Short answer: A Qualified Individual is the specific, named person the FTC Safeguards Rule requires every covered dealership to designate as responsible for overseeing, implementing, and enforcing its information security program. At a small independent dealership, this is typically the owner, general manager, or another senior manager — it doesn't require hiring a dedicated security professional, but it does require formally naming someone with real authority over the program, not a vague reference to "management."
Why this role exists in the rule
Before the 2023 amendments, dealers could satisfy the rule's spirit with a general sense that "someone" was responsible for security. The current rule is more specific: it requires a named individual, and that person needs actual authority to implement and enforce the program — not just a title with no real decision-making power behind it.
What the Qualified Individual is actually responsible for
- Overseeing the development and implementation of the dealership's information security program
- Ensuring the risk assessment gets completed and stays current
- Making decisions about specific safeguards, including approving any alternative access controls in place of standard requirements (more on this below)
- Reporting periodically, in writing, to the dealership's ownership or board on the state of the program
- Serving as the point of accountability if a lender, examiner, or the FTC asks who's responsible for the program
Does the Qualified Individual need special certifications?
No. The rule doesn't require specific credentials, certifications, or a security background. What it requires is that the person actually have the knowledge and authority to fulfill the role, and that the designation be documented in writing. For a small independent dealership, this is realistically the owner or a senior manager who understands the dealership's operations well enough to make informed decisions about protecting customer data, not necessarily a technical security expert.
Can you outsource this role?
The rule allows a dealership to designate a Qualified Individual who works for an affiliate or a service provider, rather than requiring an employee. In practice, this means a dealership could designate a compliance consultant or an outside firm in this role. However, even when outsourced, the dealership itself remains responsible for ensuring the arrangement actually satisfies the rule's requirements — outsourcing the role doesn't outsource accountability.
A specific authority worth knowing about: approving alternative access controls
One notable, specific power the rule gives the Qualified Individual: multi-factor authentication is generally required for anyone accessing your information systems, but the Qualified Individual can approve, in writing, the use of reasonably equivalent or more secure alternative access controls instead. This isn't a loophole to skip MFA casually — it's a specific, documented exception that requires the Qualified Individual's genuine judgment and a written record of that decision.
What happens if this designation is missing or unclear
A dealership without a clearly documented Qualified Individual has a specific, easily identifiable gap that stands out immediately to anyone reviewing your compliance program — a lender, an examiner, or the FTC itself. Compared to some other requirements that involve more subjective judgment calls, this one is close to binary: either you have a named person with documented authority, or you don't.
Making sure this is actually documented
The designation needs to exist in writing, not just as a general understanding within the dealership. Sterling Safeguard's platform includes a specific Qualified Individual designation as part of its core documentation, ensuring this foundational requirement is clearly on record rather than assumed.