The FTC Safeguards Rule for 2026: What Non-Bank Financial and Data Firms Must Implement

The Safeguards Rule brought bank-grade data-security duties to auto dealers, mortgage brokers, fintechs, and more, with a written program, a named owner, and a breach clock.

Sarah MitchellUS agencies correspondent · New York

July 15, 2023 · 8 min read

A data centre aisle, illustrating FTC Safeguards Rule information-security requirements. · Image: Girder Group

Most of the FTC Safeguards Rule became enforceable on 9 June 2023, and a breach-notification amendment followed in May 2024 (FTC). Yet the firms it covers (auto dealers, mortgage brokers, tax preparers, fintechs, collection agencies) often still treat data security as an IT setting rather than a documented program with a named owner. The rule closed that gap; many programs have not.

Key takeaways

The Safeguards Rule applies to non-bank 'financial institutions' far beyond banks, under the FTC's GLBA authority.
It requires a written information-security program, a qualified individual to run it, and a written risk assessment.
A 2023 amendment added specific controls; a further amendment requires breach notification to the FTC.
Separately, FTC Act Section 5 lets the FTC treat weak data security as an 'unfair' practice on its own.

What the rule requires

The Safeguards Rule sits under the Gramm-Leach-Bliley Act and applies to non-bank “financial institutions”, a category the FTC reads broadly to include auto dealers, mortgage lenders and brokers, payday lenders, tax preparers, collection agencies, and many fintechs (16 CFR Part 314). If a business handles consumer financial data, it should assume the rule reaches it.

The 2021 amendments, most of which took effect on 9 June 2023, made the program prescriptive: a written information-security program, a single qualified individual responsible for it, a written risk assessment, plus access controls, encryption, multi-factor authentication, logging, and vendor oversight (FTC business guidance). A later amendment requires covered firms to notify the FTC of certain breaches, with that duty effective in 2024.

Behind the newer requirement is an older, broader stick. Section 5 of the FTC Act prohibits “unfair or deceptive acts or practices”, and the FTC has long used it to treat unreasonable data security as unfair in its own right (15 U.S.C. § 45). A firm outside the Safeguards Rule is not outside FTC reach.

“The rule turned data security from a technical preference into a documented program a regulator can audit.”

What this means operationally

Name the qualified individual, in writing. The rule expects one accountable owner. Ambiguity here is the first finding in any review.

Write the risk assessment down and keep it current. An undocumented assessment does not satisfy the rule, however sound the controls.

Instrument logging and access controls to be provable. Encryption and MFA are only credible if you can show they were in force.

Wire breach detection to the notification duty, so the FTC report is a retrieval, not a reconstruction.

How AI could address the gap

The Safeguards Rule is, at heart, a demand for provable controls: a program you can show, an owner you can name, access you can account for. Producing and maintaining that evidence continuously is the automatable part.

AI-assisted governance tooling can keep the written program and risk assessment linked to the controls actually in place, surface access anomalies for the qualified individual to review, and assemble breach-notification packages against the clock. The accountability stays with the named person, as the rule requires; the machine keeps the record audit-ready, the same pattern we describe for the NIST framework’s Govern function.

Building the platforms, portals, and systems that make these obligations provable is what Girder Group does.

Sources

1.FTC Safeguards Rule: What Your Business Needs to Know.Federal Trade Commission
2.16 CFR Part 314, Standards for Safeguarding Customer Information, current text.Electronic Code of Federal Regulations
3.Federal Trade Commission Act, Section 5 (15 U.S.C. § 45).Federal Trade Commission

Sarah Mitchell

US agencies correspondent · Girder Group · New York

Sarah Mitchell covers US federal regulators, the SEC and FINRA, the FTC, and the FCC, with a focus on recordkeeping and data obligations, from Girder Group's New York desk.

Meet the desk