In November 2023, the Federal Trade Commission amended the Safeguards Rule to require nonbanking financial institutions — such as dealerships — to notify them no later than 30 days after discovery of any security breach that involves the unencrypted information of at least 500 consumers. As of May 13, that revised rule is now in effect.