The FTC Safeguards Rule: what small businesses need to know
Many business owners assume financial privacy rules only apply to banks. The Federal Trade Commission disagrees. Its Safeguards Rule (16 CFR Part 314) applies to a long list of non bank "financial institutions," and the amended rule that took full effect in June 2023 added specific, technical requirements.
Who it covers
If your business offers financial products or services to consumers, it likely applies. Examples include auto dealers that arrange financing or leases, mortgage brokers, tax preparers, payday and personal lenders, collection agencies, and some investment and real estate settlement businesses.
What it requires
The core requirement is a written information security program. The rule spells out what that program must include:
- A Qualified Individual responsible for the program. This can be an employee or an outside provider, but the business remains responsible.
- A written risk assessment of the customer information you hold and the threats to it.
- Safeguards based on that assessment, including access controls, an inventory of your data and systems, encryption of customer information in transit and at rest, and multifactor authentication for anyone accessing customer information.
- Secure disposal of customer information, generally within two years of last use unless you have a business or legal reason to keep it.
- Monitoring and testing: either continuous monitoring, or an annual penetration test and vulnerability assessments at least every six months.
- Security awareness training for staff.
- Oversight of service providers who handle your customer information.
- A written incident response plan.
- A written report from the Qualified Individual to your board or owner at least once a year.
Since May 2024, covered businesses must also notify the FTC within 30 days of discovering a security event involving unencrypted information of 500 or more consumers.
The small business exemption
Businesses that maintain customer information on fewer than 5,000 consumers are exempt from some of the written requirements: the written risk assessment, the incident response plan, the annual report, and the specific penetration testing and vulnerability assessment schedule. The rest of the rule, including MFA, encryption, training and a written program, still applies.
Where to start
- Name your Qualified Individual.
- Inventory where customer information lives: your dealer or practice management system, email, file shares, paper.
- Turn on multifactor authentication everywhere customer data can be reached. This is usually the single biggest gap.
- Run a vulnerability assessment to establish a baseline.
- Write it down. A program that exists only in someone's head does not satisfy the rule.
This article is general information, not legal advice. If you want help turning the rule into a concrete plan, our compliance readiness service starts with exactly this gap analysis.