How do you report a breach to the FTC under the Safeguards Rule?

If you run a tax practice, mortgage brokerage, auto dealership or an advisory firm that is not registered with the SEC, a breach involving 500 or more customers now means a report to the FTC within 30 days. The form itself is short. The hard part is having the facts ready before the deadline.

When does the FTC Safeguards Rule require breach notification?

A report is required when a notification event involves the information of at least 500 consumers. Under 16 CFR 314.4(j), the firm must notify the FTC "as soon as possible, and no later than 30 days after discovery of the event." The requirement took effect on May 13, 2024.

The rule applies to non-bank financial institutions under the FTC's jurisdiction. The FTC's Safeguards Rule guide lists examples that include mortgage brokers, tax preparation firms, finance companies, and investment advisers that are not required to register with the SEC. SEC-registered advisers and broker-dealers report under Regulation S-P instead, which has its own notice rules.

The small-firm exception does not remove this duty. 16 CFR 314.6 exempts firms with customer information on fewer than 5,000 consumers from the written risk assessment, testing, written incident response plan and board report. FTC notification under paragraph (j) is not on that list.

What counts as a notification event?

A notification event is the acquisition of unencrypted customer information without the authorization of the person it belongs to. The definition sits in 16 CFR 314.2(m), and two details change how most incidents are judged.

• Encrypted data is treated as unencrypted if the encryption key was also accessed by an unauthorized person.
• Unauthorized access to unencrypted customer information is presumed to be unauthorized acquisition, unless the firm has reliable evidence showing that acquisition did not occur or could not reasonably have occurred.

That presumption matters. An intruder who sat inside a mailbox full of tax returns or loan files for a week will usually trigger the presumption, even if the logs never show a download. Overcoming it takes evidence, such as audit logs that show what was and was not touched. A firm that does not keep those logs has little to point to.

When does the 30-day clock start?

The clock starts on the first day the event is known to the firm. Paragraph (j)(2) says a notification event is treated as discovered on that day, and it counts knowledge held by any employee, officer or other agent of the firm, other than the person who committed the breach.

In practice, the day a staff member reports a strange login, or the day your IT provider confirms an account takeover, can be the discovery date. The clock does not wait for a forensic report or a final consumer count. That is why the FTC's guide tells firms that lack some details to report what they know and file an update later.

What does the FTC's online form ask for?

The Safeguards Rule Security Event Reporting Form is a short web form in five steps. The rule requires the notice to be submitted electronically on this form. Here is what each step collects.

Step 1: Contact person at the affected financial institution

The name of the affected financial institution, plus the name, email and phone number of a contact person. A checkbox marks the filing as "an update to an existing report."

Step 2: Submitter contact information

This step is only for third parties filing on the firm's behalf, such as outside counsel or a service provider. It asks for the submitter's company name, contact name, email and phone.

Step 3: Notification event information

The start and end dates of the event, the number of consumers affected or potentially affected, the types of information involved, and a summary of the event. A checkbox lets you request a secure file transfer link, and the form says a reply email will follow within two business days.

Step 4: Delayed publishing

A "Law Enforcement Delay Requested" checkbox for cases where law enforcement has asked that public release be delayed.

Step 5: Verification and submit

A short human verification question before the report is sent. The FTC estimates the burden at five hours, including time to read the instructions and gather the information.

These fields track the contents the rule requires: the firm's name and contact information, the types of information involved, the date or date range if it can be determined, the number of consumers affected, a general description, and whether law enforcement has asked for a delay.

Will the report be made public?

It may be. The form states, "Your report may be made public," and the FTC's guide notes reports can be released, for example through a Freedom of Information Act request. Write the summary with that in mind: factual, specific about what happened and what data was involved, and free of speculation about causes you have not confirmed.

The law enforcement delay is narrow. A law enforcement official must determine that public disclosure would impede a criminal investigation or damage national security. The rule allows an initial delay of up to 30 days, an extension of up to 60 more days on a written request, and further delay only if FTC staff agree that disclosure would still cause that harm. The form asks for a way to contact the official.

What should you gather before you open the form?

Gather the six facts the rule requires and the evidence behind them. A firm that tracks these during the response can file in an afternoon. A firm that starts on day 29 usually cannot.

• The discovery date, and who knew first. This sets your deadline.
• The start and end dates of the unauthorized access, from sign-in logs, email audit logs or endpoint records.
• The data types involved: names, Social Security numbers, account numbers, tax returns, loan applications, driver's license images.
• A consumer count, with the method you used to reach it. A range is better than nothing if the count is still moving.
• Whether the data was encrypted, and whether any keys or passwords that protect it were exposed.
• Any written law enforcement request for delay, and the official's contact details.
• A short internal summary that legal counsel, leadership and your IT provider have all read.

What should you do this quarter?

This quarter, build the FTC report into your response plan as a planned step.

• Add the FTC form link, the 500-consumer threshold and the 30-day deadline to your written incident response plan required by 16 CFR 314.4(h). Firms exempt from (h) can still keep a one-page procedure.
• Name the person who decides whether an event is reportable, such as your Qualified Individual, and the person who files. Decide whether outside counsel or a service provider will file for you under Step 2.
• Confirm your email and file systems keep audit logs long enough to show what an intruder accessed. Without logs, the presumption of acquisition is hard to rebut.
• Check which customer data is encrypted at rest and where keys and admin passwords are stored.
• Ask your IT provider how fast it will tell you about a suspected breach, in writing. Your 30-day clock may start when its staff know.
• Run a short tabletop that ends with a completed draft of the form.

FTC notice does not replace other obligations. State breach notification laws, including California's, can require separate notices to consumers and regulators on different timelines. Confirm those with counsel as part of the same plan. Tax practices can pair this with our FTC Safeguards Rule checklist for tax preparers.

How does s90 help?

s90 supports tax practices, mortgage brokers and advisers covered by the Safeguards Rule in Los Angeles and Orange County. Our client agreements include a 72-hour breach notification commitment and a 24-hour evidence production commitment, so you get the logs and timelines the FTC form asks for while the clock is still early. If you want to test your plan against the form before you need it, we are glad to walk through it with you.