Auto dealers
The FTC Safeguards Rule for auto dealers
If your dealership leases vehicles or arranges financing, the Safeguards Rule likely applies to the customer data in every deal jacket and credit application.
By Tyler Milam, founder of Golden Rock · Updated
Are you covered?
A dealership that, as a usual part of its business, leases automobiles for longer than 90 days is a financial institution for its leasing business. Arranging or extending customer financing is a financial activity too.
What the rule asks
(a) Qualified Individual
Put one named person in charge of overseeing, running, and enforcing your information security program. They can be an employee or work for an affiliate or outside IT company, but your business stays responsible.
(b) Risk assessment
Base your program on a risk assessment of what could go wrong with customer information and whether your protections are enough, and redo it periodically. Only firms with customer information on 5,000 or more consumers must write it down with formal criteria.
16 CFR 314.4(b) · small-firm exemption 16 CFR 314.6
(c) Safeguards
Put protections in place for the risks you found: access controls, an inventory, encryption, app security, multi-factor authentication, secure disposal, change management, and activity monitoring.
(d) Testing and monitoring
Regularly test or monitor whether your protections actually work. Firms with customer information on 5,000 or more consumers must also use continuous monitoring or do a yearly penetration test plus vulnerability scans at least every six months.
16 CFR 314.4(d) · small-firm exemption 16 CFR 314.6
(e) Staff and training
Make sure your people can carry out the program: train all staff, use qualified security help, and keep that help trained and up to date.
(f) Service providers
Choose vendors that can protect your customers' data, require safeguards in their contracts, and check on them periodically based on their risk.
(g) Evaluate and adjust
Update your program based on testing results, changes to your business, new risk assessments, and anything else that could seriously affect your security.
(h) Incident response plan
Keep a written plan for responding to and recovering from security events that affect customer information. Not required for firms with customer information on fewer than 5,000 consumers.
16 CFR 314.4(h) · small-firm exemption 16 CFR 314.6
(i) Annual report to the board
Your Qualified Individual reports in writing, at least once a year, to your board or, if you have none, to the senior officer responsible for security. Not required for firms with customer information on fewer than 5,000 consumers.
16 CFR 314.4(i) · small-firm exemption 16 CFR 314.6
(j) Notify the FTC
If unencrypted customer information about 500 or more consumers is acquired without permission, tell the FTC as soon as possible and no later than 30 days after you discover it. This applies to firms of every size.
Breach notice: if unencrypted information on 500 or more consumers is taken, tell the FTC within 30 days of discovery (16 CFR 314.4(j)).
Where your customer information lives
- Your dealer management system (DMS)
- Credit applications and credit pulls
- F&I menus and e-contracting
- Deal jackets, copies of licenses and paystubs
Each of these needs access controls, multi-factor sign-in, encryption and a place in your risk assessment.
We're a small independent lot. Does it apply?
If you lease or arrange financing, likely yes. Dealers with customer information on fewer than 5,000 consumers skip four items (16 CFR 314.6), but still need the written program, a Qualified Individual, access controls, multi-factor sign-in and encryption.
Our DMS vendor handles security. Isn't that enough?
No. You can use service providers, but you must choose capable ones, require safeguards in their contracts and check on them periodically (16 CFR 314.4(f)). Your own staff, devices and paper files are still your program.
Not ready for a trial?
Get the printable checklist by email, with two short tips emails over the next two weeks.
Plain-language guidance from the rule text, not legal advice. Prefer to have it done for you? See Golden Rock's done-for-you options.