FTC Safeguards Rule

The Safeguards Rule (16 CFR Part 314) implements part of the Gramm-Leach-Bliley Act for businesses the FTC regulates: auto dealers, mortgage brokers, tax preparers and others that handle customer financial information. It requires a qualified individual to run the program, a written risk assessment, safeguards such as encryption and MFA, vendor oversight, an incident response plan and reporting to leadership.

Dealerships feel this most. The customer data in the finance office, the CRM and the phone recordings all fall under the program, and so do the vendors who touch them. A growing dealer group adding an AI voice agent or a new phone system is adding a service provider the rule says must be assessed and monitored.

Ask a vendor to describe their own security controls in the rule's terms: encryption at rest and in transit, MFA for every login, access logs, and how they support your risk assessment. Ask for a written agreement covering safeguards. Confirm the program itself with your compliance counsel.