spans more than $1 billion in originated mortgages.
Moving the business? Sort the financing before the boxes.
If the relocation involves a purchase, a refinance or an expansion, a senior banker reviews your file with a response within 4 hours, across all 50 states. Call 888-656-9812, live operator 24/7.
Guidance on this page was checked against the cited FTC, NIST and IRS sources on 31 August 2026. It is general information, not legal, compliance or security advice; data protection, breach notification and record retention requirements vary by state and industry, so confirm your obligations with a qualified professional.
Nothing on this page is a loan offer or personalized financial advice; all financing is subject to lender approval, credit review and property underwriting, and no approval is guaranteed. Commercial Mortgage Connection is a commercial mortgage brokerage, is paid when loans close, and sells the financing service described on this page. Equal Housing Opportunity. Call 888-656-9812 to discuss your scenario.
