Auto Dealership Cybersecurity & Compliance Solutions

GLBA Compliance and the FTC Safeguards Rule for Dealerships

The regulatory picture has shifted just as sharply. Automotive dealerships are classified as financial institutions under the Gramm-Leach-Bliley Act (GLBA) because they regularly arrange financing and leasing for their customers. That classification places every dealership squarely under the amended FTC Safeguards Rule, which took full effect in June 2023 and carries specific, non-negotiable requirements. Dealers must designate a qualified individual to oversee their information security program, conduct written risk assessments, implement access controls and encryption, deploy multi-factor authentication, monitor and log activity, establish a written incident response plan, and provide security awareness training to staff. The FTC has made clear that it intends to enforce these provisions, and dealerships that treat compliance as a box-checking exercise rather than a functioning security program expose themselves to regulatory penalties, reputational damage, and the very breaches the rule was designed to prevent.

Compounding the challenge is the fact that many dealerships must also address the Payment Card Industry Data Security Standard (PCI DSS) when they accept credit card payments for vehicles, service, and parts, along with a patchwork of state-level data privacy and breach notification laws that continue to expand. For dealer groups operating across multiple states, this means reconciling overlapping obligations while maintaining consistent controls across every rooftop. Compliance can no longer be handled reactively at the individual store level; it demands a coordinated, program-driven approach that accounts for third-party vendors, DMS integrations, and the flow of customer data across sales, finance, and service.

How Compass IT Compliance Supports Automotive Dealerships

As dealerships work to satisfy the FTC Safeguards Rule while defending against an increasingly aggressive threat landscape, the demand for practical, dealer-specific security expertise has never been higher. Building and maintaining a written information security program, keeping pace with evolving regulatory expectations, and hardening systems against ransomware and data theft requires specialized knowledge that most dealership IT staff were never hired to provide. Compass IT Compliance helps dealerships and dealer groups close that gap, translating regulatory requirements into functioning controls and giving management the confidence that customer data is protected and examiner expectations are met.