← Global Privacy Laws Research Library
16 CFR Part 314
FTC Safeguards Rule
Prepared by Shubhank Suman · Last reviewed
Status not verified beyond supplied text
- Legal character
- Federal regulation
- Region
- North America
What it covers
Risk-based administrative, technical and physical protection of customer information through a written security programme, a Qualified Individual, risk assessments, controls, testing, staff training, provider oversight, response and reporting.
Why it matters
Covers FTC-jurisdiction financial institutions, including listed nonbank financial businesses, rather than all banks or businesses. Information held about other institutions’ customers can also be covered.
Refer to it when
Research financial-sector security programmes, encryption/MFA, service-provider contracts, incident response or FTC notification events.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: High
- Cyber: Very High
AI
LOW RELEVANCE
AI systems handling customer information fall within relevant safeguards; no general AI rules.
Privacy
HIGH RELEVANCE
Protects customer information from unauthorised access and use.
Cybersecurity
VERY HIGH RELEVANCE
Detailed security, testing, provider and response duties.
Applicability
Financial institutions within FTC rulemaking/enforcement jurisdiction under the cited GLBA provisions, including customer information possessed on behalf of other institutions.
Read first
§ 314.1 → .2 → .3-.4 → .6; inspect the notification-event definition with .4(j).
Provisions / sections covered
§§ 314.1-.3 - Scope, definitions and programme
Defines covered financial institutions and customer information and requires a written programme proportionate to complexity and data sensitivity.
§ 314.4(a)-(g) - Governance and controls
Qualified Individual, risk assessment, access controls, encryption or approved compensating controls, MFA or approved equivalent, secure development/disposal, testing, training and service-provider oversight.
§ 314.4(h)-(i) - Response and reporting
Written incident response and at-least-annual governing-body reporting, subject to the limited § 314.6 exceptions.
§ 314.4(j) - FTC notification
A notification event involving at least 500 consumers requires notice as soon as possible and within 30 days of discovery. The trigger concerns unauthorised acquisition of unencrypted customer information, with the encryption-key and presumptive-access qualifications; this is not a general consumer-notification rule.
§§ 314.5-.6 - Dates and limited exceptions
The supplied text makes paragraph (j) effective 13 May 2024. Fewer than 5,000 consumers exempts only § 314.4(b)(1), (d)(2), (h) and (i), not all safeguards or FTC notification.
Subject-matter tags
- Data breach
- Enforcement and penalties
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- Gramm-Leach-Bliley Act – Privacy (15 U.S.C. Chapter 94)Law · Current (amended)Enabling statute for financial-information safeguards.
- FTC Privacy of Consumer Financial Information RuleRegulation · Status not verifiedSeparate privacy notice/sharing rule with narrower dealer-focused scope.
- SEC Regulations S-P, S-AM and S-IDRegulation · Status not verifiedSEC safeguards are a different regulator-specific regime, not a substitute scope test.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.