FTC Approves New Data Breach Notification Requirement For Nonbanking Financial Institutions

Executive Summary

With an amendment to its Safeguards Rule, the Federal Trade Commission has joined other federal agencies regulating cybersecurity breaches. Our Privacy, Cyber & Data Strategy Team analyzes how the amendment will affect nonbanking financial institutions and how it dovetails – and conflicts – with myriad other federal and state data breach notification regulations.

• The amendment directly affects nonbanking institutions like financial advisors and collection agencies
• Companies will need to notify the FTC when information from 500 or more customers was affected
• Company cybersecurity programs will need to account for FTC regulations separately from state regulations