The Safeguards Rule comes from the Gramm-Leach-Bliley Act (GLBA). It requires non-bank "financial institutions" under the FTC's jurisdiction to protect customer information with a written information security program. The FTC strengthened the rule in 2021, and the updated requirements have been in force since June 9, 2023.
Who it covers
The FTC reads "financial institution" broadly. If your business is significantly engaged in financial activities, it is likely covered. Common examples:
- Car dealers that arrange financing or leasing for customers
- Tax preparers and accounting firms
- Mortgage brokers and lenders that aren't banks
- Finance companies and payday lenders
- Collection agencies, check cashers and money transmitters
- Investment advisers not registered with the SEC, credit counselors and some other financial service providers
Banks and federally insured credit unions follow their own regulators' rules instead.
What the rule requires
Section 314.4 lists the elements every program must include:
| # | Requirement | In practice |
|---|---|---|
| 1 | Designate a Qualified Individual | One person oversees, implements and enforces the program. This can be an outside provider. |
| 2 | Written risk assessment | Identify foreseeable risks to customer information and judge how well current safeguards handle them. |
| 3 | Safeguards | Access controls, a data inventory, encryption, MFA, secure disposal, change management, and logging and monitoring of user activity. |
| 4 | Testing and monitoring | Continuous monitoring, or an annual penetration test plus vulnerability assessments at least every six months. |
| 5 | Training and qualified staff | Security awareness training for everyone, and qualified people running the program. |
| 6 | Service provider oversight | Choose capable vendors, require safeguards by contract and assess them periodically. |
| 7 | Keep the program current | Adjust it as your business, systems and risks change. |
| 8 | Written incident response plan | Who does what when customer information is compromised. |
| 9 | Annual report to leadership | The QI reports in writing, at least once a year, to the board or a senior officer. |
The safeguards in more detail
- Access controls: people get access only to the customer information they need.
- Inventory: know what data you hold, where it lives and which systems touch it.
- Encryption: encrypt customer information at rest and in transit over external networks. If that isn't feasible, the QI must approve effective alternative controls.
- Multi-factor authentication for anyone accessing any information system.
- Secure disposal: dispose of customer information no later than two years after it was last used for the customer, unless there's a legitimate business or legal reason to keep it.
- Secure development: build in-house applications securely, and test the security of third-party ones.
- Change management, and monitoring and logging of what authorized users do.
The small-business exemption
If your business maintains customer information on fewer than 5,000 individuals (the rule says "consumers"), it's exempt from four requirements:
- the written risk assessment
- continuous monitoring, or the annual pen test and six-month vulnerability assessments
- the written incident response plan
- the QI's annual written report
Your business still needs a Qualified Individual, the core safeguards and a written program. Most car dealers and mortgage brokers pass 5,000 individuals quickly, so the full rule usually applies to them.
Reporting breaches to the FTC
Since May 13, 2024, a "notification event" involving 500 or more consumers must be reported to the FTC as soon as possible, and no later than 30 days after you discover it. A notification event is the unauthorized acquisition of unencrypted customer information. Encrypted data counts as unencrypted if the key was also compromised.
The FTC has said it will make these reports public. State breach laws may add their own separate notice requirements.
What's reported, and to whom
Apart from breach notification, you don't file your program with the FTC. The QI's annual report goes to your board or owner. But if the FTC investigates, it can ask for your written program, risk assessments and QI reports. They are your proof that the program is real.
The short version: designate a QI, put your program in writing, protect the data, test it, oversee your vendors, and document all of it. See what a QI does →