FTC Safeguards Rule Compliance for Auto Dealers

Why this applies to you

If your dealership takes credit applications or arranges financing, including brokering a deal to a lender like Westlake, you are a “financial institution” under the Gramm-Leach-Bliley Act. That puts you under the FTC Safeguards Rule, in full effect since June 9, 2023. Most independent lots don’t know it applies to them.

DigiTechne writes the security program to match how your lot actually operates, stands up the required controls without ripping out your existing systems, and can serve as your outsourced Qualified Individual.

What the rule requires

• A designated Qualified Individual to oversee the program (can be outsourced)
• A written risk assessment
• Access controls
• Encryption at rest and in transit
• Multi-factor authentication
• Secure disposal and change management procedures
• Monitoring and logging
• Penetration testing or continuous monitoring
• Staff security training
• Vendor oversight
• A written incident response plan
• An annual written report from the Qualified Individual

The small-lot exemption

Dealers holding data on fewer than 5,000 consumers are exempt from four pieces of the rule under 16 CFR 314.6: the written risk assessment, the testing and monitoring requirement, the incident response plan, and the annual report. Every other requirement above still applies.

What it costs to get this wrong

Penalties run up to $53,088 per violation, and each day of noncompliance can count as a separate violation. Breaches affecting 500 or more consumers must be reported to the FTC, a requirement in effect since May 13, 2024, and become public record. “I didn’t know” is not a defense.

Read the FTC’s own Safeguards Rule overview and the auto-dealer-specific FAQ.