FTC Safeguards Rule Explained in Plain English

FTC Safeguards Rule compliance for Upstate SC car dealerships from ROI Innovations

The FTC Safeguards Rule sounds like something only lawyers and compliance teams should read. It isn't. If your business handles certain kinds of financial information, this rule likely requires you to build and maintain a written security program, and it spells out specific protections that program must include.

That doesn't mean every business needs a cybersecurity department. It does mean the FTC expects covered businesses to understand their risks, put required protections in place, and be able to show their work.

This post explains the rule in plain English. It's general information, not legal advice.

What the Safeguards Rule is really about

The Safeguards Rule comes from the Gramm-Leach-Bliley Act (GLBA), the federal law on how financial institutions protect consumers' financial information. The Federal Trade Commission enforces the rule for non-bank financial institutions. Banks, credit unions, and insurance companies fall under other regulators.

Plain-English version: If your business collects or stores sensitive financial information from customers, you need a written plan for keeping it safe, and that plan has to include certain specific protections.

The FTC updated the rule significantly in 2021, with most new requirements taking effect in June 2023 and a breach-reporting requirement added in May 2024. If your security program was written before then, it's probably out of date.

The rule covers the full picture of information security, not just hackers:

Who can access customer information
How it's stored and transmitted
How vendors handle it
What happens when systems change
How you respond if something goes wrong
Whether staff know what to do

Who is covered

The rule applies to "financial institutions" under the FTC's jurisdiction, and that phrase is much broader than it sounds. A business can be covered if it is significantly engaged in financial activities, even if it looks nothing like a bank. Common examples:

Auto dealers that arrange financing or leasing
Mortgage brokers and lenders
Payday lenders and finance companies
Tax preparers
Credit counselors
Check cashers
Collection agencies

A simple test: does your business collect or handle sensitive personal information in connection with a consumer financial product or service? If yes, the rule deserves a close look.

Accepting credit cards doesn't by itself make a business a financial institution. A coffee shop that takes cards isn't covered just for that, though card payments carry their own security rules under PCI DSS.

What "customer information" means

The rule protects customer information: nonpublic personal information about people who have a customer relationship with you. That includes obvious items like:

Social Security numbers
Income and employment information
Credit reports
Bank account numbers
Loan and credit applications
Tax return information
Driver's license numbers collected for a financial product

It also includes combinations. A name alone may not be sensitive. A name attached to a credit application is.

The key question: would this information cause fraud, identity theft, or financial harm if it were exposed? If so, protect it.

The core requirement: a written security program

The heart of the rule is a written information security program, often called a WISP. It doesn't have to be a thousand-page binder, but it should explain:

What customer information you have and where it lives
Who can access it
What risks exist
What safeguards you use, including the ones the rule specifically requires
How you test and monitor those safeguards
How you respond to security events

The program should fit your business: a small finance office needs less detail than a multi-store dealer group. Most importantly, it has to be real. A document that sits untouched in a folder doesn't count. You need to follow it, update it, and use it to guide decisions.

The requirements, translated

What the rule says	What it means
Designate a Qualified Individual	Put one person in charge of the security program
Conduct a written risk assessment	Identify where customer data lives and what could go wrong
Design and implement safeguards	Put protections in place, including specific required ones
Regularly monitor and test	Check that the protections actually work
Train staff	Teach people to handle data safely and spot threats
Oversee service providers	Make sure vendors protect customer information too
Evaluate and adjust	Update the program when risks, systems, or the business change
Create an incident response plan	Know what to do before something goes wrong
Report to leadership annually	The Qualified Individual gives the owner or board a written report each year
Notify the FTC of certain breaches	Report qualifying security events within 30 days

A Qualified Individual: one person in charge

The rule requires you to name a Qualified Individual (QI) to oversee your security program. It doesn't have to be an employee; you can use an outside provider. If you do, you remain responsible for compliance, you must assign a senior member of your staff to oversee that provider, and the provider must maintain a program that meets the rule.

Plain-English version: don't let security be everyone's job and no one's job.

A good QI understands your business, your systems, and your risks, and has enough authority to get things done.

A risk assessment: a practical inventory of weak spots

The risk assessment answers a few basic questions:

What customer information do we collect, and where is it stored?
Who can access it?
How could it be lost, stolen, changed, or exposed?
What protections do we already have, and where are the gaps?

It must be written down, with criteria for rating risks, and repeated periodically. A typical assessment turns up things like employees with access to far more records than their job requires, old credit applications sitting in a shared folder, or a vendor that receives customer data with no security terms in its contract.

Safeguards: some are required, not optional

Many businesses read the rule as a menu of suggestions. It isn't. The rule specifically requires covered businesses to:

Limit access. People see only the customer information they need for their job, and access is reviewed regularly.
Know your systems. Keep an inventory of your data, systems, and devices.
Encrypt customer information, both when it's stored and when it's sent over external networks. If encryption truly isn't feasible for a system, the QI must approve other effective controls.
Use multi-factor authentication (MFA) for anyone accessing any information system that holds customer information. Not just email, and not just remote access. Any exception needs the QI's written approval of equally strong controls.
Dispose of customer information securely, no later than two years after it was last used for the customer, unless you have a legitimate business or legal reason to keep it.
Manage changes to your systems and network so new software, devices, or vendors don't open new holes.
Monitor and log user activity so unauthorized access can be detected.
Follow secure development practices for any software you build in-house, and assess outside applications you use.

The principle behind all of them: find the risk, then use a safeguard that actually addresses it. If former employees still have system access, encryption won't fix that. A reliable offboarding process will.

Testing: check, don't assume

You must regularly test whether your safeguards work. The rule gives two options:

Continuous monitoring, or
A penetration test at least once a year plus vulnerability scans at least every six months, and whenever there's a material change to your business or systems.

Plain-English version: don't just write "we protect data." Prove it.

Training: people are part of the system

Staff need security awareness training, kept current. Good training answers everyday questions:

Can I email this document?
Where should I save this file?
What do I do if I clicked a suspicious link?
How do I confirm a customer's identity before discussing their account?
Who do I tell if a laptop or phone goes missing?

Vendors count too

Most businesses share customer information with service providers: software platforms, IT providers, document storage, marketing vendors, and more. The rule requires you to:

Choose vendors capable of protecting customer information
Require safeguards in your contracts
Periodically assess whether vendors are actually protecting it

Vendors usually aren't covered by the Safeguards Rule themselves. Protecting the data they handle is your obligation, and a vendor's mistake still becomes your customers' problem.

The incident response plan: your "what now?" document

The rule requires a written incident response plan so decisions get made before stress and confusion take over. It should cover:

Who must be contacted, and who has authority to make decisions
How to contain the problem and preserve evidence
How to determine what information was affected
Who communicates with customers, regulators, vendors, insurers, or law enforcement
How to fix the weakness and document what happened

Notifying the FTC

Since May 2024, covered businesses must notify the FTC when unencrypted customer information of 500 or more consumers is acquired without authorization. Notice is due as soon as possible and no later than 30 days after discovery, through the FTC's online form.

Two details matter:

Encrypted data counts as unencrypted if the encryption key was also compromised.
This is separate from notifying customers. Customer notification is required by state breach laws, which have their own triggers and timelines. South Carolina has its own breach notification law, as do the other states where your customers live.

Reporting to leadership

At least once a year, the Qualified Individual must give the board, owner, or senior leadership a written report on the security program: its overall status, material risks, test results, security events, and recommended changes. This keeps security a business decision instead of an IT afterthought.

The small-business exemption (it's narrower than you think)

If you maintain customer information on fewer than 5,000 consumers, you're exempt from four requirements:

The written risk assessment
Continuous monitoring or annual penetration testing and twice-yearly vulnerability scans
The written incident response plan
The annual written report to leadership

Everything else still applies: a Qualified Individual, a written security program, access controls, encryption, MFA, secure disposal, training, and vendor oversight. The FTC breach notification requirement applies regardless of size.

Count carefully. The number includes everyone you hold information on, not just this year's customers. Years of credit applications, past buyers, and leads who applied but didn't buy add up quickly. Once you cross 5,000, the full rule applies.

What this means for car dealerships

Most dealerships that arrange financing or leasing are covered, and most hold information on well over 5,000 consumers, so the full rule typically applies. Dealerships also handle customer information in more places than they realize:

Deal jackets with credit applications, pay stubs, and copies of driver's licenses, often in unlocked offices or filing cabinets
The DMS, CRM, and lender portals like RouteOne and Dealertrack, each of which needs MFA for every user
Shared logins at the sales desk or F&I office, which make access control and logging impossible
Scanners, copiers, and email, where licenses and applications get scanned and sent without encryption
Texting and personal phones used to send customer documents
Vendors with access to customer data: DMS providers, CRMs, website and chat providers, marketing companies, and IT support
Guest Wi-Fi that isn't separated from the network your business systems run on

For most dealers, the fastest wins are ending shared logins, turning on MFA across every system with customer data, locking down deal jackets, and building a vendor list with security terms in each contract.

For dealerships in Upstate South Carolina, ROI Innovations offers outsourced Qualified Individual services, gap assessments, and written security programs. See FTC Safeguards Rule help for car dealers.

Common misunderstandings

"It only applies to banks." No. Banks fall under other regulators. This rule is for the many non-bank businesses that handle consumer financial information.
"We're small, so we're exempt." Only from four specific requirements. Encryption, MFA, and the rest still apply.
"We bought security software, so we're covered." Tools help, but software isn't a security program.
"MFA on email is enough." MFA is required for anyone accessing any system with customer information.
"It only matters after a breach." The rule is about prevention and preparation. Waiting for an incident is the wrong order.

A plain-English checklist

Confirm whether the rule applies, and count how many consumers you hold information on
Name a Qualified Individual
Inventory your customer information, systems, and devices
Complete a written risk assessment
Restrict access and end shared logins
Turn on MFA for every system with customer information
Encrypt customer information stored and in transit
Set a retention schedule and securely dispose of old records
Train staff, and keep records of who completed training
List your vendors and add security terms to their contracts
Set up testing: continuous monitoring, or annual penetration tests plus scans every six months
Write an incident response plan, including FTC notification
Deliver an annual written report to leadership
Update the program when your business, systems, or vendors change

This checklist isn't a substitute for reading the rule or getting legal advice, but it's a practical map of what the rule expects.

The takeaway

Strip away the legal language and the Safeguards Rule asks for a written, active, risk-based security program with specific protections. Someone owns it. You know what data you have. Risks are written down. Required safeguards like MFA and encryption are in place. Vendors are checked. Staff are trained. Incidents are planned for before they happen.

The rule doesn't ask for magic. It asks for care, structure, and follow-through.

Need help getting compliant?

ROI Innovations provides Qualified Individual services, risk assessments, written security programs, and staff training for dealerships and other businesses covered by the Safeguards Rule. Contact us at info@roiinnovations.com or visit roiinnovations.com.

Sources

FTC Safeguards Rule: What Your Business Needs to Know (Federal Trade Commission)
16 CFR Part 314: Standards for Safeguarding Customer Information (eCFR)
Final rule adding FTC breach notification, November 13, 2023 (Federal Register)

This post is general information, not legal advice. ROI Innovations is not affiliated with the Federal Trade Commission.