The FTC Safeguards Rule protects nonpublic personal information held by non-bank financial institutions. A collection agency's daily work sits squarely inside that definition.
You hold consumer account and debt records, take payments, and exchange data with creditors. Collecting overdue accounts is a financial activity, and the FTC's Safeguards Rule guidance names collection agencies among covered businesses.
Collection agencies hold high-value financial data.
Every account contains Social Security numbers, account and debt details, bank and payment information, and contact data. That is precisely the customer financial information the Safeguards Rule is written to protect.
Account takeover and business email compromise target this data directly. The rule requires MFA, access controls, and encryption; out-of-band verification of payment instructions is a best practice we add on top.
These are the same controls that defend against the most common attacks on collection operations.
A written program is the baseline, not the ceiling.
The rule requires a written information security program, a Qualified Individual, a documented risk assessment, and an incident response plan. These exist whether or not you have ever had an incident.
We produce these documents to reflect what is actually running in your environment. The program then survives an FTC inquiry or a creditor-client security questionnaire rather than reading as boilerplate.
Vendor oversight is part of compliance.
Collection operations rely on collection-management software, payment processors, skip-tracing and data providers, and credit bureaus. The rule requires you to oversee the service providers that handle your customer information.
We inventory those vendors, document the security expectations, and fold vendor oversight into your written program so the requirement is met and evidenced.
Regulation F shapes the records and messages you must protect.
The CFPB's Regulation F (12 CFR part 1006) implements the Fair Debt Collection Practices Act, and it creates data your security program has to cover.
A debt collector must keep records that evidence compliance with the FDCPA and Regulation F from the date it begins collection activity on a debt until three years after its last collection activity on that debt.
If it records collection calls, it must keep each recording for three years after the date of the call (12 CFR 1006.100).
Where those records and recordings hold customer information as the Safeguards Rule defines it (16 CFR 314.2(d)), they belong in your risk assessment, access controls, and encryption.
The rule's two-year disposal requirement makes an exception for information that law or regulation requires you to keep (16 CFR 314.4(c)(6)), so your retention schedule should reflect the Regulation F periods.
Regulation F also governs electronic contact.
Each email or text message to a consumer must include a clear and conspicuous statement describing a reasonable and simple way to opt out of further electronic communications to that address or number (12 CFR 1006.6(e)).
The rule also describes procedures for confirming that an email address or text-message number may be used, which help a collector avoid disclosing a debt to a third party (12 CFR 1006.6(d)(3) through (5)).
Those procedures depend on accurate records of consent, opt-outs, and where each address came from, so the integrity of your collection platform matters for compliance as well as security.
We secure and document those systems inside your Safeguards program; Regulation F compliance itself stays with your agency and its counsel.
Texas and Tennessee breach-notification law sits alongside the rule.
Texas law applies alongside the FTC Safeguards Rule.
Under Texas Business and Commerce Code §521.053, anyone who conducts business in Texas and owns or licenses computerized data that includes sensitive personal information must notify each affected individual of a breach without unreasonable delay and not later than the 60th day after determining that the breach occurred.
If the breach involves at least 250 Texas residents, the Texas Attorney General must also be notified, through the electronic form on the Attorney General's website, as soon as practicable and not later than the 30th day after that determination.
Those deadlines run separately from the FTC notice due within 30 days of discovering a notification event, so your incident response plan should track each one.
Tennessee Code Annotated §47-18-2107 requires notice to affected Tennessee residents no later than 45 days from discovery or notification of a breach, but subsection (i) states that the section does not apply to an information holder subject to Title V of the Gramm-Leach-Bliley Act, and the Safeguards Rule implements sections of that title (16 CFR 314.1).
Confirm with counsel how the Tennessee exclusion applies to your business.
