Short answer: Yes. The FTC Safeguards Rule sets federal requirements for protecting customer financial information, but it doesn't override or replace state law — most states have their own separate data breach notification statutes that apply in addition to the Safeguards Rule's requirements. A dealership can be fully compliant with the federal rule and still have separate obligations under its state's specific breach notification law, particularly around notifying affected customers directly, which the Safeguards Rule itself doesn't require.
Why this gap catches dealers off guard
The Safeguards Rule's 30-day FTC notification requirement is specific and well-defined, which can create a false impression that it's the complete breach notification picture. It isn't. Notably, the Safeguards Rule requires notifying the FTC, but does not require notifying the affected customers themselves. That obligation typically comes from state law instead, and nearly every state has its own data breach notification statute covering this.
What state breach notification laws typically require
State laws vary, but common elements include:
- A requirement to notify affected individuals directly, typically within a specified timeframe after discovery, separate from and often on a different timeline than the FTC's 30-day requirement.
- Specific content requirements for the notice, which can differ from what the FTC's reporting form requires.
- In some states, notification to a state attorney general or consumer protection agency, in addition to notifying the FTC and affected individuals.
- Different triggering thresholds. Some state laws define a reportable breach differently than the Safeguards Rule's 500-consumer threshold, meaning a smaller incident that doesn't trigger FTC notification could still trigger state notification requirements.
Why multi-state dealer groups face a real patchwork problem
A dealer group with locations in multiple states, or one that serves customers across state lines, can't rely on a single breach response template. Different states' requirements around timing, content, and thresholds mean a genuinely compliant response may need to be tailored per state depending on which customers were affected — a single generic notification letter satisfying every applicable state law isn't guaranteed.
Where this connects to broader dealer compliance obligations
Auto dealers already navigate multiple overlapping compliance frameworks beyond just the Safeguards Rule — state-level pricing and advertising disclosure laws, for example, vary in similar ways. Data breach notification follows the same pattern: a federal baseline (the Safeguards Rule) with a state-by-state layer of additional or different requirements on top.
What this means for your incident response plan
A written incident response plan that only accounts for the FTC's 30-day, 500-consumer reporting requirement is addressing federal law only. A genuinely complete plan needs to also identify what your specific state (or states, for a multi-location dealer) require for notifying affected customers directly, and build that into the same response process rather than treating it as a separate afterthought once the FTC notification is handled.
Getting clarity for your specific state
General guidance about the Safeguards Rule can't tell you what your specific state requires for direct customer notification — that requires checking your state's specific breach notification statute, or consulting legal counsel familiar with your state's requirements, particularly around timing and threshold differences from the federal rule.