Many Auto Dealership Groups Have Customer Data Compliance Responsibilities. Few Have a Complete View of Them.

Keeping data safe has never been simple, and it’s only getting more complex with connected systems talking to each other and the compliance rules dealerships have to follow. For auto dealerships that span multiple entities (including external vendors), it’s nearly inevitable that someone will drop the ball.

Here, we’ll look at how compliance laws apply to dealerships and how to increase transparency and oversight across your technology, operational logistics and employee practices.

Why GLBA Applies to Auto Dealerships

Auto dealerships may not be viewed by the public as a financial institution, but due to their financing options, they’re often classified as such by the Federal Trade Commission. While dealerships are not regulated to the same level as traditional banks, they’re still expected to protect and maintain all customer information covered under the Gramm-Leach-Bliley Act (GLBA).

Whether it’s a driver’s license copy or a pay stub, dealerships are expected to protect all data until proper disposal, as opposed to after the deal is closed.

When It’s Time for a Review

Dealerships should perform regular reviews, but certain events should trigger an immediate review, including:

• Acquiring a new dealership
• Changing technology systems or implementing new solutions
• Major leadership transitions
• Insurance renewals
• Financial reviews
• Dealership growth

Whether it’s a lender requesting security documentation or a new CTO asking about your malware defenses, it pays to have thorough, up-to-date answers when you need them most.

What Data Qualifies Under GLBA?

Dealerships are expected to protect:

• Financial data: Credit scores, debt history, credit card numbers, bankruptcy records, W-2 forms, pay stubs, bank account numbers
• Identification data: Social Security numbers, driver’s license copies, passports, previous addresses, references, etc.

If your data exists across systems, including DMS platforms, document management tools or email accounts, you’re expected to know not just where information is housed, but who has access to it.

Larger dealerships often thrive via acquired dealerships, vendors and departments, which all increase the odds of hidden risks. That means that even if your location has airtight protocols, you may still be vulnerable to legal violations or reputational loss.  

GLBA Requirements for Auto Dealerships

Compliance laws can get messy if you have to argue the specifics, but the general rules are fairly simple to understand. To properly protect data, dealership decision-makers are expected to plan ahead, monitor strategies and update as needed.

The standard checklist includes:

• List foreseeable risks and rank by priority.
• Write an information security program built around risks.
• Implement and maintain appropriate data protection safeguards.
• Provide training to all affected parties, including external vendors and all impacted departments.
• Regularly review and update policies based on current and emerging threats.

Vendor Oversight Remains a Dealership Responsibility

More people may access your data than you realize. Integrated workflows may make certain operations easier, but they can also make your data more vulnerable as it passes from system to system.

And even if your vendors have excellent written security policies, that doesn’t necessarily protect the dealership in the case of vendor error. If you work for an ever-expanding dealership, you need strict vendor oversight if you hope to maintain GLBA compliance.

Why Written Policies Are Only Part of Compliance

Having a written policy doesn’t guarantee anyone follows it, especially if employees never see it or never get trained on what it means. Add in the risks of staff turnover or shifting financing practices, and even a solid policy can quickly become outdated or forgotten. Building better practices means extending responsibility across every part of the organization and making sure everyone has both access to the policy and the training to back it up.

Often, dealerships see compliance gaps when they compare day-to-day practices to expectations. For example, a security policy may dictate that employees shred all driver’s license photocopies immediately even if it often takes them a few days. That’s why it’s so important to do the legwork before you determine whether your compliance policies are enough.

A GLBA review should answer:

• Which GLBA requirements apply to the dealership?
• Where is all protected information stored, how is it protected and who has access?
• Which safeguards are already in place, what are the gaps and which gaps create the most exposure?
• Who is accountable for maintaining a written security program?
• How are vendor relationships monitored?
• How and when are risk assessments performed?
• How are controls monitored across organizations and locations?

If your dealership hasn’t recently performed a risk assessment, updated its security protocols or reviewed its information handling procedures, it’s time for a refresh. Relying on institutional knowledge or plain assumptions simply isn’t enough to keep your dealership safe.

Learn More About Your Current Compliance and Future Risk Planning

Compliance reviews should reveal not just the obligations of each party, but how those obligations should change to keep pace with emerging risks.

To learn more about how data security laws apply to different aspects of your organization, contact your Warren Averett advisor directly, or ask a member of our team to reach out to you.