The FTC Safeguards Rule: What Financial Firms and Auto Dealers Need

If your business arranges financing, prepares taxes or gives financial advice, there is a good chance a federal data security rule applies to you, even if you have never thought of yourself as a “financial institution.” It is called the FTC Safeguards Rule, and it covers far more businesses than most owners expect, including most auto dealerships.

This is a plain-language overview, not legal advice. Check with your attorney or compliance advisor about how the rule applies to your business.

Who the rule covers

The Safeguards Rule applies to financial institutions under the FTC’s jurisdiction. The FTC’s own examples include:

• Mortgage lenders and mortgage brokers
• Finance companies and payday lenders
• Tax preparation firms
• Credit counselors and other financial advisors
• Investment advisors that are not required to register with the SEC
• Collection agencies, check cashers and wire transfer businesses

It also reaches the showroom. According to the FTC’s guidance for auto dealers, most dealers who finance vehicles, help arrange financing, or lease vehicles for longer than 90 days are covered. Banks and other firms that answer to a different federal regulator follow that regulator’s rules instead.

What you need to have in place

The core requirement is a written information security program that fits the size of your business. The rule spells out what goes in it:

1. A qualified individual in charge. This can be an employee or an outside provider, but the business stays responsible.
2. A written risk assessment. What customer information you hold, where it lives, and what could go wrong.
3. Specific safeguards. Access controls that are reviewed regularly, an inventory of your data and systems, encryption of customer information at rest and in transit, multi-factor authentication for anyone who can reach customer information, secure disposal of old records, and logging of user activity.
4. Regular testing. Either continuous monitoring, or a penetration test every year plus vulnerability scans every six months.
5. Staff training. Security awareness training for everyone, with refreshers.
6. Vendor oversight. Choose service providers that can protect your data, put security expectations in the contract, and check on them periodically.
7. A written incident response plan. Who does what, and who gets called, when something goes wrong.
8. A yearly report. The qualified individual reports in writing to the board or a senior leader at least once a year.

Businesses that keep information on fewer than 5,000 consumers are exempt from some of these requirements, but not from the rule itself.

The breach reporting requirement

Since May 2024, if unencrypted information about 500 or more consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after you discover it. Encrypted data counts too if the encryption key was also taken.

What this means for dealerships

The finance office collects some of the most sensitive information a business can hold: credit applications, Social Security numbers, driver’s licenses and bank details. The weak spots tend to be ordinary ones. Scanned licenses sitting in email. Deal paperwork on a shared drive. Former employees whose dealer management system logins still work. Vendors with remote access nobody has reviewed in years.

In June 2024, a cyberattack on a widely used dealership software provider forced dealerships across the country back to pen and paper for days. It was a reminder that vendor oversight and an incident response plan are not just paperwork. More on how we support dealers is on our automotive IT page.

What this means for financial firms

Tax preparers, advisors and lenders hold tax returns, account numbers and identity documents, often shared through email and client portals, and often accessed by remote or seasonal staff. The rule expects multi-factor authentication on all of it, encryption wherever that data is stored or sent, and a clear list of who has access. See how we work with financial services and insurance firms.

Where to start

• Name your qualified individual.
• Turn on multi-factor authentication for email, remote access and every system that holds customer information.
• Encrypt laptops, servers and backups.
• List where customer information lives and who can reach it. Remove old accounts.
• Schedule your vulnerability scans and penetration test.
• Write your incident response plan and keep a printed copy.
• Review your vendor contracts for security terms.

Most of this is the same groundwork that good cybersecurity and compliance management already call for. The rule adds the requirement to write it down and keep it current.

Common questions