At a glance
- Who it's for
- Car dealers that arrange or offer financing, or lease long term. Use the checklist to score your store.
- Small dealer exemption
- Fewer than 5,000 consumers (16 CFR 314.6)
- Breach notice
- 500+ consumers: tell the FTC within 30 days
- Rule
- 16 CFR 314.4
On this page
Who the Safeguards Rule covers
The FTC's dealer FAQ is plain: "Automobile dealers who finance (or facilitate the financing of) automobiles for consumers are financial institutions." Dealers that lease cars long term are covered too (the rule's own example, 16 CFR 314.2(h)(2)(ii)).
The rule protects "customer information". Per the FAQ, a name and address alone usually aren't customer information; they become it once a record shows the person got financing through you. Cash-only buyers are not customers for this purpose.
The Safeguards Rule checklist
| Part | What you need | Under 5,000? |
|---|---|---|
| 314.4(a) | A Qualified Individual who oversees the program | Required |
| 314.4(b) | A risk assessment, repeated periodically | Required |
| 314.4(b)(1) | That assessment in writing, with rating criteria | Exempt |
| 314.4(c)(1) | Access controls: each user sees only what the job needs | Required |
| 314.4(c)(2) | An inventory of data, devices, systems and people | Required |
| 314.4(c)(3) | Encryption in transit and at rest | Required |
| 314.4(c)(4) | Checks on the apps you build or use | Required |
| 314.4(c)(5) | MFA for anyone who accesses any information system | Required |
| 314.4(c)(6) | Secure disposal of data you no longer need | Required |
| 314.4(c)(7) | Change management | Required |
| 314.4(c)(8) | Logging and monitoring of user activity | Required |
| 314.4(d)(1) | Regular testing or monitoring of key controls | Required |
| 314.4(d)(2) | Continuous monitoring, or a pen test every 12 months and scans every 6 | Exempt |
| 314.4(e) | Security training for staff | Required |
| 314.4(f) | Vendor oversight, with safeguards in contracts | Required |
| 314.4(g) | Keep the program up to date | Required |
| 314.4(h) | A written incident response plan | Exempt |
| 314.4(i) | A yearly written report to the owner or board | Exempt |
| 314.4(j) | Notify the FTC of a breach of 500+ consumers | Required |
Paraphrased from the rule text. Read 16 CFR 314.4 for the exact words.
The 5,000-consumer exemption
16 CFR 314.6 says: "Section 314.4(b)(1), (d)(2), (h), and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers."
So under 5,000 consumers you don't need:
- 314.4(b)(1) written risk assessment
- 314.4(d)(2) yearly pen test and twice-yearly scans
- 314.4(h) written incident response plan
- 314.4(i) yearly written report to the board
Everything else still applies, including a risk assessment (just not the written form with its criteria) and regular testing. The FTC hasn't said how to count toward 5,000, and the rule says "consumers", which is broader than "customers". Use your best honest count of everyone whose customer information you keep.
Telling the FTC about a breach
If unencrypted customer information about 500 or more consumers is acquired without authorization, notify the FTC as soon as possible and no later than 30 days after you discover it, on the FTC's online form (16 CFR 314.4(j)). Unauthorized access counts as acquisition unless you have reliable evidence it wasn't. Read the full breach guide.
Rules checked and limits
Rules checked October 31, 2026. We read every rule on this page in the eCFR or on the agency's own site, and each is linked in the sources below. We re-check them every quarter.
Templates and tools, not legal advice. CarShots is software, not a law firm. For a question about your own dealership, ask your attorney or your state dealer association.