The FTC Safeguards Rule for car dealers, in plain English.

Who it covers

The FTC Safeguards Rule (16 CFR Part 314) applies to businesses under the FTC's jurisdiction that handle consumers' financial information, and that includes auto dealers that arrange financing or leasing: franchise stores, independent lots and buy-here-pay-here dealers alike. The rule was overhauled in 2021, most of its specific requirements took effect on June 9, 2023, and a breach-reporting requirement was added on May 13, 2024.

Insurance agencies and banks are regulated by other agencies, so this article is about dealers and other non-bank financial businesses.

What it requires

The rule asks for a real, written information security program built from nine elements:

• A Qualified Individual who runs the program. It can be an outside provider, but the dealership stays responsible and names a senior person to oversee them.
• A risk assessment of what customer information you hold, where it lives and what could go wrong.
• Safeguards: access limited to who needs it, an inventory of systems and data, encryption of customer information, multi-factor sign-in for anyone who reaches customer information, secure disposal of old records, change management, and logging.
• Monitoring and testing: continuous monitoring, or a yearly penetration test plus vulnerability scans every six months.
• Staff training in security awareness.
• Oversight of service providers such as your DMS, CRM and F&I software vendors.
• Keeping the program current as the business changes.
• A written incident response plan.
• A yearly written report from the Qualified Individual to ownership.

Since 2024 there's one more: if unencrypted information about 500 or more customers is acquired without authorization, you must notify the FTC within 30 days of discovering it.

The small-business exemption

If you hold information on fewer than 5,000 consumers, four items don't apply: the written risk assessment, the continuous-monitoring-or-testing requirement, the written incident response plan and the yearly written report. Everything else still does, including the written program, a Qualified Individual, multi-factor sign-in, encryption, access controls, training and vendor oversight. Most established dealerships are over 5,000 once you count past customers and credit applications.

How it's actually enforced

You'll often see "$53,000 per violation" quoted. Here's the accurate picture: the FTC enforces the rule through investigations that typically end in a consent order lasting 20 years, with outside security assessments and reporting. Civil penalties of about $53,000 per violation apply when a business violates that order. Texas law adds its own breach-notice deadlines: affected people within 60 days, and the Attorney General within 30 days when 250 or more Texans are affected.

In practice, the pressure often comes from partners first: lenders, manufacturers and cyber insurers increasingly ask dealers to show a program exists.

A first-week checklist for a dealership

• Name the person responsible (or the provider who'll act as your Qualified Individual).
• Turn on multi-factor sign-in for email, your DMS, your CRM and any lender portals.
• List where customer data lives: the DMS, credit applications, scanned licenses, deal jackets, email inboxes and shared drives.
• End shared logins. Everyone gets their own account, and access is removed the day someone leaves.
• Encrypt every laptop and confirm your vendors protect the data they hold for you.
• Write down who does what if customer data is exposed, including the 30-day FTC notice.

How Golden Rock helps

We start with a free readiness check that shows what's in place and what's missing. Then we build the written program, set up multi-factor sign-in and encryption, and stay on as your Qualified Individual for a flat monthly fee: setup typically $1,500 to $7,000 by size, then $1,200 to $4,000 a month. See the FTC Safeguards service or tell us about your dealership.

This article is general information, not legal advice.