FTC Safeguards Rule: The Security Program GLBA Requires

Any business significantly engaged in financial activities as defined under the Bank Holding Company Act, excluding banks and entities regulated by prudential regulators, the SEC, or state insurance authorities for this purpose. The list is broader than intuition: auto dealers arranging financing or leasing, mortgage lenders and brokers, payday and title lenders, check cashers, money transmitters, debt collectors, tax preparation firms, non-bank fintechs, investment advisors not SEC-registered, real estate settlement services, and, added in 2021, 'finders' who bring buyers and sellers together for financial transactions. The FTC's dealer-focused outreach reflects reality: car dealerships are the rule's largest covered population and a stated enforcement priority. If customers' nonpublic personal information flows through your financing function, assume coverage and analyze out.

314.4 requires: (1) designate a Qualified Individual to implement and supervise the program; (2) a written risk assessment identifying reasonably foreseeable internal and external risks; (3) safeguards addressing the assessment, including access controls, data inventory and classification, encryption of customer information at rest and in transit, secure development practices, MFA for anyone accessing customer information systems, retention and disposal limits (dispose within two years of last use absent business need), change management, and activity monitoring; (4) regular testing, continuous monitoring or annual penetration tests plus biannual vulnerability assessments; (5) workforce training; (6) service provider selection, contracts, and periodic reassessment; (7) program evaluation and adjustment; (8) a written incident response plan; (9) the Qualified Individual's written report to the board or governing body at least annually. Elements 2's written form, 4's testing schedule, 8, and 9 are relaxed for institutions under the 5,000-consumer threshold.

Anyone with qualifications suitable to the institution's size and complexity, an employee, an affiliate's employee, or a service provider (a vCISO arrangement is expressly permitted, but then the institution must designate a senior internal member to direct and oversee them, retaining responsibility). The role owns implementation and supervision of the program and authors the annual written report covering program status, risk assessment results, testing outcomes, security events and responses, and recommendations. For small dealers and preparers this is typically the owner or office manager with an MSP behind them; the rule accepts that, what it does not accept is the role existing only on paper. In an FTC investigation, the QI's reports are the first documents requested, and their absence is a per-element violation.

The 2023 amendment, effective May 13, 2024, requires notice to the FTC (through its online portal) no later than 30 days after discovering a 'notification event': unauthorized acquisition of unencrypted customer information involving 500 or more consumers. Discovery is the first day the event is known to any person other than the perpetrator; acquisition is presumed from unauthorized access unless reliable evidence shows otherwise. The report names the institution, describes the event, data types, dates, and consumer count, and the FTC publishes the reports in a public database, a reputational lever the agency chose deliberately. Note what it is not: there is no federal consumer-notice requirement in the rule itself; state breach laws govern individual notice on their own, usually shorter, clocks. Encryption remains the practical exemption, encrypted data whose key is not compromised does not trigger the report.

Penalty-eligible from the first violation, unlike bare Section 5, each day of noncompliance and each element can count separately at over $50,000 per violation, inflation-adjusted. The FTC's enforcement history includes pre-amendment actions against mortgage companies and dealers for absent programs, PayPal/Venmo's GLBA-related order, and post-amendment matters pairing Safeguards counts with Section 5 in fintech and lead-generation cases; exam-style sweeps have focused on auto dealers. Investigations track the nine elements as a checklist: produce the risk assessment, the QI designation, MFA evidence, testing reports, vendor contracts, the IR plan, and the annual board report. The rule's prescriptiveness cuts both ways, compliance is more work than 'reasonableness', but provability is mechanical, and the artifact list doubles as the audit defense.