The baseline
Under GLBA, most dealerships that finance or lease vehicles are treated as financial institutions. The Safeguards Rule is not an IT suggestion. It is the law you operate under.
FTC · Auto dealer Safeguards FAQs, June 2025Compliance Infrastructure For Car Dealers
Technical Foundation That Supports FTC Requirements.
We build the technical layer. Compliance partnerships are available based on your jurisdiction and needs. We do not guarantee compliance, and we do not sell a compliance program.
Data compliance and advertising compliance are two different fronts. See Advertising Compliance / Guardian.
Book an Infrastructure AssessmentNew VehicleUsed / CPOService DriveF&IPartsDealer GroupsBDCMulti-RooftopNew VehicleUsed / CPOService DriveF&IPartsDealer GroupsBDCMulti-RooftopNew VehicleUsed / CPOService DriveF&IPartsDealer GroupsBDCMulti-Rooftop
The compliance crisis
Enforcement Is Already Active.
May 2024
Breach notification takes effect. If unencrypted customer information involving at least 500 consumers is acquired without authorization, the dealership must notify the FTC as soon as possible — and no later than 30 days after discovery.
FTC · Safeguards notification requirement, May 2024June 2025
The FTC issues Safeguards Rule guidance written specifically for motor vehicle dealers. When a regulator writes dealer-specific compliance FAQs, it is telling you what it plans to look for.
FTC · Auto dealer Safeguards FAQs, June 2025Penalties
Where the FTC can seek civil penalties, the current maximum is $53,088 per violation. How violations are counted depends on the law and the facts of the case.
FTC · 2025 civil penalty adjustmentsMarch 2026 · Pricing
A separate track from cybersecurity: the FTC sends warning letters to 97 dealership groups over deceptive pricing. Different rule, same signal — enforcement attention on dealers is active.
FTC · March 2026 · deceptive-pricing warning lettersMost rooftops are still running consumer-grade security on bank-grade obligations. That gap is where regulatory exposure, litigation, and coverage disputes start.
What the rooftop must support
Four Mandates. One Technical Layer.
01
FTC Safeguards Rule
Data protection and breach notification that has to be real — not a policy PDF.
02
GLBA Privacy Mandates
Customer information handling across intake, F&I, and service.
03
State-specific requirements
Controls that vary by jurisdiction. The technical layer has to support them.
04
Audit readiness
Documentation, logging, and recoverable evidence when examiners ask.
Six technical controls
We Build The Controls Examiners Ask For.
The legal and training layer is not ours. The technical foundation is.
Encrypt the file
Data Protection
Customer PII encrypted at rest and in transit, with access governance.
- At rest
- In transit
- Access governance
Prove the path
Audit Trail
Comprehensive logging of user access, system changes, and transaction records.
- Access logs
- Change logs
- Transactions
Limit the desk
Access Control
MFA, role-based limits, and credential security across the rooftop.
- MFA
- Roles
- Credentials
Stay awake
Monitoring
Real-time threat detection and technical-control auditing.
- Detection
- Anomaly alerts
- Technical audit
Contain first
Incident Response
Containment protocols and log retrieval that support FTC requirements.
- Containment
- Log retrieval
- Notification path
Stay open
Continuity
Offline disaster recovery, independent backups, high availability.
- Offline DR
- Backups
- Failover
Digital reality threats
The Threat Environment Has Already Shifted.
AI-enabled adversaries
Attacks by AI-enabled adversaries rose 89% during 2025. Speed and targeting have changed.
Source · CrowdStrike 2026 Global Threat Report · 2025 activity
Autonomous discovery
Vulnerability hunting no longer waits for a human operator.
Supply-chain targeting
One vendor breach froze more than 15,000 dealer locations. See CDK.
Source · CRN · June 2024
Email compromise
BEC aimed at dealerships — wire, title, and F&I desks.
What the rule actually asks for
Seven Requirements. Written Into The Rule.
Qualified Individual
One designated person overseeing the information security program.
16 CFR 314.4(a)
Written risk assessment
Documented risks to customer information, and how each is controlled.
16 CFR 314.4(b)
Encryption
Customer information encrypted in transit and at rest.
16 CFR 314.4(c)(3)
Multi-factor authentication
MFA for anyone accessing information systems.
16 CFR 314.4(c)(5)
Logging and monitoring
Authorized-user activity logged and monitored for unauthorized access.
16 CFR 314.4(c)(8)
Incident response plan
A written plan for responding to and recovering from a security event.
16 CFR 314.4(h)
Annual board report
The Qualified Individual reports in writing to leadership at least annually.
16 CFR 314.4(i)
Some requirements do not apply to institutions that maintain information on fewer than 5,000 consumers.
Source · 16 CFR Part 314 · Safeguards RuleWe build the technical side — encryption, MFA, logging, monitoring, and recovery. The program, the risk assessment, and the sign-offs stay with you and your compliance specialists.
Compliance partnerships
We Build The Technical Foundation. The Legal Layer Is Separate.
We build the technical foundation that supports compliance requirements. For the legal, regulatory, and training side, partnerships are available based on your specific jurisdiction and needs.
Clear scope. No overclaim. You keep the partner of your choice.
Technical sequence
01Protect
02Log
03Monitor
04Recover
Map Your Technical Exposure.
Book an Infrastructure Assessment. We map the technical layer examiners ask for — logs, encryption, access, recovery. Partnerships for the legal and training side are available based on your needs.