FTC Safeguards Rule: notify the FTC within 30 days when unencrypted data on 500 or more consumers is acquired

Since May 13, 2024, 16 CFR 314.4(j) requires FTC-regulated financial institutions to report a notification event involving at least 500 consumers to the FTC no later than 30 days after discovery. Discovery is the first day any employee or agent knows.

Source facts

Under 16 CFR 314.4(j), effective May 13, 2024, a financial institution that discovers a notification event involving the information of at least 500 consumers must notify the FTC as soon as possible and no later than 30 days after discovery, using the electronic form on the FTC’s website.

A notification event is acquisition of unencrypted customer information without the individual’s authorization. Information counts as unencrypted if the key was accessed by an unauthorized person, and unauthorized access is presumed to include acquisition unless there is reliable evidence that acquisition did not or could not reasonably have occurred. The event is discovered on the first day it is known to any employee, officer or other agent other than the person committing the breach.

The notice must include the institution’s name and contact information, the types of information involved, the date or date range if it can be determined, the number of consumers affected or potentially affected, a general description, and whether law enforcement has given a written determination that public notice would impede an investigation or damage national security.

Applicability

The part applies to the handling of customer information by financial institutions over which the FTC has jurisdiction. Confirm with counsel that an organization falls under FTC jurisdiction before relying on this rule, and check state breach-notice duties as a separate step.

DSE recommendation

DSE recommends adding the FTC 30-day clock and its reporting fields to the incident-response plan of every FTC-regulated client. Train staff that the clock starts when any employee or agent knows, prepare a worksheet for each required field, keep forensic evidence that could show acquisition did not occur, and confirm with counsel which state notices run in parallel.

Verification

Test the plan with a simulated mailbox compromise exposing a customer spreadsheet. Check that the timeline records the first day of knowledge, that the consumer count and data types can be produced from logs or inventories, and that the FTC notice could be completed within 30 days.

Official reference

eCFR — 16 CFR Part 314, Standards for Safeguarding Customer Information. Reviewed October 18, 2026.