The FTC Safeguards Rule applies to truck dealerships that arrange financing or leasing, but it protects only the records of individuals who borrow for personal, family, or household use, a small share of a heavy truck dealer’s deals. Commercial credit files fall outside that definition. State breach laws, two other FTC rules, and your lender agreements cover them anyway.
Last updated: October 13, 2026
Truck dealers ask the question about the way you’d expect. We sell to fleets, to contractors, and to guys with one truck and a DOT number. Nobody’s buying a day cab to pick the kids up from school. So does a rule written for car dealers and their retail customers have anything to do with us? It’s a fair question.
Our heavy truck dealership IT page answers that in one paragraph, and the answer is yes. I stand by it. It’s also about a page short, because the honest version has a “but” in the middle of it, and the “but” is where truck dealers either relax too early or get sold a program sized for a store that isn’t theirs.
I started on a dealership sales floor in the late ’90s and I’ve been at Helion Technologies for 20 years, so I’m a car person who ended up in IT. I’m not an attorney. What follows is how the rule reads and where I see truck stores land, and the close calls belong with your counsel. Take it that way.
Does the FTC Safeguards Rule Cover Truck Dealerships? The Short Version
The FTC Safeguards Rule is the federal regulation, at 16 CFR Part 314, that makes a financial institution keep a written security program to protect customer information. A dealership that finances, arranges financing for, or leases vehicles is a financial institution under it. What the rule protects is narrower, though. It protects information about consumers.
That word matters. The rule defines a consumer as an individual who gets a financial product or service “to be used primarily for personal, family, or household purposes.” A fleet isn’t an individual. A sleeper cab bought to haul freight isn’t a household purchase.
So the dealership is covered and most of its deals aren’t. Both halves are true. You need both.
Where “We Only Sell to Businesses” Holds Up
Give the argument its due. It’s a better one than most compliance salespeople will admit, and the text of the regulation is on the truck dealer’s side for a good part of the way.
The FTC’s privacy regulation for dealers says in its scope section that it “does not apply to information about companies or about individuals who obtain financial products or services for business, commercial, or agricultural purposes.” That’s 16 CFR 313.1(b), and the Safeguards Rule borrows the same definition of a consumer. FTC staff said it again in the Safeguards Rule FAQs for automobile dealers they put out in 2025, where the answer reads, “The Safeguards Rule only applies to ‘customer information.'” Customer information, in their words, is about a consumer who wants financing “primarily for their own personal, family, or household use.”
Read that the way a truck dealer would. The credit application from a 40-truck fleet organized as an LLC isn’t customer information under this rule. Neither is the stack of commercial deals behind it. If your store did nothing but that, the Safeguards Rule would be pointing at an empty file drawer.
I doubt that store exists.
Owner-Operators, Sole Proprietors, and the Guarantor’s Social Security Number
Here’s what the business-only argument skips. Trucking is mostly small. The American Trucking Associations counted almost 580,000 active motor carriers in June 2025 and 91.5% of them run 10 or fewer trucks. A lot of your customers are one person with one truck.
When that person fills out a credit application, the business and the individual are the same file. His Social Security number is on it. So are his home address, his date of birth, his bank, and a personal credit bureau your F&I office pulled. That’s the whole file. Under the Safeguards Rule he’s still not a consumer, as long as the truck is for work, because the test is what the money is for and not whose name is on the paper. The same goes for the owner who personally guarantees his company’s note. Same test, same result.
So the rule looks away. A thief wouldn’t. To somebody selling identities, a sole proprietor’s credit app is worth exactly what a retail car buyer’s is worth.
And then there are the real consumers, the ones truck dealers forget they have. The customer who finances a medium-duty pickup he drives home. The horse owner who wants a tractor for a personal trailer. A lease to an individual. It doesn’t take many.
| Who’s across the desk | A consumer under the Safeguards Rule? | What still covers that file |
|---|---|---|
| Fleet buying through a corporation or LLC | No. A company isn’t an individual. | Your lender agreements, and state law for any personal data in the deal jacket |
| Owner-operator or sole proprietor financing a work truck | Generally no. The credit is for business use. | State breach law, the Disposal Rule, the Red Flags Rule |
| Owner personally guaranteeing a company loan | Generally no, for the same reason | The same three, since his bureau and Social Security number sit in your file |
| Individual financing or leasing for personal use | Yes | The Safeguards Rule, plus everything above |
| Employee, technician, or driver applicant | No. Not a finance customer at all. | State breach law |
One Consumer Deal Puts the Whole Network in Scope
This is the part I’d tape to the controller’s door. The same FTC staff FAQs say the rule “requires you to secure information systems that contain customer information as well as those that are connected to a system containing customer information.” They go on to say that unless you keep two separate networks that don’t touch, the protection you owe the customer information ends up protecting the rest of what’s on that network too.
Nobody runs a second network for the retail deals. Why would they? Those deals sit in the same DMS, on the same file server, and in the same scanned-document folder as the fleet paper. It’s all one system. So a handful of consumer files, even a few dozen in a store that writes hundreds of commercial deals a year, means the access controls, the encryption, and the multifactor logins have to be on for all of it. You can’t lock one drawer of a database.
Now the good news. It’s real. Under 16 CFR 314.6, a financial institution that keeps customer information on fewer than 5,000 consumers is excused from four of the rule’s requirements. Count consumers, not customers, and plenty of heavy truck dealers come in far below that line.
| Under 5,000 consumers, you can skip | Any covered dealership still owes |
|---|---|
| The written risk assessment | A named Qualified Individual who runs the program |
| Continuous monitoring, or the annual penetration test and twice-a-year vulnerability scans | Access controls, encryption, multifactor authentication, logging, and secure disposal |
| The written incident response plan | Security training for staff |
| The annual written report to the board or owners | Oversight of the vendors who touch the data, and a report to the FTC if a breach reaches 500 consumers |
I wouldn’t skip the incident response plan even where the rule lets you. Write it anyway. Our incident response plan template for dealerships is a quick place to start. Our post on the nine FTC Safeguards Rule requirements walks through each element, and the 30-day breach notification rule has its own.
What Applies to a Truck Dealer Either Way
Suppose your attorney agrees the store has almost no consumers. Fine. The Safeguards Rule was only ever one of the things pointed at that deal jacket.
- State breach notification laws. According to the National Conference of State Legislatures, all 50 states have one. They generally turn on what was exposed, such as a name with a Social Security or driver’s license number, and not on whether the truck was for business.
- The FTC’s Disposal Rule covers “any person” who holds consumer report information for a business purpose. The personal bureau you pulled on an owner-operator or a guarantor counts, so it gets shredded or wiped. Not tossed.
- Do you carry accounts or take retail installment contracts? The Red Flags Rule may want a written identity theft program from you, and the FTC’s guide lists “small business accounts” and “sole proprietorship accounts” among its examples.
- Your own people. Truck dealerships employed nearly 148,000 people according to ATD Data 2025, and I’d bet you didn’t put any of yours on payroll without a Social Security number and a voided check.
- And then there’s whatever you signed. Your captive finance company, your floor plan lender, and your cyber insurer each get to write data security language into the agreement or the application, and I promise you none of them looked up how the FTC defines a consumer before they did. I can’t quote yours. They aren’t public. So go find the confidentiality, data security, and indemnification sections and read them with a pen in your hand.
Stack all of that up and I’m not sure the line between a covered file and an uncovered one buys you very much. Think about the Motility breach I wrote about in our heavy truck dealership cybersecurity post. It exposed data on 766,670 people. As far as I can tell, nobody stopped to sort them into consumers and commercial accounts before the letters went out.
Who’s Telling You the Rule Doesn’t Reach You?
I sold software to dealers for five years before I ever advised one, and the habit that stuck with me is asking who gets paid if I believe the answer. You’ll hear two pitches on this question. They don’t agree.
The first is from the guy with a compliance package to sell, and my thing with him is what he leaves out. He’ll say the whole rule lands on any store that touches a credit app. He won’t mention the 5,000 exemption. Why would he, when the exempt items are the ones on his invoice?
The second pitch is free, and that’s what makes it the riskier one. It comes from whoever would rather not have the project, which could be a DMS rep, or your IT guy, or honestly your own gut on a busy Tuesday when the service lane is full. “We’re B2B. That’s a car dealer thing.” I get why it’s easy to believe. It costs nothing.
Neither one has counted your consumers. Until somebody does, the question I’d put on the table is the one I ask myself when something isn’t going my way. What am I not doing?
Five Things a Truck Dealer Can Do This Quarter
None of these needs a consultant to start. Most of them need a controller, an F&I manager, and an afternoon.
- Count your consumers. Pull every deal financed or leased to an individual for personal use, as far back as you keep records. That number tells you whether you’re over or under 5,000 and whether you’re near the 500 that triggers an FTC breach report. Start there.
- Find where personal credit apps live. The DMS is the obvious place. The scanner’s inbox folder, the F&I manager’s email, and the banker’s box in the mezzanine are the ones that get missed. Check all three.
- Put the question to your attorney in writing, and get the answer back the same way. Keep the reply. Ask about leases with maintenance built in while you’re at it.
- Read three documents. Your captive finance agreement, your floor plan agreement, and last year’s cyber insurance application, where somebody at your store probably answered questions about multifactor logins and backups.
- Run the basics as if everything were covered. Our FTC Safeguards Rule checklist works as a list for a truck store too, even where the rule itself lets you off.
If you’d rather not run this alone, our dealership compliance team does it alongside the IT and security work for 2,000-plus dealerships, heavy truck stores among them. One partner looking at all of it beats three vendors who each look at a third.
Before You Call Your Attorney
We’ve never financed a truck for personal use. Are we clear of the rule?
An owner-operator put his Social Security number on the credit app. Doesn’t that make him a consumer?
Under 5,000 consumers, what do we actually get to skip?
Do full-service leases count as leasing under the Safeguards Rule?
Our floor plan agreement has a data security clause. Does it bind us if the FTC rule mostly doesn’t?
Count First, Then Decide
So, does the FTC Safeguards Rule apply to heavy truck dealerships? It does. It reaches fewer of your files than a car store’s and more of your network than you’d guess. Meanwhile the files it skips, the owner-operator credit apps and the guarantor bureaus and the payroll records, are still covered by your state, by two other FTC rules, or by the people who lend you money.
That’s why I’d spend less time on whether you’re exempt and more on where the Social Security numbers are. Our complimentary IT and cybersecurity assessment starts there. We find the personal data on your network, tell you which rules reach it, and tell you what’s protecting it today. If the answer turns out to be “not much,” you’d rather hear that from us than from a thief. Count first.