By January 1, 2007, companies must use “reasonable measures” to ensure proper destruction of records containing “personal information” of employees, clients, customers, and others. Act 136 also requires the business to draft an official written policy regarding its records destruction. Another law effective July 1, 2007 (Act 137) requires businesses to follow specific guidelines in using or transmitting information containing social security numbers.