A deadline begins with a determination
The Federal Trade Commission's Safeguards Rule applies to covered non-banking financial institutions, a category that can include businesses beyond traditional lenders. The Rule requires covered institutions to maintain safeguards for customer information and, in certain circumstances, report a notification event to the FTC.
FTC guidance states that a notification event involves unauthorized acquisition of at least 500 consumers' unencrypted customer information. For this purpose, encrypted information is treated as unencrypted when an unauthorized person accessed the encryption key. Unauthorized access is presumed to involve acquisition unless reliable evidence shows that acquisition did not or could not reasonably have occurred. Covered institutions must notify the FTC as soon as possible and no later than 30 days after discovery.
This is a management guide, not legal advice. A Central Florida business should confirm coverage and reporting duties with qualified counsel.
Record the discovery point
Create a decision record as soon as a potentially relevant event is identified. Record the date and time, how the event was detected, the systems and information believed involved, the person leading the investigation, and who has authority to obtain legal and forensic support.
Do not wait for perfect information before opening the record. The purpose is to preserve a reliable chronology and show how facts changed. Distinguish confirmed facts from assumptions and unanswered questions.
Determine whether customer information is involved
Identify the data elements at issue, the systems that held them, the population potentially affected, and whether the information meets the Rule's definition of customer information. Document where the information came from, how it was protected, and whether keys or credentials protecting it may also have been exposed.
A professional office may have information spread across email, document management, line-of-business software, cloud storage, backups, and vendors. The assessment should cover connected systems and service providers rather than only the first affected device.
Evaluate unauthorized access and acquisition
FTC guidance explains that unauthorized access to unencrypted customer information is presumed to be unauthorized acquisition unless reliable evidence supports the opposite conclusion. Preserve the evidence used to make that determination: logs, forensic findings, access records, data-transfer evidence, malware behavior, and documented limitations in available telemetry.
The decision record should identify who made the determination, when it was made, what evidence was reviewed, and what uncertainty remains. Avoid absolute claims that the evidence cannot support.
Count affected or potentially affected consumers
The notification threshold is at least 500 consumers. Establish a repeatable counting method and record whether the number represents confirmed or potentially affected people. Preserve query logic, date ranges, deduplication rules, and exclusions so the count can be reproduced.
If the count changes, keep the earlier figure and explain the revision. A defensible chronology is more valuable than silently replacing preliminary numbers.
Prepare the required information
The FTC's reporting form requests high-level information including the institution's name, dates of the event, number of consumers affected or potentially affected, types of information involved, and a summary of what happened. FTC guidance notes that reports may become public. Coordinate the submission with counsel and avoid including sensitive personal information or security details that are not requested.
If law enforcement requests a delay in public disclosure, the form provides a way to indicate that request. Preserve the request and the responsible agency contact in the incident record.
Do not confuse one rule with every obligation
FTC guidance emphasizes that Safeguards Rule compliance does not replace duties under other federal or state laws. Florida breach-notification requirements, contractual commitments, sector-specific rules, insurer notice, and obligations to customers or partners may follow different definitions and deadlines. Build a matrix listing each potentially applicable requirement, its owner, trigger, deadline, and decision status.
Turn the decision record into evidence of governance
After the event, retain the chronology, evidence index, legal determinations, submission receipt, remediation decisions, and lessons learned according to the organization's retention policy. Feed the findings into the written information security program, risk assessment, service-provider oversight, and incident-response plan.
A good reporting process does more than meet a deadline. It helps leadership make an accountable decision based on preserved facts while technical teams contain the incident and protect customers.
Human-reviewed draft; obtain legal advice regarding coverage, privilege, reporting, consumer notice, and Florida or sector-specific obligations.