Who is the 'qualified individual' under the FTC Safeguards Rule?

It is a named role, not a committee

The requirement is a designated individual. Where an outside provider supplies the function, the dealership still needs a named person responsible for direction and oversight of that provider.

Reporting obligation

The role includes reporting to the governing body on the program's status, risks and incidents. Build that reporting into an existing management cadence rather than treating it as an annual document.

Vendor oversight sits here

Selecting service providers capable of safeguarding information, requiring safeguards contractually and monitoring them belongs to this role, which is why the person should see software purchases before they are signed.

Document the decisions

Risk assessments, testing results and remediation decisions are the evidence that a program exists in practice. Keep them where they can be produced.

Choosing the person

The person should understand the store's systems and data, have the time and authority to direct changes and be able to report to management. Some stores assign an experienced employee; others use an outside provider with an internal contact.

Consider the size of the store and the complexity of its systems when deciding. Record the decision and the person's responsibilities in writing.

What the role does through the year

Typical activities include maintaining the risk assessment, reviewing access and vendor security, arranging testing and training, checking that safeguards operate, handling incidents and preparing periodic reports to management. A simple annual calendar keeps these tasks on schedule. Keep evidence of each task and any follow-up action.

Common mistakes with the role

Naming someone without giving them time, leaving the role vacant after a departure, relying on a vendor without oversight and failing to report to leadership are typical gaps. Another is not updating the program when systems change. Ask qualified advisers to review the arrangements, since the details depend on your circumstances.

Questions to ask before appointing

Does this person have the time, the authority and the skills? Who will support them?

How will they report to management? Who covers when they are away?

If an outside provider is used, what will it do and what remains with us? Written role descriptions and a review with advisers help confirm the arrangement.