Plain-English guide
Who the rule covers, every requirement in 16 CFR 314.4 in plain language, the small-business exemption, and the first steps that matter most.
By Saint Somerville, ROI Compliance · Updated November 2026 · General guidance, not legal advice
The FTC Safeguards Rule (16 CFR Part 314) comes from the Gramm-Leach-Bliley Act. It requires financial institutions under the FTC's jurisdiction to develop, implement, and maintain a written information security program (often called a WISP) that protects customer information.
The rule was amended in 2021, and most of the new requirements took effect on June 9, 2023. A requirement to notify the FTC of certain data breaches was added later and took effect in May 2024.
In practice, that means one person is in charge, your risks are written down, specific safeguards are in place, your people are trained, your vendors are checked, you have a plan for when something goes wrong, and leadership gets a written report at least once a year.
The core requirements are in 16 CFR 314.4, paragraphs (a) through (j). Here is what each one asks for and what it usually looks like at a dealership.
One person oversees and enforces the program. It can be an employee or an outside provider. If you use an outside provider, the dealership keeps responsibility, must name a senior person to oversee the provider, and must require the provider to maintain a security program.
Identify the risks to customer information (in the DMS, CRM, email, lender portals, paper deal jackets) and judge whether your current safeguards are enough. Repeat it periodically.
The rule names eight:
Regularly test whether your safeguards work. Without continuous monitoring, that means a penetration test every year and vulnerability assessments at least every six months, plus after material changes.
Give staff security awareness training that's updated as needed to reflect the risks in your risk assessment. Make sure the people running security are qualified and kept current.
Staff and leadership training →Choose vendors that can protect customer information, require safeguards in their contracts, and periodically assess them. At a dealership, that usually means the DMS, CRM, lenders' portals, website and chat vendors, and IT support.
Adjust the program when testing turns up problems, when your operations change, or when anything else could materially affect it.
A written plan to respond to and recover from a security event. It must cover goals, roles and decision-making, internal processes, communications, fixing weaknesses, documentation, and updating the plan afterward.
The Qualified Individual reports in writing, at least once a year, to the board or a senior officer. The report covers the program's overall status and material matters like risks, test results, and incidents.
If unencrypted customer information about 500 or more consumers is acquired without authorization, notify the FTC as soon as possible and no later than 30 days after you discover it.
If you maintain customer information on fewer than 5,000 consumers, four requirements don't apply to you (16 CFR 314.6):
Everything else still applies, including the Qualified Individual, the safeguards, MFA, encryption, training, vendor oversight, and FTC breach notification. When you count, include old deals and credit applications, not just current customers.
You don't have to do everything at once. These steps reduce the most risk and give you something on paper quickly.
Get guided through every step Or hand it to a Qualified Individual
The Safeguards Rule (16 CFR Part 314) is the FTC's regulation under the Gramm-Leach-Bliley Act. It requires financial institutions under FTC jurisdiction, including most car dealerships, to develop, implement, and maintain a written information security program to protect customer information.
Yes, for most dealers. A dealership that arranges financing or leases for customers is a financial institution under the rule.
Partly. Businesses that maintain customer information on fewer than 5,000 consumers are exempt from four requirements: the written risk assessment, annual penetration testing and six-month vulnerability assessments, the written incident response plan, and the Qualified Individual's annual written report. Every other requirement still applies (16 CFR 314.6).
When unencrypted customer information about at least 500 consumers is acquired without authorization, you must notify the FTC as soon as possible and no later than 30 days after discovering it (16 CFR 314.4(j)).
Yes. The rule requires multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves in writing the use of reasonably equivalent or more secure access controls (16 CFR 314.4(c)(5)).
Customer information must be securely disposed of no later than two years after the last date it was used to provide a product or service to the customer, unless it is needed for business operations or another legitimate purpose, retention is required by law, or targeted disposal isn't reasonably feasible (16 CFR 314.4(c)(6)).
Source: the Standards for Safeguarding Customer Information, 16 CFR Part 314. Read the full text at the Electronic Code of Federal Regulations. This page is general guidance, not legal advice.
The free 30-minute owner briefing walks through these requirements and answers your questions.