At a glance
- Breach notice to residents
- Without unreasonable delay
- State regulator notice
- Office of the Attorney General for the District of Columbia
- State consumer privacy law
- None
- Dealer bond
- $25,000
On this page
Federal rules every dealer follows
These apply in every state. Each links to a free tool or guide.
- FTC Safeguards Rule (16 CFR Part 314): a written security plan, a Qualified Individual, a risk assessment, MFA, encryption and the FTC breach notice. Safeguards checklist.
- Red Flags Rule (16 CFR 681): a written identity theft program; most dealers who arrange financing treat themselves as covered. Red Flags program.
- Privacy notice (Gramm-Leach-Bliley Act): give it to buyers who finance or lease. GLBA privacy notice.
- OFAC: never sell to someone on the Treasury's sanctions lists; keep records 10 years. Free OFAC search.
- Form 8300: report cash over $10,000 within 15 days. Form 8300 worksheet.
- Credit notices: adverse action within 30 days, and risk-based pricing notices. Adverse action notice.
- Used Car Rule: the Buyers Guide on every used car for sale. Buyers Guide.
- Advertised prices: include doc fees and other required fees, per the FTC's September 2026 FAQs. Ad and price check.
District of Columbia's data breach notice law
District of Columbia's breach notice law is D.C. Code § 28-3852. If personal information of District of Columbia residents is breached, it says to notify them promptly, in the most expedient time possible and without unreasonable delay, consistent with law-enforcement needs and measures to determine the scope of the breach and restore system integrity.
Who else to tell: the Office of the Attorney General for the District of Columbia. If the breach affects 50 or more District residents; promptly, without unreasonable delay, and no later than when notice is provided to residents (may not be delayed because the total number affected is not yet known). Nationwide consumer reporting agencies also if more than 1,000 persons are notified.
The law has a clause for businesses that follow the breach rules of their own federal regulator (D.C. Code § 28-3852(g) (entity that maintains breach procedures under GLBA Title V or HIPAA/HITECH rules and notifies residents accordingly is deemed in compliance as to resident notice, but must still give written notice to the AG under (b-1))). Some clauses like this cover only banks and credit unions, so don't count on it: plan to meet the state deadline as well as the FTC's.
The law reads: "The notification shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement"
This is on top of the federal rule. Under the FTC Safeguards Rule, a dealer must tell the FTC within 30 days of discovering a breach of unencrypted information about 500 or more consumers. How the FTC notice works.
Does District of Columbia have a consumer privacy law?
District of Columbia has no comprehensive consumer privacy law like California's as of October 31, 2026. The federal privacy rules still apply: a dealer that arranges financing or leases gives each of those buyers a privacy notice under the Gramm-Leach-Bliley Act. Make a free GLBA privacy notice.
District of Columbia dealer license and bond
A District of Columbia retail dealer license calls for a $25,000 surety bond; other amounts apply to some license types or sales volumes. Everything about the District of Columbia dealer license: who needs one, the lot rules and the application.
District of Columbia dealer compliance checklist
Write and sign your security plan
Name your Qualified Individual, do the risk assessment and turn on MFA for every system with customer data.
Adopt a Red Flags program
Check the buyer's ID on every deal and log what you checked.
Give the privacy notice
To every buyer who finances or leases, at or before signing.
Check every buyer against the OFAC lists
Keep the dated result in the deal jacket for 10 years.
Track cash
Add up related cash payments and file Form 8300 when they pass $10,000.
Train your staff on security
The Safeguards Rule asks for security awareness training for everyone who handles customer data. Keep a record of who finished it.
Put District of Columbia's breach deadline in your incident plan
Notice to residents as the law sets out, plus the Office of the Attorney General for the District of Columbia, and the FTC within 30 days at 500 or more consumers.
Check your ads
Advertised prices include doc fees and every fee all buyers pay.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
District of Columbia laws checked October 31, 2026 on the official sources linked below.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.