Understanding the FTC's New Data Breach Notification Requirements

Every lender has a folder somewhere labeled, in spirit if not in ink, “things that happen to other companies.” Data breaches usually live in that folder. They are the sort of event that visits retailers, hospitals, and social media platforms, the kind of headline you read over coffee while feeling quietly grateful it is not about you. For non-bank lenders in particular, there has long been a comforting assumption that breach-notification duty is a bank problem, or a big-tech problem, or at worst a fifty-state patchwork you can manage with a spreadsheet and a good vendor. That assumption has a hole in it, and the hole has a thirty-day fuse attached.

The Rule You Are Probably Already Subject To

Start with a fact that surprises a remarkable number of otherwise sophisticated executives: if you are a non-bank consumer lender, you are almost certainly a “financial institution” under the Gramm-Leach-Bliley Act, and therefore squarely inside the Federal Trade Commission’s Safeguards Rule. Mortgage lenders, mortgage brokers, payday lenders, finance companies, auto dealers that arrange financing, and collection agencies are all named residents of this particular neighborhood.¹ The word “bank” appears nowhere in the definition, which is precisely why so many non-banks assume the rule waves at them from a distance rather than knocking on the door.

The Safeguards Rule already asks for a good deal of financial institutions. It expects a written information security program, a designated qualified individual to run it, annual risk assessments, encryption of customer information, multi-factor authentication for anyone touching the systems, vendor oversight, incident response planning, and periodic reporting up to the board or its equivalent.¹ None of that is new, and most compliance functions know the checklist even if the implementation is, let us politely say, aspirational. What is newer, and what tends to get lost, is the amendment that took effect in May 2024.

The Part Where You Tell the Government, and the Government Tells Everyone

As of May 2024, a covered financial institution must notify the FTC of a “notification event” as soon as possible, and in no case later than thirty (30) days after discovery, whenever unencrypted customer information of at least five hundred (500) consumers has been acquired without authorization.² Thirty days is not thirty business days, it is not thirty days after your outside forensics firm finishes its report, and it is emphatically not thirty days after your public relations team decides how it feels. The clock starts at discovery, which in the real world means the clock often starts before anyone in the building fully understands what happened.

Here is the detail that turns a routine compliance obligation into a genuinely interesting one. The FTC does not simply file your notice in a drawer. Every report submitted under this requirement is entered into a publicly available online database on the Commission’s own website.³ The agency considered the industry’s entirely reasonable objection, which was roughly “you are asking us to publish a map of where we were just robbed,” and concluded that consumer transparency outweighed the discomfort.³ So the notice that lists your institution’s name, the categories of information involved, the date range of the event, and the number of consumers affected does not stay between you and your regulator. It becomes a searchable entry that plaintiffs’ lawyers, journalists, competitors, and your most anxious customers can pull up at their leisure.³

It is, in effect, a mandatory public confession with a thirty-day deadline. One imagines the FTC’s user-experience team debating whether the submission button should simply say “Post.”

Why “We Take Security Seriously” Is Not a Filing Strategy

The reason this matters at the executive level, rather than merely the IT level, is timing and consequence. Civil penalties for violations of the FTC Act now run to more than fifty-three thousand dollars ($53,000) per violation, a figure the Commission cheerfully adjusts upward for inflation each year, and in a data-breach scenario “per violation” has an unpleasant way of multiplying.⁴ A late filing does not undo the breach; it simply adds a second, entirely self-inflicted problem on top of the first one, and this second problem is documented, dated, and difficult to explain to a board.

The deeper trap is organizational rather than legal. A thirty-day disclosure obligation collides directly with the natural instincts of an organization in crisis, which are to investigate quietly, to avoid saying anything that is not yet certain, and to keep the circle small. Those instincts are understandable and, in the compressed timeline the rule imposes, are actively dangerous. The institutions that miss the deadline will rarely be the ones that did not care. They will be the ones that were still holding meetings about whether a reportable event had really occurred while the fuse quietly burned down.

The Good News (seriously, there is some), and What to Actually Do

The genuinely encouraging news is that this is a solvable problem, and solving it costs far less than the alternative. Breach notification is one of the few compliance obligations where a modest amount of preparation converts a potential catastrophe into a manageable Tuesday.

First, confirm your status in writing rather than by assumption. If your institution extends, brokers, services, or collects on consumer credit, treat yourself as a covered financial institution under the Safeguards Rule until qualified counsel tells you otherwise, and do not let the absence of the word “bank” in your name lull anyone into thinking the rule is someone else’s homework. Second, build the thirty-day clock into your incident response plan now, before there is an incident, with a pre-identified decision-maker who owns the notification call and a template already drafted so that the choice under pressure is “send” rather than “draft from scratch at midnight.” Third, close the gap between discovery and awareness, because the rule runs from discovery and your exposure grows with every day the right people do not know what the wrong people already do; that means real detection, real escalation paths, and vendor contracts that require your service providers to tell you fast. Fourth, get the underlying controls into genuine working order, because encryption is not merely good practice here; it is the on-off switch for the entire obligation. Properly encrypted information that is acquired without the key is not a reportable notification event, which means the same encryption that protects your customers can also keep your institution out of the public database entirely.

There is a quiet elegance to how this rule is built. It rewards exactly the behavior a well-run lender should want anyway: encrypt the sensitive data, know when something has gone wrong, and have a grown-up ready to make the call. The firms that treat the thirty-day rule as a prompt to fix these things in calm weather will be the ones who, on the worst day, simply execute a plan. The public database is coming for the unprepared, not the diligent. Be the institution that filed on day three, accurately and without drama, and let the searchable entry read as evidence that you had your act together. In this line of work, boring and on time is not a consolation prize. It is the whole game.

This article is provided for general informational purposes only and does not constitute legal advice, nor does it create an attorney-client relationship. The regulatory developments discussed are evolving, and readers should consult qualified counsel regarding their specific circumstances.