FTC Safeguards Rule for Auto Dealerships: 10 Requirements Explained

Last updated: October 2026

Disclaimer: This article is intended to help auto dealerships understand the FTC Safeguards Rule and the technology practices that can support compliance. It is provided for educational purposes and is not legal advice. Dealerships should consult qualified legal or compliance professionals regarding their specific obligations.

If your dealership arranges financing or leasing for customers, the FTC Safeguards Rule likely applies, even if you don't finance vehicles directly.

Under the Gramm-Leach-Bliley Act (GLBA), most automobile dealers that arrange consumer financing or lease vehicles for longer than 90 days are treated as financial institutions. The Rule requires covered dealerships to develop, implement, and maintain a written information security program designed to protect customer information.

At most dealerships, responsibility for protecting customer information is split across the DMS provider, CRM vendor, lenders, employees, an outside IT company, and dealership leadership. Each one controls a piece of the environment, but somebody still has to know that the whole program works together. When everyone owns one piece, someone still has to own the outcome.

That's the practical challenge. It isn't simply buying security software. It's knowing where customer information lives, who can access it, which vendors touch it, what safeguards are actually working, and who takes responsibility when something needs attention. The right dealership IT partner can help leadership coordinate those moving parts and get clear answers.

This guide translates the Rule's requirements into dealership language and explains where an experienced IT provider can help.

FTC Safeguards Rule at a Glance

Why the Rule Applies to Most Auto Dealerships

The Safeguards Rule applies to financial institutions subject to the FTC's jurisdiction. A dealership can qualify as a financial institution because of what it does, not because it calls itself a bank or lender.

A dealership is generally covered when it:

• Extends consumer credit.
• Arranges or facilitates vehicle financing through a third-party lender.
• Leases vehicles to consumers for longer than 90 days.
• Collects and maintains customer information in connection with those activities.

This means a dealership can be covered even when a bank, captive finance company, or other lender ultimately holds the loan. Arranging or brokering financing is enough to create obligations under the Rule.

What Counts as Customer Information?

Customer information generally means nonpublic personal information about someone with whom the dealership has a continuing relationship through financing or leasing.

Examples may include:

• Approved credit or lease applications.
• Social Security numbers.
• Income and employment information.
• Bank account or payment information.
• Driver's license information included with financial records.
• Financing documents and lender communications.
• Lists identifying customers who financed or leased vehicles.

The Rule covers customer information in paper, electronic, and other forms. It can affect data stored in the DMS, CRM, email, shared drives, employee computers, cloud services, scanned documents, file cabinets, and systems operated by service providers.

The Ten Required Elements in Dealership Language

The FTC identifies ten elements that should be included in a covered financial institution's information security program. Here's what each one means inside a dealership.

1. Designate a Qualified Individual

The dealership must formally designate a Qualified Individual to oversee and implement the information security program.

This person doesn't have to be a dealership employee. The role may be filled by a qualified person employed by an affiliate or outside service provider. If an outside provider fills the role, the dealership must still retain responsibility, designate a senior employee to oversee the Qualified Individual, and require the provider to maintain an appropriate information security program.

Questions for leadership:

• Who is formally responsible for the program?
• Does that person have the knowledge and authority to perform the role?
• Who inside the dealership oversees an outside Qualified Individual?

2. Base the Program on a Risk Assessment

The security program must be based on an assessment of reasonably foreseeable internal and external risks to customer information. A dealership-focused IT risk assessment can help document the technology environment, but the Safeguards Rule assessment must address the dealership's complete information security program.

In dealership terms, that means identifying:

• Where customer information is collected, stored, transmitted, and disposed of.
• Which employees, vendors, and systems can access it.
• What could result in unauthorized disclosure, misuse, alteration, or loss.
• Whether current safeguards adequately control those risks.
• Which risks will be reduced, accepted, or otherwise addressed.

Risk assessments need to be revisited as systems, vendors, operations, and threats change.

3. Design and Implement Safeguards

The dealership must implement safeguards that address the risks it identifies. These go well beyond antivirus software and include administrative, technical, and physical controls.

Important examples include:

• Unique user accounts and access based on job responsibilities.
• Periodic access reviews and prompt removal of former employees.
• Multi-factor authentication for people accessing dealership information systems, unless a reasonably equivalent or stronger control is approved in writing by the Qualified Individual.
• Encryption of customer information at rest and while transmitted over external networks, or approved compensating controls when encryption is infeasible.
• Secure configuration and evaluation of applications handling customer information.
• Data-retention and secure-disposal procedures.
• Change-management procedures.
• Logging and monitoring of authorized-user activity.
• Physical protection for equipment and paper records.

4. Monitor and Test the Safeguards

The dealership must regularly test or otherwise monitor whether its key safeguards are working.

For information systems, the Rule requires continuous monitoring or periodic penetration testing and vulnerability assessments. When the dealership doesn't have effective continuous monitoring or another system that detects vulnerability-creating changes on an ongoing basis, it must conduct:

• Penetration testing at least annually, based on the risks identified for that year.
• Vulnerability assessments at least every six months.
• Additional vulnerability assessments after material operational or business changes, or when circumstances could materially affect the security program.

Routine activities may also include reviewing security alerts, testing backup restoration, verifying endpoint protection, auditing access permissions, and documenting remediation.

5. Prepare and Train Personnel

Every employee who handles systems or customer information has a role in protecting it.

The dealership should provide security-awareness training that reflects the risks identified in its assessment. Personnel who administer the security program need appropriate skills, current security information, and continuing training.

Day-to-day dealership examples include:

• Teaching employees to recognize phishing and fraudulent payment requests.
• Training new employees during onboarding.
• Running periodic phishing simulations.
• Documenting participation and follow-up training.
• Giving IT and security personnel role-specific training.

6. Oversee Service Providers

Dealerships rely on DMS, CRM, lender, payroll, marketing, document-management, shredding, cloud, and technology providers. When a provider receives, maintains, processes, or can access customer information while delivering its service, the dealership may have service-provider oversight obligations.

The dealership must take reasonable steps to:

• Select and retain providers capable of maintaining appropriate safeguards.
• Require appropriate safeguards in the provider's contract.
• Periodically reassess providers based on their risk and the continued adequacy of their safeguards.

A vendor list alone doesn't satisfy vendor oversight. The dealership should understand what each relevant provider can access, how that access is secured, and who reviews it.

7. Keep the Security Program Current

The program has to change when the dealership's risk changes.

Updates may be needed after:

• A new DMS, CRM, cloud service, or lender integration.
• A dealership acquisition or new rooftop.
• Changes in employee or vendor access.
• Security testing that identifies weaknesses.
• A security incident.
• New threats or significant technology changes.

A Written Information Security Program should describe how the dealership actually operates today, not how it operated when the document was first created.

8. Maintain a Written Incident Response Plan

The dealership must have a written plan for responding to and recovering from a security event that materially affects customer information.

The plan should address:

• The goals of the response.
• Internal response processes.
• Roles, responsibilities, and decision-making authority.
• Internal and external communications.
• Remediation of identified weaknesses.
• Documentation and reporting.
• Review and revision of the plan after an incident.

An incident response plan covers more ground than a disaster recovery plan. Backups and recovery matter, but the dealership also needs to plan for detection, containment, investigation, escalation, communications, documentation, and corrective action.

9. Report to Ownership at Least Annually

The Qualified Individual must provide a written report regularly, and at least annually, to the dealership's board or equivalent governing body. If the dealership has no board or equivalent body, the report must go to the senior officer responsible for the program.

The report should cover:

• The overall status of the information security program.
• Compliance with the Rule.
• Material risk-assessment and risk-management matters.
• Service-provider arrangements.
• Security testing results.
• Security incidents or violations and management's response.
• Recommended changes to the program.

This gives dealership ownership a documented view of what's working, what remains exposed, and what decisions need attention.

10. Notify the FTC of Certain Security Events

The FTC must be notified as soon as possible, and no later than 30 days after discovery, when a notification event involves the unauthorized acquisition of unencrypted customer information affecting at least 500 consumers.

For this purpose, unauthorized access to unencrypted information is treated as unauthorized acquisition unless reliable evidence shows that acquisition did not and could not reasonably have occurred. Encrypted information is also covered if the encryption key was accessed by an unauthorized person.

The dealership should involve qualified legal counsel promptly after discovering a possible breach. Other federal, state, contractual, insurer, lender, or consumer-notification requirements may also apply.

Does the Fewer-Than-5,000-Consumers Exception Apply?

Under 16 CFR 314.6, financial institutions maintaining customer information concerning fewer than 5,000 consumers get relief from four specific provisions of the Rule:

• The detailed written-risk-assessment requirements in 16 CFR 314.4(b)(1).
• The specific penetration-testing and vulnerability-assessment requirements in 16 CFR 314.4(d)(2).
• The written incident-response-plan requirement in 16 CFR 314.4(h).
• The annual written-report requirement in 16 CFR 314.4(i).

This isn't a complete exemption from the Safeguards Rule. The remaining requirements still apply, including the obligation to maintain an appropriate information security program and protect customer information. The FTC breach-notification requirement is also not included in this exception.

Because the threshold is based on customer information maintained, not simply annual vehicle sales, employee count, or number of locations, a dealership should confirm its status with qualified legal or compliance counsel before relying on the exception.

How Tech Marvel Can Support the Technology Side of the Rule

Compliance remains the dealership's responsibility, and legal counsel should interpret the dealership's specific obligations. Tech Marvel can help dealership leadership identify and manage many of the technology, security, documentation, and vendor-coordination issues that support the program.

Tech Marvel supports the surrounding IT environment and helps coordinate the appropriate vendors when dealership software, DMS, CRM, OEM portal, lender, phone, internet, or service-system issues overlap with IT. We don't provide legal advice or guarantee compliance.

What Can Non-Compliance Cost?

Failure to comply can expose a dealership to an FTC investigation and enforcement action. Depending on the circumstances and legal authority involved, outcomes can include administrative or court orders, required corrective measures, long-term security assessments or monitoring, and civil penalties. A security incident can also create separate costs involving legal counsel, forensic investigation, customer notification, operational disruption, insurance, vendor coordination, and lost trust.

The practical goal isn't to respond to compliance questions with assumptions. Dealership leadership should be able to show what safeguards are in place, how they're maintained, who is responsible, and what's being done about identified gaps.

Frequently Asked Questions

Does the Rule apply if we don't finance vehicles in-house?

Generally, yes. A dealership that arranges or brokers consumer financing can qualify as a financial institution even when a bank or finance company provides and ultimately holds the loan.

Does the Rule apply to a dealership with only one location?

It can. Coverage is based primarily on the dealership's financial activities and customer information, not its number of rooftops. The security program should be appropriate for the dealership's size, complexity, activities, and data sensitivity.

Are cash-only vehicle sales covered?

A cash sale by itself generally doesn't create customer information under the Safeguards Rule. However, if the dealership also arranges financing or leasing and stores covered customer information on the same connected systems, safeguards may need to protect the broader information environment.

Does antivirus software make a dealership compliant?

No. Antivirus or endpoint protection is only one control among many. The Rule also addresses risk assessment, access, MFA, encryption, monitoring and testing, employee training, vendor oversight, incident response, reporting, documentation, physical safeguards, and ongoing program management.

Can an outside IT provider serve as the Qualified Individual?

Yes, if the provider has the appropriate qualifications and is formally assigned the responsibility. The dealership must still retain responsibility for compliance, assign a senior employee to oversee the outside Qualified Individual, and require the provider to maintain an appropriate security program.

Is a vulnerability scan the same as a penetration test?

No. A vulnerability assessment identifies known weaknesses or unsafe configurations. A penetration test actively evaluates whether those weaknesses can be exploited. They serve different purposes, and the Rule establishes specific testing requirements when effective continuous monitoring or equivalent ongoing detection isn't in place.

Does the fewer-than-5,000-consumers exception eliminate the Rule?

No. It provides relief from four specific provisions, not the entire Safeguards Rule. Covered smaller dealerships must still maintain appropriate safeguards and meet the requirements that aren't exempted.

Can Tech Marvel certify that our dealership is compliant?

No IT provider can remove the dealership's responsibility for compliance. Tech Marvel can help identify technology and security gaps, implement and maintain supported controls, improve documentation, and coordinate vendors. Legal or compliance professionals should advise the dealership on its final compliance determination.

Start with a Clear View of Your Current Gaps

You shouldn't have to guess whether customer information is properly protected, MFA is consistently enforced, former employees still have access, backups can be restored, or security responsibilities are clearly assigned.

Tech Marvel combines dealership IT experience with over 30 years of technology expertise to help New Jersey dealerships reduce downtime, strengthen cybersecurity, coordinate technology vendors, and get clear answers from one accountable local partner.

During your free 20-minute Dealership IT Review, we can focus specifically on the technology safeguards, documentation, vendor access, monitoring, and security responsibilities that may need closer review under the FTC Safeguards Rule.

Want to know where your dealership stands? Book your free 20-Minute Automotive IT Risk Review →

Sources

• Automobile Dealers and the FTC's Safeguards Rule: Frequently Asked Questions
• FTC Safeguards Rule: What Your Business Needs to Know
• 16 CFR 314.4 - Elements
• 16 CFR 314.6 - Exceptions