Question 1

Who must comply with the FTC Safeguards Rule?

Accepted Answer

Any 'financial institution' under the GLBA definition — including auto dealers with captive financing, title companies, mortgage brokers, accounting firms that prepare tax returns, payday lenders, and other businesses that handle customer financial information. Size does not exempt you.

Question 2

What is the penalty for violating the FTC Safeguards Rule?

Accepted Answer

Civil penalties up to $51,744 per violation per day. The FTC has pursued enforcement actions against CafePress ($500K), Drizly ($100K+ plus C-suite personal liability), and Chegg ($875K). The May 2024 breach notification amendment adds a 30-day FTC reporting obligation for incidents affecting 500+ consumers.

Question 3

What is a 'Qualified Individual' under the FTC Safeguards Rule?

Accepted Answer

A designated person (internal or external, such as a vCISO) responsible for overseeing, implementing, and enforcing your information security program. The FTC explicitly allows an outside party to serve in this role — making a managed security provider's vCISO service the most cost-effective path for SMBs.

Question 4

When did the FTC Safeguards Rule breach notification amendment take effect?

Accepted Answer

May 13, 2024. Covered financial institutions must notify the FTC within 30 days of discovering a breach that affects 500 or more consumers. This runs parallel to — and sometimes triggers — state breach notification laws.

Question 5

What does the FTC Safeguards Rule require for service providers?

Accepted Answer

You must select and retain service providers that maintain appropriate safeguards, require those safeguards by contract, and periodically monitor your service providers' security. The CDK Global outage exposed that most auto dealers had no documented vendor oversight program — a direct Safeguards violation.

Are You FTC SafeguardsRule Ready?

Are You FTC Safeguards
Rule Ready?