Definition
The FTC Safeguards Rule is a federal regulation that requires financial institutions, including car dealers that arrange financing or leases, to run a written information security program that protects customer information, with specific controls such as encryption, multi-factor authentication and a designated Qualified Individual.
Pasch Group Dealer Glossary · checked against primary sources October 2026
What it means for a dealership
The rule comes from the Gramm-Leach-Bliley Act and covers dealerships that collect customers’ financial information to arrange credit. The FTC amended it in 2021, and most of the detailed requirements took effect on June 9, 2023.
In practice it asks a dealership to know where its customer data lives, limit who can reach it, encrypt it, require multi-factor authentication for anyone who logs in to its systems, test its defenses, train staff, oversee the vendors that handle the data and plan for incidents. A Qualified Individual must report on the program in writing to the board or a senior officer at least once a year.
Since May 13, 2024, dealers must also notify the FTC within 30 days of discovering a security event that exposes the unencrypted information of at least 500 consumers. Dealers that hold information on fewer than 5,000 consumers are excused from a few written requirements, such as the risk assessment and the incident response plan, but not from the rest of the rule.
Questions
Does the Safeguards Rule apply to my dealership?
If your dealership arranges financing or leases for customers, the FTC treats it as a financial institution under the Gramm-Leach-Bliley Act, so the rule applies. That includes franchise and independent dealers that arrange or extend credit.
Do we have to tell customers about a breach?
The Safeguards Rule requires notifying the FTC, not customers. State data breach laws usually do require notifying affected customers, so check with your counsel.
Sources
- 16 CFR Part 314: Standards for Safeguarding Customer Information (eCFR)
- FTC Safeguards Rule: What Your Business Needs to Know (FTC)
This explains the rule in plain English. It isn’t legal advice: check how it applies to your dealership with your counsel.
Updated October 11, 2026