FTC Safeguards Rule for Dealerships: A Customer-Data Checklist for CRM, Texting and Call Tools

What the FTC Safeguards Rule requires of dealerships, plus a vendor checklist for CRM, texting, call recording and lead tools and the breach-reporting rules.

The FTC Safeguards Rule requires most dealerships that arrange financing or lease vehicles to run a written information security program that protects customer information, including the copies held by outside vendors. For many stores, the CRM, texting, call recording and lead tools are where that vendor oversight is weakest, so each one needs its own check.

At a glance

The FTC treats dealers that finance, arrange financing or lease vehicles for longer than 90 days as financial institutions under the Safeguards Rule.
The Safeguards Rule lists nine required elements, from naming a Qualified Individual to a written yearly report to the board or owner.
Every vendor that receives, stores or can access customer information is a service provider, and the dealership must choose capable vendors, require safeguards by contract and reassess them over time.
CRM records, text threads, call recordings and online credit applications can all hold financing details, so each tool belongs in the dealership's inventory of systems.
A breach exposing unencrypted information about 500 or more consumers must be reported to the FTC within 30 days of discovery.

This guide is general information drawn from FTC publications and the text of the rule, read in October 2026. It is not legal advice; a dealership should confirm its own obligations with its counsel or compliance provider.

Which dealerships the FTC Safeguards Rule covers

The Safeguards Rule covers dealerships that finance or arrange financing for vehicles, and dealerships that lease vehicles for longer than 90 days. The FTC's Safeguards Rule FAQ for automobile dealers (June 2025) says those dealers are financial institutions under the rule, and that coverage depends on what a business does, not what it calls itself. The FAQ also notes that it reflects FTC staff views and does not bind the Commission.

The FAQ is written for automobile dealers. RV, marine and powersports dealers are not named in it, but the FTC's general guidance, FTC Safeguards Rule: What Your Business Needs to Know, makes the same point that "what matters are the types of activities your business undertakes." A boat, RV or powersports store that arranges financing should therefore confirm its status with counsel rather than assume it is outside the rule.

The rule itself is 16 CFR Part 314. The FTC strengthened it in 2021, and a breach-reporting amendment took effect on May 13, 2024, according to the FTC's business blog.

What counts as customer information at a dealership

Customer information, for a dealership, starts with anything tied to financing or leasing. The FTC's dealer FAQ says credit applications, lists of financing or leasing customers, and financial information about those customers are always customer information. Names and addresses on their own, or general sales figures, are not customer information unless they are combined with financing details.

Two further points from the FAQ matter for software. First, the protection lasts as long as the dealership holds the information, even after the customer relationship ends. Second, a database that mixes financing customers with everyone else has to be protected as a whole, although a list pulled from it that shows only buyer names and addresses is not customer information. A summary by the law firm Nelson Mullins (July 2025) adds that the FAQ treats general sales reports and service records as outside the definition.

The practical consequence is that customer information rarely stays inside the DMS. Copies spread to every tool where a salesperson, BDC agent or F&I manager types, texts, records or uploads something about a customer's credit.

The nine required elements of a dealership security program

The Safeguards Rule requires nine elements in the written information security program, listed in 16 CFR 314.4 and summarized by the FTC as follows:

Qualified Individual. Name one person to run and supervise the program. The FTC's dealer FAQ says this can be an employee or someone at an affiliate or service provider.
Risk assessment. Write down the foreseeable internal and external risks to customer information and how well current safeguards handle them, and repeat the assessment periodically.
Safeguards. Put controls in place for the risks found, covering the specific items listed in the next section.
Monitoring and testing. Use continuous monitoring, or else run penetration testing every year and vulnerability assessments at least every six months.
Staff training. Give everyone security awareness training and give the people running the program specialized training.
Service provider oversight. Select capable vendors, require safeguards in the contract and reassess vendors over time.
Keeping the program current. Adjust the program after testing results, and after material changes such as a new system or a new rooftop.
Written incident response plan. Set out goals, roles, decision authority, communication, fixes, documentation and reporting for a security event.
Report to the board. The Qualified Individual reports in writing at least once a year to the board, or to the senior officer where there is no board.

Which specific safeguards the rule names

The rule names eight specific safeguards in 16 CFR 314.4(c). They are access controls that limit each user to the information needed for the job; an inventory of data, devices and systems; encryption of customer information in transit over external networks and at rest; secure development and review of applications; multi-factor authentication for anyone accessing any information system; secure disposal of customer information, generally no later than two years after it was last used to serve the customer; change management procedures; and logging and monitoring of authorized users' activity. The rule lets the Qualified Individual approve alternative controls where encryption is not feasible, and approve equivalent controls in place of multi-factor authentication in writing.

What changes for smaller dealerships

Smaller dealerships get a partial exception, not an exemption. Under 16 CFR 314.6, a financial institution that holds customer information on fewer than 5,000 consumers does not have to meet four provisions: the written risk assessment, the penetration testing and vulnerability assessment schedule, the written incident response plan and the annual written report to the board. Every other element, including vendor oversight, encryption and multi-factor authentication, still applies. The count is of consumers whose information the store holds, not yearly sales, so a store should check the number before relying on the exception.

Where customer information sits in CRM, texting, call and lead tools

Customer information sits in at least four kinds of sales and service software at most stores, in addition to the DMS. The mapping below is this guide's own reading of how the FTC's definitions apply to common dealership tools; it is a starting point for the store's risk assessment, not a legal classification.

CRM

What it can hold: credit application leads, notes on approvals or payment discussions, uploaded documents and customer lists that flag financed or leased buyers.
Who can see it: often every salesperson, BDC agent and manager, sometimes across rooftops.
What to check: role-based access, multi-factor authentication on every login, activity logs, encryption, and whether old records can be deleted on a schedule.

Texting and the shared inbox

What it can hold: messages about approval status, payoff amounts or down payments, and photos of documents customers send to support a deal.
Who can see it: anyone with access to the shared inbox, plus staff who text from personal phones outside any system.
What to check: whether attachments are stored encrypted, who can export threads, how long messages are kept, and a written rule against texting financing details from personal phones.

Call recording and call tracking

What it can hold: recordings and transcripts of calls where customers discuss credit, income or payoffs.
Who can see it: managers reviewing calls, the call tracking vendor and sometimes a marketing agency with account access.
What to check: whether recording links are public or require a login, how long recordings are kept, and which outside parties have logins. The guide to call recording laws for dealerships covers the separate consent rules for recording.

Lead and online credit application tools

What it can hold: full credit applications submitted on the website, through digital retailing tools or from third-party lead providers.
Who can see it: the website provider, the lead provider, the CRM and whoever receives lead notification emails.
What to check: whether credit applications arrive by plain email, which vendors keep their own copy, and whether former employees still receive lead notifications.

Not every company that receives dealership data is a service provider. The FTC's dealer FAQ says a manufacturer that receives names and addresses for recall notices is not a service provider unless it provides services to the dealer, and that a third party receiving data with the customer's consent for a rebate does not create ongoing oversight duties.

A vendor inventory and checklist for each tool

A vendor inventory is the simplest way to show that every tool holding customer information is covered by the program. The FTC defines a service provider as any person or entity that "receives, maintains, processes, or otherwise is permitted access to customer information," and its business guidance says contracts "must spell out your security expectations." For each tool, record the following in one place:

The tool and vendor name, and the person at the store who owns the relationship.
Which customer information it holds: credit applications, financing notes, documents, recordings or none.
Who has access, by role and by name, including outside agencies and former employees still on the list.
Whether multi-factor authentication is switched on for every user, not just available.
Whether the vendor encrypts the data in transit and at rest, and where that is written down.
Whether the contract requires the vendor to maintain safeguards and to notify the store of a security incident.
How data is deleted at the end of the contract and on the store's retention schedule.
The date the vendor was last assessed and the date of the next review.

Questions to send each vendor

Is customer information encrypted in transit and at rest, and can you put that in writing?
Does every user login support and enforce multi-factor authentication or single sign-on?
Can access be limited by role, location and department?
Do you keep logs of logins and user actions, and for how long?
Which of your own staff and subprocessors can access our data, and how is that access approved?
How quickly will you tell us about a security incident that affects our data, and is that in the contract?
Can we set retention periods and delete records that are no longer needed?
Will you sign a data processing agreement or security addendum?
Do you have an independent security assessment or penetration test summary you can share?
When the contract ends, how do we export our data and confirm it was deleted?

Vendor answers vary in how much they publish. As one example, the Shiftix Cloud trust center states that data is encrypted in transit (TLS 1.2+) and at rest (AES-256), that audit logs are kept for at least 12 months and that data processing agreements are available on request, and the platform security page describes two-factor authentication, single sign-on support and per-role access. Published statements are a starting point; the Safeguards Rule still expects the dealership to get the commitments into the contract and reassess the vendor periodically.

Stores reviewing their vendor list often find the same leads and customers sitting in several tools at once. The complimentary Revenue Leak Audit looks at how lead response, follow-up and workflow run across those tools.

What to do if a vendor or the store has a breach

A breach involving unencrypted information about at least 500 consumers must be reported to the FTC as soon as possible and no later than 30 days after discovery. The FTC calls this a notification event, and its October 2023 announcement set out the requirement. The dealer FAQ adds that encrypted information counts if the encryption key was also taken, and that unauthorized acquisition is presumed unless the store has reliable evidence it did not happen.

Reports go through the FTC's online form. Under 16 CFR 314.4(j), the notice includes the store's name and contact details, the types of information involved, the date or date range, the number of consumers affected or potentially affected, a general description of the event and whether law enforcement has asked in writing for a delay. The FTC's business guidance says reports may be made public. Separate state breach notification laws may also apply, which counsel can confirm.

A breach at a vendor still counts when the vendor holds the store's customer information. The incident response plan should therefore name, for each tool in the inventory, who at the vendor the store contacts and what the contract requires the vendor to report.

Next steps

The next step is to match the work to where the store stands today:

No written program yet: name the Qualified Individual and start the vendor inventory above, then build the risk assessment from it.
Program exists but vendors are thin: send the ten vendor questions to every tool that holds credit applications, texts or recordings, and add missing clauses at renewal.
Choosing a new CRM or DMS: put the vendor questions into the selection process. The automotive CRM guide and the guide to cloud-based dealer management systems cover the other selection questions.
Texting from several tools: consolidate where possible and check consent and carrier registration with the dealership text messaging guide.

Frequently asked questions

Can the Qualified Individual be someone outside the dealership?

Yes. The FTC's dealer FAQ says the Qualified Individual can be an employee, or someone at an affiliate or service provider such as a managed IT or compliance firm. When an outside person fills the role, the rule still holds the dealership responsible for the program, and the store has to designate a senior staff member to direct and oversee that person.

Is a car manufacturer a service provider under the Safeguards Rule?

Usually not. The FTC's June 2025 dealer FAQ says a manufacturer that receives names, addresses and VINs for purposes such as recall notices is not a service provider unless it provides services to the dealer. Sharing information that shows a customer financed or leased triggers Privacy Rule notice requirements, so dealers should check what each manufacturer report contains.

Does the Safeguards Rule apply to a dealership that only sells for cash?

Probably not, but the answer depends on the store's activities. The FTC ties dealer coverage to financing, arranging financing and leasing for more than 90 days. A store that refers buyers to a lender or helps them complete a credit application may be arranging financing, so a cash-only claim should be checked with counsel.

How long can a dealership keep old customer files?

Generally no longer than two years after the information was last used to serve the customer. The Safeguards Rule allows longer retention when there is a legitimate business need or a legal requirement, or when targeted disposal is not feasible, and it requires the retention policy to be reviewed periodically. Old CRM records, text threads and recordings fall under the same rule.

Customer data checks often show where leads and follow-up fall between tools. The Revenue Leak Audit is complimentary, carries no obligation and needs no software purchase; it reviews lead response, follow-up, conversion, customer retention, accountability and workflow, and Shiftix Cloud walks through the findings with the dealership.