FTC Safeguards Rule Program for Car Dealers | DealSafe

Skip to content

Requirement	What the rule asks	How DealSafe handles it
1. Qualified Individual	One named person accountable for the program	Your GM or controller holds the title. DealSafe supplies the job description, calendar and backup.
2. Risk assessment	Written, with mitigation plans, reassessed periodically	Guided, dealership-specific, video-led, stored and versioned.
3. Access controls	Limit who reaches customer data; review it; no shared logins	Access reviews per rooftop. PII locked to GM and F&I in the product.
4. Encryption	At rest and in transit, or documented alternatives	System inventory with gaps tracked. DealSafe itself is encrypted at rest and in transit.
5. Multi-factor authentication	MFA for anyone on your information system	MFA checklist per system with evidence. DealSafe's own logins require MFA.
6. Monitor and test	Continuous monitoring, or annual pen test plus semiannual scans	Testing calendar, vendor coordination, results logged.
7. Employee training	Security awareness for all staff, refreshed	Short role-based videos, auto-assigned. Every completion logged.
8. Vendor oversight	Capable providers, contracts, periodic reassessment	Vendor register with contract language and reminders.
9. Incident response plan	Written: roles, decisions, remediation, reporting	Living template, customized, drilled annually, versioned.
10. Annual board report	The Qualified Individual reports in writing, at least yearly	One click compiles a board-ready report.

The Desk and above add the PII lock and the access log. Everything else is in every tier.

Multi-factor sign-in, required

Every login that can reach customer data needs a second factor: an authenticator app or a passkey. It cannot be turned off. Sales sees a name and a deal status, nothing else. Every tier.

Every file scanned for malware

Every document uploaded to DealSafe is scanned. A file that fails is rejected. Every tier.

Encryption in layers

Encrypted at rest and in transit. Social Security numbers, license images and credit data get a second layer before storage.

PII locked by role, every access logged

General managers and finance managers see the file. The sales floor sees the name and the deal status, never the data. Each access is logged to your Book of Evidence. The Desk and above.

The FTC says dealers are financial institutions. Its own FAQ says so.

The FTC's dealer FAQ states that most automobile dealers who finance or lease automobiles are financial institutions under the Safeguards Rule. BHPH stores are doubly covered: they extend the credit themselves. The rule is not a policy you buy. It is a program you run, with written proof.

Dealerships holding information on fewer than 5,000 consumers are exempt from four requirements only: the written risk assessment, monitoring and testing, the incident response plan, and the annual board report. The Qualified Individual, access controls, encryption, MFA, training and vendor oversight still apply. DealSafe scales the program to your size.

See Red Flags & ID verification · See training & audit support · See Secure Customer Intake

Related reading: The FTC Safeguards Rule for auto dealers: a plain-English checklist · How to choose dealer compliance software: a buyer's guide · Enforcement Watch: FTC, CFPB and California actions that touch dealers · All guides and news

30 days

Since May 13, 2024: notify the FTC as soon as possible, and no later than 30 days after discovery.

500+

Consumers whose unencrypted customer information is involved. Reports go through an FTC online form and are posted in a public database.

3 files

The incident plan, the encryption inventory, and the evidence file stand between a contained event and a public one. Unauthorized access is presumed to be acquisition unless you have reliable evidence otherwise. DealSafe keeps all three current.

Is the Safeguards Rule actually being enforced against dealers?

The FTC's flagship dealer-channel case was against a dealer software provider (DealerBuilt, 2019) after data on about 12.5 million consumers was exposed. It settled with a 20-year compliance order. Dealer-side enforcement today runs through Section 5 actions on pricing and add-ons, and every public breach report invites a look at the whole Safeguards program. The exposure is real. It is also manageable, with a documented program.

What are the penalties?

Up to $53,088 per violation under FTC Act Section 5(m)(1)(A), the inflation-adjusted figure effective January 17, 2025. Violations can be counted per affected consumer, which is why we say "up to" once and then get to work.

Can we outsource the Qualified Individual role?

The rule allows the Qualified Individual to work for an affiliate or service provider. DealSafe supports the role either way. Responsibility for the program stays with your dealership, and we make sure you can prove it was discharged.

Does DealSafe replace my IT provider?

No. DealSafe runs the compliance program and coordinates testing. Your IT provider or MSP keeps the network running. We document what they do so it counts in an audit.

Is this legal advice?

No. DealSafe is compliance software plus specialist support, not a law firm. For legal judgment calls, we will tell you to call your counsel, and we will hand them a clean file.