It can apply only if the firm maintains customer information concerning fewer than 5,000 consumers, and it removes only four listed duties. Citation: 16 CFR 314.6.
Primary source: FTC auto dealer Safeguards Rule FAQs
Does the under-5,000-consumer exemption apply to an auto dealer?
Details
Some smaller dealerships may be under 5,000 consumers, but a busy finance office can cross the threshold through retained credit applications and lease records. Under 16 CFR 314.6, being under the threshold does not remove the basic written information security program or FTC breach-notification duty. The firm should document the count method, because old files, leads, former customers, and retained records can matter.
Primary source: FTC auto dealer Safeguards Rule FAQs.
FAQ
Does the under-5,000-consumer exemption apply to an auto dealer?
It can apply only if the firm maintains customer information concerning fewer than 5,000 consumers, and it removes only four listed duties. Citation: 16 CFR 314.6.
What is the data-flow issue for an auto dealer?
Customer information starts in the credit application and F&I desk, then moves into the DMS, lender portals, identity-verification tools, deal jackets, and retained sales or lease records. OEM systems are not automatically dealer service providers, so the WISP should distinguish dealer-controlled systems from manufacturer systems.
Is this legal advice?
No. It is source-cited educational content for a template product, not legal advice.