FTC Safeguards Rule Compliance Guide for Orange County Businesses (2026)

Yes — most auto dealerships are covered. Arranging financing or leasing is a financial activity under the GLBA framework, which generally makes franchised and independent dealers "financial institutions" subject to the FTC Safeguards Rule. Orange County dealers that originate or facilitate consumer financing should assume the Rule applies and build a written information security program, confirming specifics with the FTC and counsel.

Generally, yes. Tax preparers and accounting firms that handle clients' financial information are typically treated as financial institutions under the Rule and must maintain a written information security program. Many preparers are also expected to maintain a written data security plan as part of professional and IRS expectations. Confirm your exact obligations with the FTC, the IRS, and your counsel.

A Qualified Individual is the single person a covered business designates to oversee, implement, and enforce its information security program. The Rule allows this to be an employee or a qualified third party such as a managed IT provider, but the business retains ultimate responsibility. The Qualified Individual generally must also report in writing to the board or senior leadership.

Yes, in general. The Rule expects covered businesses to require multi-factor authentication for access to systems holding customer information and to encrypt customer data at rest and in transit. Where MFA or encryption is infeasible, the Qualified Individual can typically approve equivalent or more secure compensating controls. Verify the current requirements at ftc.gov.

Smaller businesses below a certain customer-information threshold may be exempt from some of the more formal requirements — such as a written risk assessment, certain reporting, and penetration testing — but they are still expected to safeguard customer data. The threshold and its conditions can change, so OC small businesses should verify current rules with the FTC and counsel rather than assuming exemption.

BRITECITY, based in Irvine and serving Orange County, can assess your current safeguards against the Rule, identify gaps, and build a documented, defensible information security program — including the Qualified Individual role, technical controls, monitoring, vendor oversight, and reporting. Start with an IT health check or a call to scope your obligations.