GLBA is the 1999 federal law that makes a dealership protect its customers’ financial information and tell them how it’s shared. The FTC Safeguards Rule is the regulation under GLBA that spells out the security program a dealer has to run.
Last updated: November 4, 2026
So one is the law and the other is the rulebook written under it. Simple enough. The privacy side of GLBA has its own rulebook too, which is where most of the confusion starts.
Dealers ask me this a lot, usually right after a lender, an auditor, or an insurance questionnaire uses both terms in the same sentence. My short answer has always been a picture. GLBA is the deal jacket sitting open on a desk at 7 p.m., with a copy of a driver’s license and a credit application inside. The Safeguards Rule takes that same idea and carries it into the DMS, the CRM, the lender portals, the email, and every laptop in the building, which is to say the IT and cybersecurity side of the store.
That picture gets a dealer most of the way there. The legal version is a little different, and the difference matters when someone asks you to prove you’re compliant. So let me give you both: the plain version I’d use across the table, and the version that holds up when it’s written down. If you want the cybersecurity program itself, our dealership cybersecurity services page covers what we run day to day. This post is about which rule asks for what.
What GLBA Actually Is
The Gramm-Leach-Bliley Act is a 1999 federal law about financial institutions. Title V of it covers consumer privacy, and for a car or truck dealer, three pieces of Title V matter: a privacy part that controls how customer financial information is shared and what notices customers get, a safeguards part that says that information has to be protected, and a pretexting part that makes it illegal to get someone’s financial information by pretending to be them.
Why a dealer? Because the law follows the activity, not the sign out front. When a store arranges financing or leases a vehicle, it’s acting as a financial institution under GLBA. The FTC’s 2025 Safeguards Rule FAQs for auto dealers say the rule covers most automobile dealers who finance or lease automobiles. That’s nearly every franchised store, and plenty of heavy truck dealers too. Cash-only stores are rare.
Here’s the part people miss. The safeguards section of the statute, 15 U.S.C. 6801(b), doesn’t list encryption settings or testing schedules. It tells the agencies to set standards for administrative, technical, and physical safeguards, and then it stops. The law sets the duty. The rules fill in the details.
GLBA is the “what.” It was never meant to be the “how.”
Where the FTC Safeguards Rule Fits
The FTC wrote the “how” for dealers in 16 CFR Part 314, the Standards for Safeguarding Customer Information, which most people just call the Safeguards Rule (you’ll also see it called the GLBA Safeguards Rule, which is the same thing). The first version was short and general. The FTC rewrote it in late 2021, the bulk of the new requirements took effect on June 9, 2023, and a requirement to notify the FTC after certain breaches was added on May 13, 2024. Our FTC Safeguards Rule news tracker keeps the newer changes in one place.
Now back to my deal jacket picture, because this is where I have to correct myself a little. The Safeguards Rule isn’t only about computers. Its definition of customer information covers records in paper, electronic, or any other form, so the jacket on the desk is a Safeguards Rule issue as much as the DMS is. Paper counts. Shredding is in there too. The rule says customer information has to be securely disposed of no later than two years after it was last used, with a few exceptions.
I still use the IT picture, though. Pretty much everything the FTC added in 2021 lands on the computer side of the house, from multifactor logins on the DMS to pen testing, while the paper side mostly asks you to lock a cabinet and shred on schedule.
The paper is covered twice.
GLBA vs the Safeguards Rule, Side by Side
| Question | GLBA | FTC Safeguards Rule |
|---|---|---|
| What is it? | A federal law passed by Congress in 1999 | A federal regulation, 16 CFR Part 314, written by the FTC under that law |
| What does it cover? | Privacy, safeguarding, and pretexting for customer financial information | Only safeguarding: the information security program |
| How specific is it? | General duties, with the details left to agency rules | Nine named elements, from a Qualified Individual to an annual board report |
| Privacy notices to customers | Required, through a separate rule (for dealers, the FTC’s Privacy Rule) | Not covered |
| Paper deal jackets | Covered by the duty to protect customer information | Covered: the rule applies to paper, electronic, and any other form, disposal included |
| What the store produces | A privacy notice, opt-out handling, and a security program through the Safeguards Rule | A written information security program, risk assessment, incident response plan, test results, and a yearly report to the board |
| Who enforces it for dealers? | The FTC, for dealers that sell, lease, and service vehicles | The FTC |
One law. At least two rules under it.
What Does the GLBA Safeguards Rule Ask a Dealer to Do?
The Safeguards Rule asks a dealer to keep a written information security program with nine elements: a named person in charge, a written risk assessment, safeguards built from that assessment, regular testing, trained staff, vendor oversight, ongoing updates, an incident response plan, and a yearly written report to leadership. On paper that sounds like a bank’s problem. At a store it looks more like this.
- A Qualified Individual, meaning one name on the program. That might be your controller or your IT manager. It might be someone at an outside provider. It can’t be “everybody.”
- A risk assessment of the store you’ve actually got, the F&I office and the service drive and that old server in the parts room included.
- Safeguards that come out of it. Access limits, encryption, MFA, and getting rid of old jackets and hard drives properly.
- Testing, which the rule lets you do two ways: continuous monitoring, or a pen test every year with vulnerability scans every six months.
- Training for anyone who touches customer data. At a dealership that’s the receptionist, too.
- Who’s checking your vendors? You are. The rule wants capable providers, security terms in the contract, and a fresh look at them over time.
- A written incident response plan, so a bad Saturday runs off a playbook instead of a group text.
- Once a year, a written report from the Qualified Individual to the board, the owner, or a senior officer.
Updating the program as the store changes is the ninth element, and the FTC breach notice sits alongside all of it: if an event involves the unencrypted information of at least 500 consumers, the dealer notifies the FTC within 30 days of finding it. We walk through each element in more depth in the nine Safeguards Rule requirements explained, and our FTC Safeguards Rule checklist turns them into something a store can work through.
Nine elements. Every one of them ends in a document someone can ask to see.
The Privacy Rule Is the Other Half of GLBA
If the Safeguards Rule is about locking the data up, the Privacy Rule is about who you hand it to and what you tell the customer before you do. For most of the financial world that rule is the CFPB’s Regulation P. Dealers are an exception. Under the Dodd-Frank Act, dealers that mainly sell, lease, and service vehicles stayed with the FTC, so their privacy obligations sit in the FTC’s own Privacy Rule at 16 CFR Part 313: the privacy notice the customer gets when the deal is signed, the annual notice where one is required, and the customer’s right to opt out before their information is shared with certain outside companies.
They don’t cover for each other. So when someone says “we’re GLBA compliant,” ask which half.
The 5,000-Consumer Line Isn’t an Exemption
Somebody always brings up the number. Usually it’s a smaller store, and usually they heard it from a vendor who wanted the conversation to be short. Section 314.6 of the rule says a financial institution holding customer information on fewer than 5,000 consumers doesn’t have to do four specific things: the written risk assessment, the continuous monitoring or the pen tests and vulnerability scans, the written incident response plan, and the annual report to the board.
Four items. That’s it.
You still need a Qualified Individual. You still need safeguards, training, and vendor oversight. And I’ll be blunt about the count itself, because I’ve sat in a lot of F&I offices: once you add up every customer whose file is still in the DMS, the CRM, and the back-room cabinets, not just this year’s deliveries, I’ve rarely seen a franchised store come in under 5,000. Plan like you’re over it.
Where Dealers Mix the Two Up
I spent my early years on a dealership sales floor and five more selling CRM to dealers before I came to Helion Technologies, so I’ve heard most of these from both sides of the desk. These are the ones that come up most, in the words dealers actually use.
“Our DMS provider handles GLBA for us.” Your DMS provider protects its own systems. The Safeguards Rule puts the program on the dealer, and it makes overseeing that provider one of the dealer’s jobs. The provider’s security statement is part of your vendor file, not a replacement for your program. It helps. It isn’t the program.
“We hand out the privacy notice, so we’re covered.” That’s the Privacy Rule. It says nothing about multifactor authentication, testing, or incident response. Different job.
“The deal jackets are F&I’s problem, not IT’s.” They’re both, which is the whole reason this gets confusing. The paper and the systems hold the same customer, and the rule covers both forms.
“Nobody’s coming after a single-point store.” Maybe the FTC isn’t. Criminals don’t sort by rooftop count, though. They never have. The June 2024 cyberattack on CDK Global took DMS access away from thousands of stores at once, and several publicly traded dealer groups disclosed the disruption to investors in SEC filings. An industry survey published by CDK Global found 35% of auto dealers had a cyberattack or incident in 2024. A breach stops your sales floor first. The regulatory questions show up after.
Every one of those starts with a half-true sentence.
Who Owns Which Part at the Store
Whenever things aren’t going the way I want, I ask myself what I’m not doing. It’s a good question to put to a GLBA program too, because the gaps are almost always in the handoffs between departments, not inside any one of them. F&I owns the privacy notice and the jackets on the desk. The office owns the filing room and the shred bin. Whoever runs IT owns the systems, the testing, and most of the paperwork the Safeguards Rule asks for. The Qualified Individual has to see across all three and report on it once a year, which is hard to do when each piece belongs to a different vendor and nobody is accountable for the whole thing.
Nobody owns the seams. That’s the problem.
That’s the reason we run compliance as part of the same team that runs the IT and the security. When we’re doing a dealer’s compliance, we deliver that annual report to their board, and it’s built from the same environment we manage every day. Our continuous compliance program for dealerships covers the program, the vendor scoring, and the testing, and the people side is handled through security awareness training for dealership employees. We do this for 2,000-plus dealerships, all of them automotive or heavy truck.
One accountable team beats four departments guessing.
Things Dealers Ask Me About GLBA
So is the Safeguards Rule part of GLBA or a separate law?
Does GLBA really apply to a dealership that only sells cars for cash?
Our F&I team already gives customers a privacy notice. What’s left?
Under 5,000 customers: what actually goes away?
Who should be our Qualified Individual?
Does a breach have to be reported to the FTC now?
One Law, Two Rules, One Program
You don’t need to memorize the citations. Nobody does. You need to know that GLBA is the umbrella, that the Privacy Rule and the Safeguards Rule are two different jobs under it, and that somebody at your store owns each one in writing.
If you’d like a straight read on where your store stands on the security side, our complimentary IT and cybersecurity assessment looks at the systems, the paper trail, and the vendors together, and you’ll get a plain answer either way. Peace of mind comes from knowing who owns which part.