Most companies covered by the FTC Safeguards Rule do not think of themselves as financial institutions. They prepare tax returns, sell cars, broker mortgages, collect debts or introduce buyers to sellers. The rule reaches them anyway, and it does not ask them to be reasonable in general terms. It names a designated officer, a written risk assessment, encryption, multi-factor authentication, a testing cadence and a report to the board.
The text is short enough to read in an afternoon, which is worth doing before you buy anything, because the summaries circulating online get the penalties, the exemption and the deadlines wrong.
What Is the FTC Safeguards Rule?
The Safeguards Rule is the Federal Trade Commission's regulation implementing the data security half of the Gramm-Leach-Bliley Act. Its formal name is Standards for Safeguarding Customer Information, it has been in force since 2003, and it was rewritten in 2021 and amended again in 2023.
It is not a framework or a set of goals. It is a rule with paragraph numbers, and the obligation is singular: build a written information security program appropriate to your size, run it, and keep running it.
Two phrases do the work. Written means an unwritten practice, however good, does not satisfy the rule. Appropriate to your size and complexity means a four-person tax office and a national auto group answer the same elements at different weights, and that the defensible program is built on your own risk assessment rather than a template. Firms already carrying security obligations across the financial sector will recognize the content; what differs is that the FTC wrote it down as a rule.
Who Does the FTC Safeguards Rule Apply To?
Section 314.1(b) sets the boundary. The rule covers financial institutions the FTC has jurisdiction over, meaning those not already answering to a banking regulator, the SEC, the National Credit Union Administration or a state insurance authority. A business qualifies if it is significantly engaged in an activity financial in nature or incidental to one, as described in section 4(k) of the Bank Holding Company Act.
The test looks at what a business does, not what it calls itself, and section 314.2(h)(2) works through 13 examples of how ordinary that can be: a retailer issuing its own credit card, an auto dealership leasing cars for longer than 90 days, a real estate or personal property appraiser, a check printer, a check casher, a tax preparation service, a real estate settlement provider, a mortgage broker, an investment advisory company, a credit counseling service and a company acting as a finder. Paragraph (h)(4) draws the other edge: a retailer whose only credit is occasional layaway is not covered, nor is one that merely accepts cards it did not issue, nor a merchant that lets a customer run a tab, nor a grocery store that cashes checks.
Auto dealers are the group the FTC has spent the most effort on. Its June 2025 staff FAQ for automobile dealers states that dealers who finance or arrange financing are financial institutions because lending is a financial activity, and that leasing for longer than 90 days qualifies on its own.
What you must protect is narrower than what you hold. Customer information, under section 314.2(d), is any record containing nonpublic personal information about a customer, in paper, electronic or other form, and a customer is a consumer with a continuing relationship. The dealer FAQ works this out: an approved financing application is customer information, and so is a list of everyone who financed with you, while a name and address collected from every buyer for recall notices is not, and neither are service records or aggregate sales data.
When Did the FTC Safeguards Rule Take Effect?
The rule people comply with today is mostly four years old, and obligations attached at four separate moments. Several summaries still cite a December 2022 deadline the FTC moved.
- Standards for Safeguarding Customer Information published at 67 FR 36493
- The original rule takes effect, asking for a written program and naming almost no controls
- The amended rule adds the Qualified Individual, risk assessment, encryption, multi-factor authentication, logging and testing
- Compliance date for the new provisions, moved back six months from December 2022
- The notification amendment adds paragraph 314.4(j) and defines a notification event
- Section 314.4(j) takes effect. Reporting within 30 days becomes mandatory
- FTC staff publish Safeguards Rule FAQs for automobile dealers
The FTC's business blog confirms it: the 2021 updates took effect on June 9, 2023, and the reporting amendment gave businesses six months before it applied.
What Does the FTC Safeguards Rule Require?
The FTC's own explainer says section 314.4 identifies nine elements your program must include, running from (a) to (i). The notification duty at (j) sits alongside them, which is why the agency's 2025 dealer FAQ counts ten. Nothing changed in the rule between the two documents.
| Element | Section | What it requires |
|---|---|---|
| Qualified Individual | 314.4(a) | One named owner. May sit at a service provider, in which case you keep responsibility and name a senior person to oversee them |
| Risk assessment | 314.4(b) | Written, with criteria for categorizing risks and deciding what is mitigated or accepted. Repeated periodically |
| Safeguards | 314.4(c) | Eight named controls, below |
| Testing | 314.4(d) | Continuous monitoring, or annual penetration testing plus vulnerability assessments every six months |
| Personnel | 314.4(e) | Security awareness training reflecting the risk assessment, plus qualified security staff kept current |
| Service providers | 314.4(f) | Select for capability, require safeguards by contract, reassess periodically on risk |
| Keeping current | 314.4(g) | Adjust for test results, material business changes and new assessments |
| Incident response plan | 314.4(h) | Written, covering goals, processes, roles, communications, remediation, documentation and revision |
| Board report | 314.4(i) | Written, at least annually, on program status, risk decisions, vendors, testing and security events |
Paragraph (c) is where the rule stops being a management standard and names technology: access controls limiting users to what their duties need; an inventory of data, personnel, devices, systems and facilities; encryption of customer information in transit over external networks and at rest, with compensating controls only where the Qualified Individual finds encryption infeasible and approves them in writing; secure development practices for in-house applications and a process for assessing third-party ones; multi-factor authentication for any individual accessing any information system; secure disposal no later than two years after the information's last use for that customer; change management; and centralized logging of authorized user activity.
Section 314.2(k) defines multi-factor authentication as at least two of a knowledge factor, a possession factor and an inherence factor, which settles whether a password plus a security question counts.
The cadence in paragraph (d)(2) is the requirement most often bought wrong. It is a choice, not a stack: either continuous monitoring capable of detecting changes that create vulnerabilities, or annual penetration testing plus vulnerability scanning at least every six months. Companies routinely buy one test a year and skip the scans, which satisfies neither branch.
The rest is program hygiene with an evidentiary edge. Security awareness training has to reflect the risks your assessment found. The written incident response plan has seven required contents, and the one nobody does is the post-event revision. The Qualified Individual can be an outside security leader, which is how most small covered businesses satisfy paragraph (a) at all. Service provider oversight deserves more weight than its two lines suggest: the 2026 Verizon Data Breach Investigations Report found third-party breaches up 60 percent, now 48 percent of all breaches.
What Is a Notification Event Under the Safeguards Rule?
Since May 13, 2024, a covered institution has had to tell the FTC when customer information gets out. The threshold and the clock are fixed, and neither depends on whether anyone was harmed.
The presumption is the operative sentence. You do not get to conclude that data was merely viewed rather than taken; you have to show it, with evidence, or you report. That is why logging under paragraph (c)(8) matters beyond detection.
The Commission's final notification rule estimated the requirement would affect roughly 115 financial institutions each year, at about five hours per report, and stated that it intends to enter notification event reports into a publicly available database. Reporting is not a private conversation with a regulator, and it discharges nothing else: state notification statutes run on their own deadlines, and telling the Commission is not telling the people affected or covering the steps individuals take after their data leaks.
Who Is Exempt From the FTC Safeguards Rule?
There is one exemption, it is partial, and it is smaller than people assume. Every summary mentions the 5,000 consumer threshold and almost none says which requirements it removes.
Read what remains. Below the threshold you still owe a written program under section 314.3(a), a Qualified Individual, a risk assessment, all eight safeguards in paragraph (c), service provider oversight, training, and the 30 day notification duty. The exemption removes four paragraphs of documentation and testing. It does not create a small business carve-out.
What the FTC Safeguards Rule Does Not Require
Much of what gets bought in the name of Safeguards Rule compliance answers a requirement that is not in the text.
There is no certification: no body certifies compliance, the FTC issues no seal, and nothing in Part 314 contemplates an audit or an auditor. There is no registry and no filing apart from a notification event. There is no approved product list, no named algorithm and no mandated tool category, because section 314.2(f) defines encryption by what it accomplishes and leaves the choice to you. There is no requirement to notify consumers, which comes from state law instead. And there is no fixed control baseline beyond paragraph (c), since the rest of the program follows from your own risk assessment.
What Are the Penalties for Violating the FTC Safeguards Rule?
This is the most misstated part of the topic, and the correction is simple: neither the rule nor the statute names a fine.
Part 314 contains no penalty provision. 15 U.S.C. 6805, the Gramm-Leach-Bliley Act's enforcement section, allocates enforcement among the agencies and puts FTC-jurisdiction financial institutions under paragraph (a)(7), to be enforced under the Federal Trade Commission Act. It sets no dollar figure, for institutions or for individuals.
What enforcement looks like is more instructive than any number. In the Commission's clearest Safeguards Rule case, a mortgage analytics company was alleged to have failed to oversee a vendor that stored scanned mortgage documents on a cloud server in plain text with no password. The settlement announced in December 2020 carried no fine. It required a comprehensive data security program, biennial assessments by an independent organization, an annual compliance certification from a senior executive, and reports of any future breach to the Commission within 10 days.
Money arrives at the second offense. Section 5(l) of the FTC Act makes each violation of a final Commission order a separate offense, and each day of a continuing failure to obey a separate offense again. The maximum is inflation-adjusted: 16 CFR 1.98 currently sets it at $53,088 for penalties assessed after January 17, 2025. A company that ignores the rule faces an order. A company that then ignores the order faces arithmetic.
Safeguards Rule vs the GLBA Privacy Rule
Two FTC rules implement the Gramm-Leach-Bliley Act, and covered companies routinely satisfy one while assuming it covered the other.
The Privacy Rule, at 16 CFR Part 313, governs disclosure: notices describing your information practices and, with exceptions, an opportunity to opt out before you share nonpublic personal information with a non-affiliated third party. The Safeguards Rule governs protection, saying nothing about who you may share information with and everything about how you secure what you hold. They also reach different people: the Privacy Rule can attach to a consumer who asked about financing and never applied, while the Safeguards Rule attaches to customer information, which requires a continuing relationship.
How to Comply With the FTC Safeguards Rule
The order below is the rule's order. Doing it in a different sequence produces controls nobody can justify and a risk assessment written backwards to fit them.
When to Hire Help With Safeguards Rule Compliance
Two parts of this rule are hard to run internally at a small company: the Qualified Individual role, which is a standing job rather than a project, and the testing branch, which needs skills most covered businesses have no reason to employ full time.
Key takeaways
- The Safeguards Rule is 16 CFR Part 314, issued under the Gramm-Leach-Bliley Act, and it requires a written information security program sized to your business.
- It binds non-bank financial institutions under FTC jurisdiction, defined by activity rather than label: tax preparers, auto dealers that finance or lease, mortgage brokers, appraisers and finders among 13 examples in section 314.2(h)(2).
- Section 314.4 sets nine elements, and paragraph (c) names eight controls including encryption in transit and at rest and multi-factor authentication for anyone accessing any information system.
- Testing is a choice between continuous monitoring and annual penetration testing plus vulnerability assessments every six months. One test a year satisfies neither branch.
- A notification event of 500 or more consumers goes to the FTC within 30 days of discovery, and unauthorized acquisition is presumed unless your evidence rebuts it.
- The fewer than 5,000 consumers exemption removes exactly four paragraphs: the written risk assessment, the testing cadence, the written incident response plan and the annual board report.
- Neither Part 314 nor 15 U.S.C. 6805 sets a fine. Safeguards cases produce orders, and civil penalties arrive only when a company breaks one.
Common questions
What is the FTC Safeguards Rule in simple terms?
A federal rule requiring companies that handle consumers' financial information, but are not regulated as banks, to maintain a written security program. It has to include a designated responsible person, a risk assessment, controls such as encryption and multi-factor authentication, training, vendor oversight and an incident response plan.
Who has to comply with the FTC Safeguards Rule?
Financial institutions under FTC jurisdiction, meaning those not supervised by a banking regulator, the SEC, the NCUA or a state insurance authority. Section 314.2(h)(2) gives 13 examples, including tax preparers, mortgage brokers, auto dealers that finance or lease, check cashers, appraisers and finders.
Is the Safeguards Rule the same as GLBA?
No. Gramm-Leach-Bliley is the statute. The Safeguards Rule is one of the FTC's regulations implementing it, covering data security. The Privacy Rule at 16 CFR Part 313 is the other, covering notices and opt-outs for sharing information with non-affiliated third parties.
Does the FTC Safeguards Rule apply to car dealerships?
Yes, for most of them. FTC staff guidance published in June 2025 states that dealers who finance or arrange financing are financial institutions, and that leasing for longer than 90 days independently qualifies. What is covered is customer information tied to the financing or lease, not every record in the dealership.
Does the Safeguards Rule require encryption?
Yes, in transit over external networks and at rest, under section 314.4(c)(3). The exception is narrow: where you determine encryption is infeasible you may use effective alternative compensating controls, and the Qualified Individual has to review and approve them.
Does the Safeguards Rule require multi-factor authentication?
Yes, under section 314.4(c)(5), for any individual accessing any information system, unless the Qualified Individual approves equivalent or more secure controls in writing. Section 314.2(k) defines it as at least two of a knowledge factor, a possession factor and an inherence factor.
What is a Qualified Individual under the Safeguards Rule?
The single person responsible for overseeing, implementing and enforcing your information security program, required by section 314.4(a). They can be your employee or work for an affiliate or service provider. If they are external, you keep responsibility and designate a senior person of your own to oversee them.
When do I have to report a breach to the FTC?
As soon as possible, and no later than 30 days after discovery, when a notification event involves at least 500 consumers. Discovery is the first day the event is known to any employee, officer or agent other than the person who caused it. The report goes on an electronic form.
What are the penalties for violating the FTC Safeguards Rule?
Part 314 sets none, and neither does the Gramm-Leach-Bliley Act's enforcement section. The FTC enforces under the FTC Act, and its cases have produced orders requiring a security program, independent biennial assessments and executive certification. Civil penalties, capped at $53,088 per violation under the current schedule, apply when a company violates a final order.
Do I need a written information security plan if I am a small business?
Yes. Section 314.6 exempts institutions holding information on fewer than 5,000 consumers from four paragraphs only: the written risk assessment, the testing cadence, the written incident response plan and the annual board report. The written program applies regardless of size.
On this page
- What Is the FTC Safeguards Rule?
- Who Does the FTC Safeguards Rule Apply To?
- When Did the FTC Safeguards Rule Take Effect?
- What Does the FTC Safeguards Rule Require?
- What Is a Notification Event Under the Safeguards Rule?
- Who Is Exempt From the FTC Safeguards Rule?
- What the FTC Safeguards Rule Does Not Require
- What Are the Penalties for Violating the FTC Safeguards Rule?
- Safeguards Rule vs the GLBA Privacy Rule
- How to Comply With the FTC Safeguards Rule
- When to Hire Help With Safeguards Rule Compliance
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.