The Federal Trade Commission (FTC) Safeguards Rule goes into effect June 9, 2023. Did that date sneak up on you? Will your dealership be compliant, or is your team still trying to figure out what IT upgrades are needed to secure private customer data? Let’s breakdown the Safeguards Rule, see how it impacts your dealership and outline steps to consider while working on this compliance initiative. If you’d like another source of information to share with your team, check out EFG’s latest F&I Talk Outside the Box podcast.
Originally enacted in 2003, the FTC amended the Safeguards rule in 2021, but extended the deadline for compliance to June 9th of this year, giving dealerships more time to incorporate the needed equipment and procedures. Specifically, the new requirements include:
- Designate a qualified individual to oversee your information security program.
- Develop a written risk assessment.
- Limit and monitor who can access sensitive customer information.
- Encrypt all sensitive information.
- Implement ongoing security personnel training.
- Develop an incident response plan.
- Perform periodic assessments of service provider security practices.
- Implement multi-factor authentication, or another method with equivalent protection, for any individual accessing customer information.
That’s a lot to absorb! Let’s focus on the key component of data security.