FTC Safeguards Rule Security Event Notices: The 30-Day Clock and the Record You Keep
October 14, 2026
Compliance guide
The FTC Safeguards Rule requires covered financial institutions to report certain security events involving customer information. A reliable process identifies whether the rule applies, starts the 30-day clock from the correct discovery date, submits the required information, and preserves evidence of the decision and filing.
Who is covered
The Safeguards Rule applies to financial institutions within the FTC's jurisdiction that are not subject to enforcement of the Gramm-Leach-Bliley Act's safeguards requirements by another agency. Coverage depends on the activities an organization performs, not only on whether it describes itself as a bank or financial company.
FTC guidance identifies examples of potentially covered nonbank institutions, including mortgage lenders and brokers, finance companies, payday lenders, tax-preparation firms, check cashers, debt collectors, and certain financial advisers. Organizations should assess their activities, regulator status, and applicable definitions against the FTC Safeguards Rule guidance and 16 CFR Part 314.
The FTC security-event notification requirement took effect on May 13, 2024. It appears in 16 CFR 314.4(j). Coverage review should be documented before an incident occurs and revisited when business activities or regulatory status change.
What triggers the notice
The rule requires electronic notice to the FTC when a notification event involves the information of at least 500 consumers. A notification event is the unauthorized acquisition of unencrypted customer information. The relevant definitions are set out in 16 CFR 314.2.
The rule presumes unauthorized acquisition when an unauthorized person accessed unencrypted customer information. An institution can rebut that presumption with reliable evidence that unauthorized acquisition did not occur and could not reasonably have occurred. Information is treated as unencrypted if an unauthorized person obtained the encryption key.
An incident assessment should therefore establish:
- Whether the organization and information fall within the rule.
- Whether the information involved is customer information.
- Whether access or acquisition was unauthorized.
- Whether the information was encrypted, including whether an unauthorized person obtained the key.
- The number of consumers affected or potentially affected.
The 500-consumer threshold is not limited to confirmed identity misuse. The institution must assess the number of consumers whose information was affected or potentially affected based on available evidence. Record the count methodology, source data, assumptions, and later updates.
The 30-day clock and discovery standard
A covered institution must notify the FTC as soon as possible and no later than 30 days after discovery of a qualifying event. Discovery is measured from the first day the event is known to the institution.
The institution is deemed to know of the event when it is known to any employee, officer, or other agent, except the person who committed the breach. Senior management's later awareness does not reset the clock. Nor does the date an incident is formally escalated or classified replace an earlier awareness date under the rule.
Incident procedures should capture the earliest report or observation that could establish knowledge of the event. Record when the information was received, who received it, what was known at that time, and when additional facts were established. Preserve the distinctions between first awareness, investigation milestones, and the final scope assessment.
Start deadline tracking promptly while facts are investigated. Assign an accountable owner, record the calculated deadline and its basis, and escalate changes in scope or consumer count. Internal review should not obscure the original awareness date. For deadline calculation and legal interpretation, consult counsel as appropriate.
Submit and document the FTC notification
The notification must be submitted electronically through the FTC Safeguards Rule Security Event Reporting Form. The regulation requires the institution to provide:
- Its name and contact information.
- The types of information involved.
- The event date or date range, if determinable.
- The number of consumers affected or potentially affected.
- A general description of the event.
- Information about any written law-enforcement determination that public notification would impede a criminal investigation or damage national security, including a means for the FTC to contact the official.
Before submission, reconcile the event description and count against the incident record. Identify information that remains under investigation and maintain a consistent basis for any estimate. Retain the submitted form or a complete copy of its contents, submission date and time, confirmation or receipt, and the identity of the preparer and reviewer. Preserve any subsequent updates with their dates and supporting basis.
The regulation provides a specific process for law-enforcement requests concerning public disclosure. It does not establish a general extension of the 30-day FTC filing deadline. Document any written determination, request, related correspondence, and advice received, and assess its effect with counsel.
Keep the decision record, including a no-filing conclusion
Not every security incident meets the Safeguards Rule notification threshold. When the institution concludes that no FTC filing is required, preserve the reasoning and evidence supporting that decision. A concise decision record can show what facts were reviewed and why the event did or did not meet the rule's criteria.
The incident file should connect the assessment, decision, filing, and follow-up. Include:
- Coverage analysis: The activities assessed, regulator status, applicable rule provisions, and decision owner.
- Event chronology: Initial awareness, reporting channels, investigation milestones, and the basis for the discovery date.
- Information and consumer assessment: Information types, encryption status, access or acquisition evidence, count methodology, assumptions, and revisions.
- Decision record: Whether the notification threshold was met, the rationale, approvals, and any counsel or specialist review.
- FTC submission evidence: Submitted information, filing timestamp, confirmation, correspondence, and updates.
- Response and remediation: Containment, corrective actions, assigned owners, completion evidence, and incident-plan review.
Preserve original records and subsequent amendments without overwriting prior decisions. Apply access controls, retention schedules, and legal holds consistent with organizational policy and applicable obligations.
Keep federal and state notice obligations separate
An FTC filing does not replace independent state data-breach notification obligations. State laws may impose separate duties, recipients, thresholds, triggering events, and deadlines. Maintain a parallel jurisdiction review rather than treating the federal form as a complete compliance notice process.
For a state-focused overview, see State Data Breach Notification Deadlines. Verify current statutes and agency guidance for each applicable jurisdiction. The FTC filing is a federal regulatory notice; it does not, by itself, establish that any separate consumer or state regulator notice has been completed.
Prepare the evidence file for oversight
A review-ready record allows an authorized reviewer to trace the requirement, scope, decision, deadline, submission, and follow-up. Link the regulatory source and coverage analysis to the incident record. Keep approval history and evidence of filing accessible to the designated oversight roles.
A structured registry process can help assign ownership, maintain controlled records, and preserve decision history. National Compliance Registry's services support compliance registration management, secure records, and documented notice workflows.
General compliance information, not legal advice.