FTC Safeguards for Auto Dealerships

In most cases, yes. The FTC Safeguards Rule (16 CFR Part 314) implements the Gramm-Leach-Bliley Act for non-bank "financial institutions" under FTC jurisdiction, and the rule uses automobile dealers as a named example of a covered financial institution. A dealership becomes covered by extending credit or arranging or originating financing for its customers, which describes nearly every franchise and buy-here, pay-here dealer. The credit applications your F&I office handles carry Social Security numbers, driver license data, income, and bank and lender details. That handling of customer financial information is what brings the dealership within scope. A dealer that never arranges financing and only sells for cash may fall outside the definition, but that is uncommon. We assess your specific activities during onboarding and document why and how the rule applies to you.

The rule requires a written information security program overseen by a designated Qualified Individual. It also requires a risk assessment and access controls with multi-factor authentication for anyone accessing your information systems, unless a documented equivalent is approved. Customer information must be encrypted in transit and at rest.

You must apply secure development practices if you build your own software. You need continuous monitoring of your systems. Without it, you need annual penetration testing and vulnerability assessments at least every six months. The remaining elements are security awareness training, a written incident response plan, and an annual written report to your dealer principal or governing body. You must also notify the FTC within 30 days of a notification event. A notification event is the unauthorized acquisition of unencrypted customer information involving at least 500 consumers.

Dealerships maintaining information on fewer than 5,000 consumers are exempt from four of these elements: the written risk assessment, the penetration testing and twice-yearly vulnerability assessments, the written incident response plan, and the annual board report. Most franchise dealers exceed that threshold and are fully in scope. Every covered dealer must still maintain a written program with access controls and MFA, encryption, audit logging, secure disposal, and training. The FTC breach-notification duty applies regardless of size.

The FTC can seek civil penalties of up to $53,088 per violation, per day. State attorneys general can bring parallel actions under state consumer protection laws. Beyond fines, a data breach involving customer credit applications can disrupt your finance relationships and put deals on hold. It can damage standing with captive and third-party lenders. It can also trigger contractual and reputational consequences with the customers whose information was exposed. The compliance program exists to prevent the breach, not just to satisfy the regulator.

We deliver the program end to end. That covers a gap analysis against the Safeguards Rule, a written risk assessment, and the WISP and supporting policies. It includes implementation of the technical controls: MFA, encryption, access controls, logging, and endpoint and email security across the showroom, F&I office, and service drive. It also covers the penetration testing and vulnerability assessment schedule, security awareness training, the incident response plan, and the annual board report. We then manage the program on an ongoing basis so it stays current as your environment and the rule change. We serve commercial clients across Texas, Tennessee, and the United States.

They are two separate FTC rules that most financed-vehicle dealers must meet, and it is efficient to run them as one program. The Safeguards Rule (16 CFR Part 314) governs how you protect customer information. The Red Flags Rule (16 CFR Part 681) requires a written identity-theft prevention program that identifies and responds to the warning signs, or red flags, of identity theft in your credit transactions. Because a dealership that arranges financing typically qualifies as both a financial institution and a creditor, both rules commonly apply. The good news is that one coherent program can carry both: the same risk assessment, access controls, staff training, and incident response that satisfy the Safeguards Rule also support the identity-theft program the Red Flags Rule requires. Cyber One Solutions builds and documents both so the F&I office follows a single set of procedures rather than two disconnected ones.

No. A secure Dealer Management System and reputable credit-application and lender portals are helpful, but the Safeguards Rule applies to your dealership as a whole, not just one application. You are still responsible for your own written program, your access controls and MFA, your risk assessment, your incident response plan, and your training. You must also oversee every service provider that touches customer information, including your DMS and portal vendors. The rule expects you to select providers capable of maintaining appropriate safeguards and to require those safeguards by contract. We build the program around your full environment, inventory the DMS and lender-portal relationships, and document vendor oversight as part of it.

The Safeguards Rule requires you to designate a single Qualified Individual responsible for overseeing, implementing, and enforcing your information security program. The rule does not require a particular certification. It expressly allows the role to be filled by an affiliate or a service provider rather than an in-house employee. When the Qualified Individual is external, accountability stays with your dealership. You must retain responsibility for compliance and assign a senior member of your own staff, often the dealer principal or general manager, to oversee that provider. You must also require the provider to maintain a program that protects you. Cyber One Solutions can serve as, or support, your Qualified Individual and produce the documentation and periodic reporting the role requires. Your leadership stays in the oversight position the rule expects.

The F&I office is a high-value target because it concentrates the exact data an identity thief needs to open credit in someone else's name. The controls the Safeguards Rule requires are the same controls that blunt that threat. Multi-factor authentication makes account takeover far harder. Role-based access controls keep credit files out of reach of staff who do not need them, so a service advisor cannot browse F&I records. Encryption protects Social Security numbers and bank details at rest and in transit. Audit logging shows who accessed a customer file and when. Combined with the identity-theft procedures the Red Flags Rule expects, this gives your store a single defense that satisfies the regulators and protects your customers and your finance reserves at the same time. That is why the program pays for itself beyond satisfying the rule.