FTC Safeguards Rule — 2021 security-program amendments
Enacted in force
Fields requiring verification
- enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
In plain English
- Financial institutions within FTC Safeguards Rule jurisdiction that handle covered customer information, including applicable non-bank financial institutions and finders. Primary source
- Institutions maintaining customer information concerning fewer than 5,000 consumers have specified exceptions, not a complete exemption. Primary source
- Designate a qualified individual and maintain a written information-security program based on risk assessment. Primary source
- Implement applicable access controls, encryption or approved compensating controls, multifactor authentication or approved equivalents, testing and secure disposal. Primary source
- Oversee service providers and implement applicable incident-response, reporting and board-governance controls, respecting the limited small-institution exceptions. Primary source
Dates and phased obligations
Legal effective date: 2022-01-10; principal compliance date: 2023-06-09. Primary source
Some provisions became effective January 10, 2022. The separately sourced extension moved the specified provisions originally due December 9, 2022 to June 9, 2023. The extension is supporting evidence for this row and is not counted as a separate instrument. This row covers the 2021 security-program amendment, not later breach-reporting amendments. Source and qualifications
Questions from this record
Who does 16 CFR 314; 86 FR 70272 cover?
Financial institutions within FTC Safeguards Rule jurisdiction that handle covered customer information, including applicable non-bank financial institutions and finders. Institutions maintaining customer information concerning fewer than 5,000 consumers have specified exceptions, not a complete exemption. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
Legal effective date: 2022-01-10; principal compliance date: 2023-06-09. Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
- FTC final rule, 86 FR 70272DATES; 16 CFR 314.1–314.5
- FTC compliance extension, 87 FR 71509DATES; amended 16 CFR 314.5
Verification history
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.