At a glance
- Who
- Dealers that finance, arrange financing or lease long term
- Small dealer exemption
- Fewer than 5,000 consumers: four parts don't apply
- Breach notice
- 500+ consumers, 30 days
- Enforced by
- The FTC
On this page
Why the rule covers car dealers
The FTC's dealer FAQ: "Automobile dealers who finance (or facilitate the financing of) automobiles for consumers are financial institutions." The reason it gives is that "lending money is considered a financial activity under the relevant federal law." Dealers that lease cars long term are covered too.
If you only ever sell for cash and never arrange financing, the rule likely doesn't cover you, because cash buyers aren't "customers" under it.
People: who runs it and who is trained
- A Qualified Individual oversees the program (314.4(a)). Who can hold the role.
- Security training for everyone, updated as your risks change (314.4(e)).
- Qualified security staff, your own or a provider's, who keep their knowledge current (314.4(e)).
Paper: the assessment and the plan
- A risk assessment of the risks to customer information, repeated periodically (314.4(b)). Over the threshold it must be written, with criteria for rating risks (314.4(b)(1)).
- A written program that answers each part of the rule, kept up to date (314.4(g)). See what goes in one.
- A written incident response plan (314.4(h)) and a yearly written report to the owner or board (314.4(i)), at 5,000+ consumers.
Systems: the technical safeguards
Under 314.4(c):
- Access controls, so each person sees only what their job needs, reviewed periodically.
- An inventory of the data, devices, systems and people that touch customer information.
- Encryption of customer information in transit and at rest.
- MFA for anyone accessing any information system: your DMS, CRM, credit portal, email and e-contracting.
- Secure disposal of customer information you no longer need, within the limit in 314.4(c)(6), and a periodic review of how long you keep it.
- Change management, and logging of what users do.
And testing (314.4(d)): regular testing or monitoring for everyone; over the threshold, continuous monitoring or a pen test every 12 months and vulnerability scans every 6 months.
Vendors: the companies that touch your data
Pick providers that can protect the data, require safeguards in their contracts, and review them periodically based on their risk (314.4(f)). For a dealer that means your DMS, CRM, credit bureaus, e-contracting and website providers, and your IT company.
The 5,000-consumer exemption
16 CFR 314.6 lifts four parts for institutions with customer information on fewer than 5,000 consumers:
- 314.4(b)(1) written risk assessment
- 314.4(d)(2) yearly pen test and twice-yearly scans
- 314.4(h) written incident response plan
- 314.4(i) yearly written report to the board
The FTC hasn't said how to count, and the rule says "consumers", not "customers". Count everyone whose customer information you keep, including past financed buyers you still hold records on, and be honest with yourself.
Breach notice to the FTC
If unencrypted customer information on 500 or more consumers is acquired without authorization, notify the FTC within 30 days of discovery (314.4(j)). The full breach guide.
Enforcement
The FTC enforces the rule. Part 314 itself states no penalty amount, so we don't quote one. In our search of the FTC's auto industry case list for 2023 to 2026, we found no Safeguards case against a dealer, but that is not a reason to wait: the breach notice requirement means a serious breach goes straight to the FTC.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.