[Billing Code: 6750-01S] 

FEDERAL TRADE COMMISSION 

16 CFR Part 314 

RIN 3084-AB35 

Standards for Safeguarding Customer Information 

AGENCY: Federal Trade Commission. 

ACTION: Final rule; delay of effective date. 

SUMMARY: The Federal Trade Commission is delaying the effective date set forth in 

16 CFR 314.5 of portions of the amended Safeguards Rule, 16 CFR Part 314, as 

published on December 9, 2021, 86 FR 70272. 

DATES: The effective date for portions of the final rule published December 9, 2021, at 

86 FR 70272, 70307, is delayed from December 9, 2022, until June 9, 2023. 

FOR FURTHER INFORMATION CONTACT: 

David Lincicum, Division of Privacy and Identity Protection, Bureau of Consumer 

Protection, Federal Trade Commission, 600 Pennsylvania Avenue N.W., Washington, 

D.C. 20580, (202) 326-2773. 

SUPPLEMENTARY INFORMATION: 

I. Final Rule and Delay of Effective Date 

On December 9, 2021, the Federal Trade Commission (Commission) amended the 

Safeguards Rule, 16 CFR Part 314. While portions of the amended Rule became effective 

on January 10, 2022, certain provisions were originally to become effective December 9, 

2022. 16 CFR 314.5. 

1 
 

 

 

 

 

 

 

 

 

 

 

 

 

 

The Commission is aware that there is a reported shortage of qualified personnel 

to implement information security programs and that supply chain issues may lead to 

delays in obtaining necessary equipment for upgrading security systems. 1 In addition, 

these difficulties were exacerbated by the COVID-19 pandemic that has been active as 

financial institutions have attempted to come into compliance with the amended 

Safeguards Rule. These issues may make it difficult for financial institutions, especially 

small ones, to come into compliance with the amended Safeguards Rule by December 9, 

2022. Accordingly, the Commission is delaying the effective date of those portions of the 

Safeguards Rule that were to go into effect on December 9, 2022, until June 9, 2023. 2 

II. Administrative Procedure Act 

The Commission is issuing the final rule without prior notice and the opportunity 

for public comment and, as explained below, without the delayed effective date ordinarily 

prescribed by the Administrative Procedure Act (APA).

3

 Pursuant to section 553(b)(3)(B) 

of the APA, general notice and the opportunity for public comment are not required with 

respect to a rulemaking when an “agency for good cause finds (and incorporates the 

1 See, e.g., James Legg, “Confronting the shortage of security professionals,” Forbes.com (Oct. 21, 2021), 

https://www forbes.com/sites/forbesbusinesscouncil/2021/10/21/confronting-the-shortage-of-cybersecurityprofessionals/; Cyber Seek, Cybersecurity Supply/Demand, https://www.cyberseek.org/heatmap.html; 

Robert Triggs, “The global computer chip shortage explained,” Androidauthority.com (June 5, 2022), 

https://www.androidauthority.com/computer-chip-shortage-1212941/. 2 The Safeguards Rule’s ongoing rulemaking was included in the Commission’s Spring 2022 Regulatory 

Agenda, but that Agenda did not contemplate this final rule extending the effective date of parts of the final 

rule issued on December 9, 2021. See Fed. Trade Comm’n, Standards for Safeguarding Consumer 

Information, https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202204&RIN=3084-AB35. 

Pursuant to Section 22(d)(4) of the FTC Act, 15 U.S.C. 57-b3(d)(4), this Rule was not included in the 

Commission’s Spring 2022 Regulatory Agenda because the Commission first considered this final rule and 

the reasons supporting it after its approval of the Agenda. 3 5 U.S.C. 553. 

2 
 

 

 

 

 

 

 

 

 

 

 

 

finding and a brief statement of reasons therefor in the rules issued) that notice and public 

procedure thereon are impracticable, unnecessary, or contrary to the public interest.” 4 

The Commission believes that the public interest is best served by revising 16 

CFR 314.5 to delay the effective date of certain portions of the Safeguards Rule and by 

making such revision effective immediately upon publication in the Federal Register. As 

noted above, the COVID-19 pandemic has disrupted economic activity in the United 

States. This has exacerbated a reported shortage of qualified information security 

personnel and supply chain issues that can lead to delays involving equipment necessary 

to upgrade information security systems. Delaying the effective date of these portions of 

the amended Safeguards Rule will allow financial institutions additional time to 

effectively and efficiently bring their information security programs into compliance with 

the Rule. 5 For these reasons, the Commission finds that there is good cause consistent 

with the public interest to issue the rule without advance notice and comment. 6 

The APA also requires a 30-day delayed effective date, except for “(1) 

substantive rules which grant or recognize an exemption or relieve a restriction; (2) 

interpretative rules and statements of policy; or (3) as otherwise provided by the agency 

for good cause.” 7

 As noted above, the Commission finds that there is good cause to 

revise the effective date of the portions of the Safeguards Rule that were previously 

designated to go into effect on December 9, 2022, immediately. 8 The Commission 

recognizes that, while this rule revision goes into effect immediately, the result of the 

4 Id. 553(b)(3)(B). 5 The revised deadline should also go into effect as soon as possible because the original deadline in 

December 2022 is imminent. 6 See 5 U.S.C. 553(b)(3)(B). 7 Id. 553(d). 8 See id. 553(d)(3). 

3 
 

 

 

 

 

 

 

 

 

 

revision is to give regulated parties additional time to come into compliance, so they 

would not be prejudiced if the change goes into effect immediately. Furthermore, the 

delay of an effective date of a substantive rule requirement is a “substantive rule[]” that 

“relieve[s] a restriction” for a period of time, which makes it eligible to take effect 

without the ordinary wait of 30 days. 9 

III. Paperwork Reduction Act 

In accordance with the requirements of the Paperwork Reduction Act (PRA), an 

agency may not conduct or sponsor, and a respondent is not required to respond to, an 

information collection unless it displays a currently valid Office of Management and 

Budget (OMB) control number. The Commission has reviewed this final rule pursuant to 

authority delegated by the OMB and has determined that it does not contain any 

collections of information pursuant to the PRA. 

IV. Regulatory Flexibility Act and Congressional Review Act 

The Regulatory Flexibility Act (RFA) 10 requires an agency to consider whether 

the rules it proposes will have a significant economic impact on a substantial number of 

small entities. The RFA applies only to rules for which an agency publishes a general 

notice of proposed rulemaking pursuant to 5 U.S.C. 553(b). As discussed previously, 

consistent with section 553(b)(3)(B) of the APA, the Commission has determined for 

good cause that general notice and opportunity for public comment is unnecessary, and 

therefore the Commission is not issuing a notice of proposed rulemaking. Accordingly, 

the Commission has concluded that the RFA’s requirements relating to initial and final 

regulatory flexibility analyses do not apply. In any event, the extension of the effective 

9 Id. 553(d)(1). 10 5 U.S.C. 601–612. 

4 
 

 

 

 

 

 

 

 

 

date will reduce the burden of complying with the Rule for all covered financial 

institutions, including small businesses. 

Pursuant to the Congressional Review Act (5 U.S.C. 801 through 808), the Office 

of Information and Regulatory Affairs designated this rule as not a “major rule,” as 

defined by 5 U.S.C. 804(2). 

List of Subjects in 16 CFR Part 314 

Consumer protection, Credit, Data protection, Privacy, Trade practices. 

For the reasons stated above, the Federal Trade Commission amends 16 CFR Part 

314 as follows: 

PART 314—STANDARDS FOR SAFEGUARDING CUSTOMER 

INFORMATION 

1. The authority citation for Part 314 continues to read as follows: 

Authority: 15 U.S.C. 6801(b), 6805(b)(2). 

2. Revise § 314.5 to read as follows: 

§ 314.5 Effective date. 

Sections 314.4(a), 314.4(b)(1), 314.4(c)(1)–(8), 314.4(d)(2), 314.4(e), 314.4(f)(3), 

314.4(h), and 314.4(i) are effective as of June 9, 2023. 

By direction of the Commission. 

April J. Tabor, 

Secretary. 

5