Upstate South Carolina car dealerships
FTC Safeguards Rule compliance for car dealerships, handled by someone who's done it.
If your dealership arranges financing or leases, the FTC treats it as a financial institution under the Gramm-Leach-Bliley Act. ROI Innovations serves as your outsourced Qualified Individual, writes your written information security program (WISP), and verifies the controls that back it up.
✓ Served as Qualified Individual for a Ford franchise dealership
✓ Microsoft 365 and email security set up, not just written down
✓ Saint Somerville, based in Anderson, South Carolina. On-site across the Upstate
ROI Innovations is an independent consultant, not affiliated with or endorsed by the Federal Trade Commission. Information on this site is general and is not legal advice.
Why it applies to you
Why the FTC treats your dealership like a bank
Under the Gramm-Leach-Bliley Act, the FTC treats businesses that are significantly engaged in financial activities as financial institutions. Arranging auto loans and leases counts, which puts most dealerships under the FTC Safeguards Rule (16 CFR Part 314), the same rule that covers mortgage brokers and tax preparers.Every credit application holds what identity thieves want most: Social Security numbers, income, bank details, and driver's license numbers. The rule requires a written program to protect that information, a named person in charge of it, and proof that the controls work.The amended rule's main requirements took effect June 9, 2023. Since May 13, 2024, dealerships must also report qualifying data breaches to the FTC.
What the rule requires
The 10 requirements of the FTC Safeguards Rule for dealerships
These come from section 314.4 of the rule. Items marked (5,000+) are relaxed for dealerships that keep information on fewer than 5,000 consumers.
Last reviewed October 2026. Sources: 16 CFR Part 314 and the FTC guide FTC Safeguards Rule: What Your Business Needs to Know.
Name a Qualified Individual. One person, on staff or outsourced, who runs the program and answers for it.
Assess your risks (5,000+). A written assessment of where customer information lives and what could expose it.
Put safeguards in place. Access controls, a data and systems inventory, encryption, multi-factor authentication, secure disposal, change management, and activity monitoring.
Test or monitor them (5,000+). Continuous monitoring, or a yearly penetration test plus vulnerability assessments at least every six months.
Train your people. Security awareness training that keeps up with the risks you actually face.
Oversee your service providers. Choose vendors that can protect the data, require it in the contract, and check on them periodically.
Keep the program current. Update it when your systems, vendors, or operations change.
Write an incident response plan (5,000+). Who does what, and who gets called, when something goes wrong.
Report to ownership every year (5,000+). A written report from the Qualified Individual to the dealer principal or board.
Report qualifying breaches to the FTC. If unencrypted information on 500 or more consumers is acquired without authorization, notify the FTC within 30 days of discovery.
Be ready
The documents to have ready when someone asks
If the FTC opens an investigation, a cyber insurer sends a questionnaire, or a business partner asks how you protect customer information, these documents show your program is real. Items marked (5,000+) are required only if you keep information on 5,000 or more consumers.
Who your Qualified Individual is, and for an outside QI, the senior person at the dealership who oversees them
Your written information security program (WISP)
Your written risk assessment (5,000+)
Testing or monitoring results: continuous monitoring, or your latest penetration test and vulnerability assessments (5,000+)
Your written incident response plan (5,000+)
The latest annual report to ownership from your Qualified Individual (5,000+)
Your service provider list and how you oversee each one
Staff training records
Services
Three ways to work together
Start where you are. Some stores need a clear picture first. Others need someone to own the program from here on.
Start here
Safeguards Gap Assessment
A review of your dealership against each requirement of the rule, with a written report ranking what to fix first.
On-site walkthrough of systems, vendors, and data flow
Review of any program or templates you already have
Prioritized fix list you can act on
Most complete
Outsourced Qualified Individual
I'm appointed in writing as your Qualified Individual. I run the program year-round: I recommend, approve, verify, and document. Your team or IT provider makes the changes. A senior person at your dealership stays named to oversee it, as the rule requires.
Included: written appointment as your Qualified Individual
Risk assessment, recommendations, and written program, kept current
Service provider tracking: who has access to customer information, and each vendor's verification status
One on-site visit per year, including a staff security training session
Training program oversight, new-hire training materials, and completion records
Scheduling and review of required testing or monitoring
Verification and documentation of completed fixes
Incident response plan, and incident coordination with extra time billed hourly
Signed annual written report to ownership
Not included, quoted separately: vendor security assessments (per vendor), remediation and configuration work, software licenses, outside penetration testing, lender and insurance questionnaires, additional training sessions or on-site visits, and incident time beyond coordination (billed hourly).
Build it once
Program Build
A complete written information security program (WISP) for your store, written to how you actually operate. Your Qualified Individual and IT provider run it from there.
Risk assessment and written program
Policies, vendor list, and incident response plan
Annual report template for ownership
Every engagement is quoted up front. Ongoing work is billed by the hour or in monthly blocks.
Controls, not just a binder
The program gets backed up by real settings
A written program that says you use multi-factor authentication doesn't help if nobody turned it on. When you want the controls set up too, I can do that as a separate engagement, or work alongside your IT provider.
Microsoft 365 security
Multi-factor authentication, managed devices, and policies that keep customer data off personal phones.
Email security
SPF, DKIM, and DMARC make it much harder for anyone to send email pretending to be your dealership, plus phishing protection for staff inboxes.
Staff training
Short sessions for sales, F&I, and office staff, on-site or over Teams or Zoom, with attendance records for your file.
How it works
From first call to a program you can show
1
Talk
A 20-minute call about your store, your systems, and who handles IT today.
2
Assess
An on-site walkthrough of how customer information moves, from the showroom to F&I to your vendors.
3
Build
Write the program and give you a prioritized plan for the biggest gaps.
4
Maintain
Verify fixes, track vendors and training, update the program, and deliver the annual report.
Ready to start? Schedule an assessment.
About
Local, hands-on, and already doing this work
I'm Saint Somerville, founder of ROI Innovations, based in Anderson, South Carolina. I've served as Qualified Individual for a Ford franchise dealership, where I built the written security program and a Microsoft 365 environment with managed devices, multi-factor authentication, and controls that keep customer data off personal phones.I started offering this because many dealers either don't know the rule applies to them or bought a template that doesn't match how their store runs. I work with independent and franchise dealerships across Upstate South Carolina, on-site or remote.ROI Innovations also offers process improvement, small business help, and staff training at roiinnovations.com. I also write the Get Clear on Compliance blog, plain-English guides to the Safeguards Rule and other compliance topics.
FAQ
FTC Safeguards Rule questions dealers ask
Does the FTC Safeguards Rule apply to car dealerships?
Yes, if your dealership arranges financing or leases for customers. That makes it a financial institution under the Gramm-Leach-Bliley Act, and the Safeguards Rule applies. Cash-only dealers are in a different position; bring it up on the call. For a plain-English walkthrough of the whole rule, read FTC Safeguards Rule Explained in Plain English.
What can a car dealership do this week to improve Safeguards Rule compliance without a big budget?
Remove old employee and vendor accounts, replace shared logins at the sales desk and in F&I, turn on multi-factor authentication, start one evidence folder, and list your vendors. For a 7-day plan, read Fast, Low-Cost Compliance Moves That Make an Immediate Impact.
Does the Safeguards Rule apply to buy-here-pay-here dealers?
Yes. A buy-here-pay-here dealer extends credit directly to customers, which is a financial activity under the Gramm-Leach-Bliley Act, so the Safeguards Rule applies.
What is a Qualified Individual under the FTC Safeguards Rule?
The person the rule requires you to name to oversee, implement, and enforce your information security program. It can be an employee or an outside provider.
Can a car dealership use an outsourced Qualified Individual for the Safeguards Rule?
Yes. The dealership keeps responsibility for compliance, must name a senior person on staff to direct and oversee the outside Qualified Individual, and must require that provider to maintain its own information security program.
Does the FTC Safeguards Rule require multi-factor authentication for our DMS, CRM, and lender portals?
Yes, for anyone accessing any system that holds customer information. That means not just email and remote access, but also your DMS, CRM, lender portals, and anything else with customer data. The only exception is when your Qualified Individual approves equivalent or stronger access controls in writing.
What is a WISP (written information security program) for a car dealership?
A written information security program: the document that describes how your dealership protects customer information, including your risk assessment, safeguards, vendor oversight, training, and incident response. The Safeguards Rule requires one.
What Safeguards Rule documents should a dealership have ready for an FTC investigation or cyber insurance review?
Who your Qualified Individual is, your written information security program, your service provider list, and staff training records. Dealerships that keep information on 5,000 or more consumers also need a written risk assessment, testing or monitoring results, a written incident response plan, and the latest annual report to ownership.
Does our DMS provider or IT company make our dealership compliant with the Safeguards Rule?
No. They protect their own systems. Your risk assessment, written program, staff training, and oversight of those same vendors are still the dealership's job.
Are small car dealerships exempt from any FTC Safeguards Rule requirements?
Yes, partly. Dealerships that keep information on fewer than 5,000 consumers are exempt from four items: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the annual report. You still need a Qualified Individual, a written program, and core safeguards like multi-factor authentication and encryption.
What is a notification event, and when must a dealership report a breach to the FTC?
Unauthorized acquisition of unencrypted customer information involving 500 or more consumers. Unauthorized access is presumed to be acquisition unless you have reliable evidence it wasn't. Since May 13, 2024, the dealership must report it to the FTC as soon as possible and no later than 30 days after discovering it.
What happens if a car dealership doesn't comply with the FTC Safeguards Rule?
The FTC can investigate and bring enforcement actions. A breach can also trigger state notification requirements, customer notices, and cleanup costs.
How long does it take a car dealership to comply with the FTC Safeguards Rule?
It depends mostly on your store's size and how quickly the information comes together: your vendor list, access to your systems, and time with your managers. A gap assessment is the quickest piece. A full program build takes longer because it covers every system and vendor you use. After the first call, you'll get a quote with a timeline based on your store.
Is ROI Innovations a law firm?
No. I'm a security and compliance consultant, and I'll work alongside your attorney on legal questions.
Schedule an assessment
Find out where your dealership stands
Leave your name and dealership, and Saint will reply within one business day to set up a 20-minute call. Prefer email? Use the button below.
Please don't email Social Security numbers, account numbers, or other customer information.
ROI Innovations · Consulting | Compliance | Training · Anderson, South Carolina
© 2026 ROI Innovations. Information on this site is general and is not legal advice. ROI Innovations is not affiliated with or endorsed by the Federal Trade Commission.
Rule text: 16 CFR Part 314 · roiinnovations.com