FTC Safeguards Rule: the 30 day breach notice for 500 consumers

Under the FTC Safeguards Rule, a covered financial institution must notify the FTC as soon as possible, and no later than 30 days after discovery, of a notification event involving unencrypted information on at least 500 consumers. The requirement took effect in May 2024. This is education, not legal advice.

What counts as a notification event

The FTC's guidance describes it as a security breach involving unauthorised acquisition of unencrypted customer information of at least 500 consumers. Two details matter to engineers.

First, encrypted information is treated as unencrypted if an unauthorised person accessed the encryption key. Encryption helps only if the key stayed safe.

Second, unauthorised access to unencrypted information is presumed to be unauthorised acquisition unless you have reliable evidence showing it was not acquired. That again puts weight on logs.

When discovery happens

Under 16 CFR 314.4(j)(2), an event is treated as discovered on the first day it is known to the institution. Knowledge by any employee, officer or other agent counts, except for the person who committed the breach. A junior analyst who sees the signs on Tuesday starts the clock even if management hears on Friday.

What the notice contains

Section 314.4(j)(1) lists:

• the institution's name and contact information
• the types of information involved
• the date or date range of the event, if it can be determined
• the number of consumers affected or potentially affected
• a general description of the event
• whether a law enforcement official has given a written determination that public notice would impede an investigation or threaten national security, plus a way for the FTC to contact that official

The FTC says you submit through an online form, and that if you lack all details you should submit what you know and file an update later.

Law enforcement delay

A law enforcement official may request an initial delay of up to 30 days after the FTC notice, and can extend by up to 60 more days with a written request. Further delay needs a determination by FTC staff. Do not assume a verbal request from an investigator is enough.

Build the 500 count before you need it

The threshold is about consumers, not records. Engineers can prepare by knowing where customer data lives and how to count distinct people in each store. When an incident hits at 2 a.m., counting from scratch is slow.

A short list works well:

1. A data map of systems holding customer information.
2. A saved query per store that returns distinct consumer counts.
3. Log retention long enough to show what was accessed.
4. A named person who can file the FTC form.

Quick check

Sources

• FTC: Safeguards Rule, what your business needs to know
• 16 CFR 314.4

Last reviewed: 19 October 2026.