Do Auto Dealers Have to Comply with the FTC Safeguards Rule? (2026)

Yes — if your dealership arranges financing or leasing, you are almost certainly a "financial institution" under the FTC Safeguards Rule, and a specific written cybersecurity program is required of you by federal regulation, not by a vendor's preference. The FTC has said plainly that the Rule "applies to financial institutions subject to the FTC's authority," and "that includes most automobile dealers who finance or lease automobiles" (FTC Safeguards Rule FAQ for auto dealers).

That surprises a lot of owners. The sign out front says "dealership." The regulation treats you like a lender — because every time your F&I office pulls a credit application, you are handling exactly the kind of customer financial data the Gramm-Leach-Bliley Act was written to protect.

This guide covers who's covered, what the Rule actually requires, the two dates that matter, and how to get a defensible program in place without turning your store into an IT shop.

Why dealerships are "financial institutions"

The Safeguards Rule implements the Gramm-Leach-Bliley Act (GLBA), and GLBA's definition of "financial institution" is broad and deliberately non-bank. The FTC's guidance lists 13 kinds of businesses it covers — mortgage lenders, finance companies, tax preparers, and more — and notes that even that list is not exhaustive (FTC Safeguards Rule: What Your Business Needs to Know).

A dealership that helps a customer secure a loan or a lease is "significantly engaged" in financial activities. That triggers coverage. A store that somehow sold only for cash with no financing arm might argue it's out of scope — but that describes almost no modern dealership. If you run an F&I desk, assume you're in.

What the Rule actually requires

The Safeguards Rule does not hand you a checklist of products to buy. It requires a comprehensive written information security program appropriate to your size and the sensitivity of the data you hold (FTC auto-dealer FAQ). Inside that program, several elements are explicitly named:

• A designated Qualified Individual to run the program. This is a real, accountable role — not a line item. It can be an employee or a qualified third party, but someone owns it.
• A written risk assessment that the program is built on. The controls have to follow from an honest look at where your customer data lives and how it could be exposed.
• Access controls — only the people who need customer information can reach it.
• Encryption of customer information at rest and in transit — both stored data and data moving across networks.
• Multi-factor authentication for anyone who accesses the information system — not just email, but the systems that hold customer data.
• Logging and monitoring of activity, so you can detect and reconstruct unauthorized access.

The FTC names these directly: required safeguards "include access controls, encryption of customer information at rest and in transit, multifactor authentication for anyone who accesses your information system, and logging and monitoring activity, among other things" (FTC).

If you have read a cyber-insurance application lately, this list will look familiar. That is not a coincidence — the controls underwriters score and the controls the Safeguards Rule requires are nearly the same controls.

The two dates that matter

June 9, 2023. The expanded safeguards — the Qualified Individual, the specific technical controls above — became enforceable. A dealership without a written program is already past the deadline, not approaching one.

May 13, 2024. A breach-notification amendment took effect. Covered businesses must notify the FTC "as soon as possible – and no later than 30 days after discovery – of a security breach involving the unauthorized acquisition of at least 500 consumers' unencrypted information" (FTC). For a dealership, 500 customer records is a small number — a single compromised F&I database can blow past it.

Why this is not a paperwork exercise

The data a dealership holds is unusually rich: Social Security numbers, income, employment, and bank details on every financed deal. That is a premium target. And the industry already has its cautionary tale — the 2024 attack on the CDK Global dealer-management platform took thousands of dealerships offline and is estimated to have cost the industry more than $1 billion (Channel Futures). That was a single-vendor outage; it shows how completely a modern store depends on systems that can be attacked or knocked down.

The point is not fear. It is that the Safeguards Rule is asking for the same things that would have blunted that kind of event: tested backups, segmented systems, monitored endpoints, and a plan for when something goes wrong.

How to satisfy the Rule without becoming an IT department

The controls map cleanly onto a managed security program. In practice, getting a dealership compliant looks like this:

1. Stand up the Qualified-Individual function and a real risk assessment. Someone accountable, and an honest map of where customer data lives — DMS, F&I tools, email, back-office, showroom machines.
2. Put MFA and encryption on the systems that hold customer data, not just the obvious ones. The Rule says "anyone who accesses your information system."
3. Get managed detection and response on the DMS and F&I systems — and the back-office and showroom machines that connect to them — so an intrusion is caught and contained, and logging/monitoring is satisfied as a byproduct.
4. Add identity and email security on the inboxes that handle deals, lender communications, and customer documents, where account takeover and invoice fraud begin.
5. Document everything into one evidence package that satisfies both an FTC inquiry and your cyber-insurance renewal.

That last point matters: the same evidence answers the regulator and the carrier. You build it once.

This is exactly the program Obsidian Ridge operates for dealerships — see the Auto Dealerships security & compliance page for how the controls line up against the Safeguards Rule. If you would rather start by finding the gaps, the Cyber Insurance Readiness Sprint maps your current state against the required controls in a fixed-scope, seven-business-day engagement and produces the written program and evidence you need.

The bottom line

If you finance or lease, the FTC Safeguards Rule applies to you, the deadline has already passed, and the controls it requires are the same ones that protect your store from the kind of event that took the industry offline in 2024. The good news is that one well-run program satisfies the regulation, prepares the cyber-insurance application, and actually reduces the risk — handled for you, so your team can sell cars.

Want to know where your store stands against the Safeguards Rule today? Book a dealership readiness assessment.