FTC Safeguards checklist for car dealers, with the deadlines.

Start here: are you covered?

Yes, if you finance cars or help customers get financing. In its June 2025 FAQ for auto dealers, the FTC says dealers that finance, or facilitate the financing of, vehicles for consumers are financial institutions under the rule, and dealers that lease for longer than 90 days are covered for their leasing business. The FAQ's examples of customer information include the financing and leasing applications you approve, whether they're on paper or in your DMS.

This checklist turns the rule into tasks. For what the rule requires and why, read the FTC Safeguards Rule for car dealers, in plain English.

This week: people and sign-ins

• Name your Qualified Individual in writing. An employee or an outside provider. With a provider, the dealership stays responsible and a senior manager oversees them.
• Turn on multi-factor sign-in for everyone who reaches customer information: email, the DMS, the CRM, lender and credit portals, and remote access. The rule requires it for anyone who accesses your information systems, and that includes vendors who sign in to them.
• End shared logins. Every salesperson, F&I manager and office employee gets their own account.
• Remove access the day someone leaves, and review who can reach each system today.
• Lock up paper. The FTC's FAQ gives locked file cabinets for paper records as an example of a physical safeguard. Deal jackets and credit applications count.

This month: find the data and lock it down

• Make a data map. List every place customer information lives: the DMS, the CRM, credit applications, scanned licenses, deal jackets, email inboxes, shared drives, phones, backups, and copiers or scanners that store images.
• Encrypt it on laptops, desktops, servers and backups, and whenever it travels outside your network. Where encryption isn't feasible, your Qualified Individual must approve another control.
• Separate your networks. The FTC's FAQ notes that when customer information is on a network, the other systems connected to that network need protecting too. Keep guest Wi-Fi and customer-lounge computers off the network your DMS uses.
• List your vendors: DMS, CRM, F&I and e-contracting tools, credit bureaus, your IT company and your shredding company. Check that each contract requires them to protect your customers' data, and note when you'll review them.
• Write the risk assessment: for each place on your data map, what could go wrong, how likely and how bad it is, and what you'll do about it.
• Set a disposal schedule. Shred or wipe customer information no later than two years after you last used it to serve the customer, unless a law or a real business need says to keep it.
• Turn on logging and change control: sign-in alerts on email and the DMS, and a record of who changes what in your systems.

Write it down: the records to keep

If it isn't written down, you can't show it to a lender, an insurer or the FTC. Keep these together in one place:

• The written information security program, naming your Qualified Individual
• The data map, the risk assessment and the list of who can access what
• Vendor list, contracts and review notes
• Training dates and who attended
• Test and scan reports
• The incident response plan
• Each year's written report from the Qualified Individual
• Disposal records, such as shredding certificates and wiped-drive logs

The calendar: what’s due when

• Every six months: vulnerability scans of your systems, unless you have continuous monitoring, and again after any material change.
• Every year: a penetration test (again, unless you have continuous monitoring), and a written report from your Qualified Individual to the owner or board.
• Regularly: security-awareness training kept up to date with your risks. Once a year is a sensible minimum.
• Periodically: repeat the risk assessment, review your vendors, and review how long you keep records.
• Whenever something changes (a new DMS, a new store, a new vendor, a security incident): update the program.

Dealers with information on fewer than 5,000 consumers are exempt from four items: the formal written-risk-assessment requirements, the testing schedule, the written incident response plan and the yearly report. Count every consumer whose information you keep, past customers included, before you skip anything.

If customer data is exposed

• Follow your incident response plan, and bring in your IT provider and your insurer.
• The FTC: if unencrypted information about 500 or more consumers was acquired without authorization, notify the FTC as soon as possible and no later than 30 days after discovery, using its online form. The clock starts on the first day anyone at the dealership, other than the person who caused the breach, knows about it, and the FTC presumes data was acquired unless you have reliable evidence it wasn't.
• Texas: notify affected people within 60 days, and the Texas Attorney General within 30 days, through its online form, when 250 or more Texans are affected.
• Your partners: check what your lender, manufacturer and vendor agreements require you to report.

Want help with it?

Start with our free readiness check: a short questionnaire and a look at your public setup, then a plain two-page summary of where you stand and what's missing. If you want it handled, we build the program and stay on as your Qualified Individual for a flat monthly fee: setup typically $1,500 to $7,000 by size, then $1,200 to $4,000 a month. You stay responsible under the rule and name a senior person to oversee us. Get the free readiness check or see the FTC Safeguards service.

Prefer to work through the checklist yourself? Safeguards Tracker lists every requirement with due dates, a place for your proof and a weekly reminder email, for $49 a month after a 14-day free trial.

Quick answers

Where does this checklist come from? From the rule itself (16 CFR 314.4) and the FTC's June 2025 FAQ for auto dealers. It turns the requirements into tasks; the rule's text is what counts.

How often does a dealership need penetration tests and vulnerability scans? Unless you have continuous monitoring, the rule requires a penetration test every year and vulnerability assessments at least every six months, plus after material changes to your systems or business.

When must a dealership report a data breach to the FTC? When unencrypted information about 500 or more consumers is acquired without authorization. Notify the FTC as soon as possible and no later than 30 days after discovery, using the FTC's online form. Texas adds its own deadlines for notifying affected people and the Attorney General.

Do small dealerships get an exemption? Partly. With information on fewer than 5,000 consumers, you don't need the formal written risk assessment, the testing schedule, the written incident response plan or the yearly report. The written program, a Qualified Individual, multi-factor sign-in, encryption and the rest still apply.

Sources

• FTC Safeguards Rule, 16 CFR Part 314 (sections 314.2, 314.4 and 314.6)
• FTC: Automobile dealers and the Safeguards Rule, frequently asked questions (June 2025)
• FTC: Safeguards Rule, what your business needs to know
• Texas Business and Commerce Code, chapter 521 (section 521.053)

This article is general information, not legal advice.