Shift into Compliance: The FTC Safeguards Rule for Auto Dealers

/ General / By

If your dealership helps customers finance or lease vehicles, you’re likely a “financial institution” under the Gramm-Leach-Bliley Act (GLBA) and must comply with the FTC’s Safeguards Rule. The Rule isn’t new—it dates to 2003—but major amendments in 2021 tightened expectations, and additional breach-notification requirements took effect in 2024. Here’s the plain-English guide: what the Rule is, what dealers must do, and the key dates you need to know. (Federal Trade Commission)

What is the Safeguards Rule?

The Safeguards Rule (16 C.F.R. Part 314) requires covered financial institutions to develop, implement, and maintain a written information security program to protect customer information (nonpublic personal information). In 2021, the FTC amended the Rule to add concrete requirements—think “must-haves” like multi-factor authentication (MFA), encryption, continuous monitoring or regular testing, and board-level reporting. In 2023, the FTC added a breach-notification obligation. (Federal Trade Commission)

Are auto dealers covered? Yes—most dealerships that finance, arrange financing, or lease vehicles are considered financial institutions under the FTC’s jurisdiction and are covered by the Safeguards Rule. The FTC has even published dealer-specific FAQs making this explicit. (Federal Trade Commission)

What do dealerships have to do?

The Rule requires a written information security program appropriate to your size, complexity, and risks. Practically, that program must include nine core elements. Here they are, translated for dealership operations:

  1. Designate a “Qualified Individual.” Appoint someone to own and oversee your security program. This can be an employee or an external provider, but accountability stays with you. Require at least annual written reporting to your board or top officer. (Federal Trade Commission)
  2. Perform a written risk assessment. Inventory the customer data you hold (DMS, CRM, F&I documents, lender portals, backups) and identify threats—internal and external. Reassess periodically as systems, vendors, and risks change. (Federal Trade Commission)
  3. Implement safeguards to control identified risks, including:
  • Access controls with least-privilege and periodic review.
  • Data inventory and asset management (know where customer info lives).
  • Encryption of customer information at rest and in transit (or a documented, approved equivalent).
  • Application security review for in-house and third-party apps.
  • Multi-factor authentication (MFA) for anyone accessing customer info.
  • Secure disposal policies—generally within two years of last use unless legally required to keep it.
  • Change management to evaluate security impact before system changes.
  • Logging and monitoring to track authorized user activity and detect unauthorized access. (Federal Trade Commission)
  1. Monitor and test your program. Either implement continuous monitoring or perform annual penetration tests and vulnerability scans at least every six months—and after material changes. (Federal Trade Commission)
  2. Train your staff. Provide ongoing security awareness training; add specialized training for IT and high-risk roles (F&I, accounting). (Federal Trade Commission)
  3. Oversee service providers. Vet vendors (DMS, CRM, call-tracking, website/chat, lenders’ portals) for security, contract appropriate safeguards, and monitor them periodically. (Federal Trade Commission)
  4. Keep the program current. Update policies, controls, and safeguards as threats and operations evolve (new tools, mergers, locations). (Federal Trade Commission)
  5. Create a written incident response plan. Define goals, roles, communications, containment, remediation, and documentation for security events. Test and refine it. (Federal Trade Commission)
  6. Report to leadership. The Qualified Individual must deliver a regular (at least annual) written report covering risk posture, test results, incidents and responses, vendor management, and recommended changes. (Federal Trade Commission)

Small-entity note: Certain provisions don’t apply to institutions that maintain information on fewer than 5,000 consumers, but most franchised and many independent dealers will exceed that threshold. Review the FTC’s small-entity guidance and the rule text to confirm applicability. (Federal Trade Commission)

Breach-notification: a new must-do

As of May 13–14, 2024, covered institutions must notify the FTC as soon as possible and no later than 30 days after discovering a “notification event”—a security breach involving the unauthorized acquisition of unencrypted customer information of at least 500 consumers (note: encrypted data counts as unencrypted if the key was accessed). The FTC provides an online reporting form and may make reports public. Build this clock and threshold into your incident response plan. (Federal Trade Commission)

By when did (or do) dealers need to comply?

  • The 2021 amendments originally had a December 9, 2022 compliance date, but the FTC extended some requirements six months to June 9, 2023—including the Qualified Individual, written risk assessment, access controls, encryption, training, incident response, service-provider oversight, and MFA. Those are now in force. (NADA)
  • The breach-notification amendment became effective May 13, 2024 (FTC announcement on May 14 clarifies practical details). (Federal Trade Commission)

A simple dealership checklist

Use this as an at-a-glance readiness scan you can hand to your GM or controller:

  • Governance: Named Qualified Individual; annual board report scheduled and templated. (Federal Trade Commission)
  • Risk Assessment: Written, current inventory of systems (DMS, CRM, F&I, OEM portals, cloud storage, email, endpoints); threats identified with treatment plan. (Federal Trade Commission)
  • Access & MFA: Role-based access, offboarding checklist, MFA enforced for accounts touching customer info (including remote access and cloud apps). (Federal Trade Commission)
  • Encryption: Data at rest and in transit encrypted, or documented approved equivalent; key management addressed. (Federal Trade Commission)
  • Monitoring & Testing: Centralized logging; continuous monitoring or annual pen test + semiannual vulnerability scans; remediation tracked. (Federal Trade Commission)
  • Vendor Management: Due diligence, contracts with security clauses, periodic reviews for DMS/CRM/marketing tech and finance partners. (Federal Trade Commission)
  • Training: New-hire and recurring awareness; targeted training for F&I, IT, accounting. (Federal Trade Commission)
  • IR Plan: Written, exercised; clear thresholds for FTC reporting within 30 days for incidents affecting ≥500 consumers’ unencrypted data. (Federal Trade Commission)
  • Data Lifecycle: Retention schedule; secure disposal within two years of last use unless a legal/business need exists. (Federal Trade Commission)

Why this matters for sales, not just security

Compliance isn’t just an IT exercise. Enterprise lenders, insurers, and fleet customers increasingly scrutinize dealer controls. A documented, tested program speeds vendor reviews, reduces downtime from incidents, and preserves hard-won reputation—especially when F&I attachments (licenses, pay stubs, SSNs) move across multiple systems daily. The Safeguards Rule gives you a defensible baseline; following it can shorten sales cycles and smooth OEM and lender relationships. (Federal Trade Commission)

How Cyberator can help (practically)

Dealers often juggle multiple systems and vendors, making coordination and evidence-collection the hardest part. Cyberator can:

  • Accelerate the risk assessment, mapping controls to the Safeguards Rule and surfacing gaps across people, process, and technology.
  • Centralize your program, from policies to diagrams to task ownership, with automatic tracking of remediation and deadlines.
  • Operationalize vendor management, keeping contracts, due-diligence artifacts, and review cadence in one place.
  • Produce audit-ready evidence for leadership reviews and, if needed, regulators—without a scramble.

(You still need an incident response partner, technical tools, and staff training, but Cyberator becomes the operating system for your compliance program.)

Bottom line

If you handle financing or leasing, you’re in scope. Make sure you’ve met the 2021 amendment requirements (effective June 9, 2023) and updated your incident response to handle the 30-day breach-notification rule effective May 2024. Start with governance (Qualified Individual + board reports), complete your written risk assessment, enforce MFA and encryption, tighten vendor contracts, and test continuously. That’s how you turn compliance into a competitive advantage at the dealership. (NADA)

References for further reading: