FTC Safeguards Rule compliance for car dealerships, handled by someone who's done it.
If your dealership arranges financing or leases, the FTC treats you as a financial institution. ROI Innovations serves as your outsourced Qualified Individual, writes your information security program, and sets up the controls that back it up.
- Has served as Qualified Individual for a franchise dealership
- Microsoft 365 and email security set up, not just written down
- Based in Anderson, SC. On-site across the Upstate
Why the FTC treats your dealership like a bank
The Gramm-Leach-Bliley Act covers any business "significantly engaged" in financial activities. Arranging auto loans and leases counts. That puts most dealerships under the FTC's Safeguards Rule (16 CFR Part 314), the same rule that covers mortgage brokers and tax preparers.
Every credit application holds the information identity thieves want most: Social Security numbers, income, bank details, driver's license numbers. The rule says you need a written program to protect it, a named person in charge, and proof that the controls work.
The amended rule has been fully in force since June 2023. Since May 2024, a breach involving 500 or more customers must also be reported to the FTC within 30 days of discovery.
Ten things the Safeguards Rule asks of every dealership
These come from section 314.4 of the rule. Items marked 5,000+ are relaxed for dealerships that hold information on fewer than 5,000 consumers.
- Name a Qualified IndividualOne person, on staff or outsourced, who runs the program and answers for it.
- Assess your risks5,000+A written assessment of where customer data lives and what could expose it.
- Put safeguards in placeAccess controls, a data and systems inventory, encryption, multi-factor authentication, secure disposal, change management, and activity monitoring.
- Test or monitor them5,000+Continuous monitoring, or a yearly penetration test plus vulnerability scans every six months.
- Train your peopleSecurity awareness training that keeps up with the risks you actually face.
- Oversee your service providersChoose vendors that can protect the data, require it in the contract, and check on them.
- Keep the program currentUpdate it when your systems, vendors, or operations change.
- Write an incident response plan5,000+Who does what, and who gets called, when something goes wrong.
- Report to ownership every year5,000+A written report from the Qualified Individual to the dealer principal or board.
- Report qualifying breaches to the FTCUnencrypted data on 500 or more customers: notify the FTC within 30 days of discovery.
Three ways to work together
Start where you are. Some stores need a clear picture first. Others need someone to own the program from here on.
Safeguards Gap Assessment
A review of your dealership against each requirement of the rule, with a written report ranking what to fix first.
- On-site walkthrough of systems, vendors, and data flow
- Review of any program or templates you already have
- Prioritized fix list you can act on
Outsourced Qualified Individual
ROI Innovations serves as your QI and runs the program year-round. A senior person at the dealership stays named to oversee it, as the rule requires.
- Owns the written program and keeps it current
- Vendor oversight and staff training
- Annual written report to ownership
- First call when something goes wrong
Program Build
The full written information security program for your store, written to how you actually operate. Hand it to your own QI to run.
- Risk assessment and written program
- Policies, vendor list, and incident response plan
- Annual report template for ownership
Every engagement is quoted up front. Ongoing work is billed by the hour or in monthly blocks.
The program gets backed up by real settings
A written program that says "we use multi-factor authentication" doesn't help if nobody turned it on. The work includes setting up the controls the program describes.
Microsoft 365 security
Multi-factor authentication, managed devices, and policies that keep customer data off personal phones.
Email security
SPF, DKIM, and DMARC so nobody can send convincing email as your dealership, plus phishing protection for staff inboxes.
Staff training
Short sessions for sales, F&I, and office staff, on-site or over Teams or Zoom, with attendance records for your file.
From first call to a program you can show
- 1
Talk
A 20-minute call about your store, your systems, and who handles IT today.
- 2
Assess
Walk through how customer information moves, from the showroom to F&I to your vendors.
- 3
Build
Write the program, fix the biggest gaps first, and set up the controls.
- 4
Maintain
Training, vendor reviews, the annual report, and updates as your store changes.
Local, hands-on, and already doing this work
I'm Saint Somerville, founder of ROI Innovations, based in Anderson, South Carolina. I've served as Qualified Individual for a Ford franchise dealership, building its written security program and a Microsoft 365 environment with managed devices, multi-factor authentication, and controls that keep customer data off personal phones.
I started offering this because many dealers either don't know the rule applies to them or bought a template that doesn't match how their store runs. I work with independent and franchise dealerships across Upstate South Carolina, on-site or remote.
Also offering process improvement, small business help, and staff training at roiinnovations.com.
Questions dealers ask
Does the Safeguards Rule really apply to a car dealership?
Yes, if your dealership arranges financing or leases for customers. That makes you a financial institution under the Gramm-Leach-Bliley Act. Cash-only dealers are in a different position; bring it up on the call.
Can someone outside the dealership be our Qualified Individual?
Yes. The rule allows an outsourced QI. The dealership still owns compliance and must name a senior person on staff to direct and oversee the outside QI.
Our DMS provider or IT company says they've got us covered. Don't they?
They protect their own systems. Your risk assessment, written program, staff training, and oversight of those same vendors are still the dealership's job.
We're a small store. Do we still need all of this?
Dealerships with information on fewer than 5,000 consumers skip four items: the written risk assessment, continuous monitoring or penetration testing, the written incident response plan, and the annual report. You still need a Qualified Individual, a written program, and core safeguards like multi-factor authentication and encryption.
What happens if we ignore it?
The FTC can investigate and bring enforcement actions. A breach can also bring state notification requirements, customer notices, and cleanup costs. Lenders and manufacturers increasingly ask to see your program.
What is a notification event?
Unauthorized access to unencrypted information on 500 or more consumers. Since May 13, 2024, the dealership must report it to the FTC as soon as possible and no later than 30 days after discovering it.
How long does it take?
It depends mostly on your store's size and how quickly the information comes together: your vendor list, access to your systems, and time with your managers. A gap assessment is the quickest piece. A full program build takes longer because it covers every system and vendor you use. After the first call, you'll get a quote with a timeline based on your store.
Are you a lawyer?
No. I'm a security and compliance consultant, and I'll work alongside your attorney on legal questions.
Find out where your dealership stands
Send a note with your store name and the best time to call. Saint will reply within one business day to set up a 20-minute call.
Please don't email Social Security numbers, account numbers, or other customer information.