Your Dealership Counts as a Financial Institution. So Does Your Tax Office.

The paperwork in your back office is financial data

Think about what sits in a typical dealership finance office. Credit applications, Social Security numbers, pay stubs, driver's license copies and bank details. A tax office holds much of the same, plus full returns. A mortgage broker holds even more.

Owners of these businesses often think of data security as a bank problem. Federal law treats the data the same no matter whose desk it sits on, and the Federal Trade Commission is the agency that enforces it for many of these firms.

What the evidence says

The Safeguards Rule lives at Title 16 of the Code of Federal Regulations, Part 314. Its scope section names the kinds of businesses it covers, including mortgage lenders, finance companies, mortgage brokers, collection agencies, credit counselors and tax preparation firms. Its definitions treat a customer relationship as including a deal where a business arranges or brokers a home loan or credit to buy a vehicle. They also say a car dealership that leases cars for longer than 90 days as a usual part of its business is a financial institution for that leasing work.

The FTC updated the rule in a notice published in the Federal Register on December 9, 2021. The update added specific requirements. A covered business must name a Qualified Individual to run its security program. It must encrypt customer information both at rest and when it travels over outside networks, unless that is not workable and the Qualified Individual approves other controls. It must use multifactor login for anyone who accesses its systems. It must keep a written incident response plan, and the Qualified Individual must report in writing at least once a year to the owners or board.

Then on November 13, 2023 the FTC published a further change that took effect on May 13, 2024. It requires a covered business to notify the FTC as soon as possible, and no later than 30 days after discovery, when unencrypted customer information about at least 500 consumers is taken without permission. The rule says data counts as unencrypted if the encryption key was also stolen. It also says unauthorized access is presumed to mean the data was taken unless the business has reliable evidence otherwise.

The report goes in electronically on a form on the FTC website. It has to include the type of information involved, the date or date range if known, the number of consumers affected and a general description of what happened.

Why small firms get caught off guard

They do not know they are covered

A dealer thinks of itself as a car seller and a tax preparer thinks of itself as a seasonal office. Neither may realize the rule applies until a breach forces the question.

Nobody can count the records

To know whether a breach crosses the 500 mark, you have to know what was on the system that was hit. Firms that keep old deal jackets, scanned files and email attachments for years often cannot answer that quickly.

Old records never get cleared out

The rule says customer information should generally be disposed of no later than two years after it was last used to serve that customer, unless there is a business or legal reason to keep it. Records that should be gone still count when they are stolen.

How to get ready before something happens

1. 1Confirm whether your business is covered, especially if you arrange financing, lease vehicles, prepare taxes or broker loans.
2. 2Name one person as your Qualified Individual, whether on staff or through a trusted provider.
3. 3List every system, file share, mailbox and paper file that holds customer financial data.
4. 4Turn on encryption for stored customer data and for data sent outside your network.
5. 5Require multifactor login on email, dealer and tax software and remote access.
6. 6Set a schedule to dispose of customer records two years after last use unless you have a reason to keep them.
7. 7Write a short incident plan that covers who decides, how you count affected customers and how you file the FTC notice within 30 days.

None of this needs a big security team. It needs a clear owner, a current list of where the data is and a few settings turned on that many systems already support.

What this means if you run a company in Oklahoma

Oklahoma has a long list of independent car lots, family tax offices and local mortgage shops. Many run on a handful of staff and an outside IT helper. They hold exactly the kind of data criminals want, often with less protection than a bank.

The rule does give some relief. Firms that hold data on fewer than 5,000 consumers are exempt from a few parts, such as the written risk assessment, the incident plan and the yearly written report. The 30 day breach notice has no such exemption.

At Oklahoma Data Partners, we help Oklahoma dealers, tax offices and lenders find where customer data lives, clear out what they no longer need and set up the encryption, access and records that the Safeguards Rule expects. If your business handles customer financial data, book a consultation.