At a glance
- Threshold
- 500 or more consumers
- Deadline
- 30 days after discovery
- How
- The FTC's online form
- Rule
- 16 CFR 314.4(j)
On this page
What counts as a notification event
A "notification event" is the unauthorized acquisition of unencrypted customer information (16 CFR 314.2):
- Unencrypted includes encrypted data when the key was also taken.
- Acquisition is presumed when someone got unauthorized access, unless you have reliable evidence they didn't take anything.
- It must involve at least 500 consumers.
Common dealer examples: ransomware on the DMS, a stolen laptop with deal files, a phished email account holding credit applications.
When the clock starts
Notify the FTC "as soon as possible, and no later than 30 days after discovery." Discovery is the first day the event is known to any employee, officer or other agent of yours, other than the person committing the breach. A salesperson noticing counts.
The six things the FTC asks for
- Your name and contact information.
- The types of information involved.
- The date or date range, if you can tell.
- The number of consumers affected or potentially affected.
- A general description of what happened.
- Whether law enforcement has determined in writing that public notice would impede a criminal investigation or harm national security, with that official's contact details.
How to file
File on the FTC's Safeguards Rule notification form. Per the form page, your lawyer or IT vendor may file for you, reports may be made public, and you can send updates later as you learn more.
If law enforcement asks in writing for a delay, the rule allows one; longer delays need FTC staff approval.
What to do in the first days
Contain it
Disconnect affected machines, reset passwords, turn on MFA where it was missing, and call your IT provider.
Write down the discovery date
That day starts the 30-day clock.
Work out what and how many
Which systems, which data, how many people. At 500 or more, the FTC notice is due.
File with the FTC
Answer the six questions. Update the report later if the facts change.
Check other notices
Your state's breach law may require notices to buyers or the attorney general, and your lender and insurance agreements may too.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.