What minimum level of encryption is required for electronic data transmission containing confidential, credit card, and/or PII data that traverses any network and is processed by Budget's business systems?

According to Budget's 2025 Franchise Disclosure Document, a minimum of 128-bit encryption must be used for electronic data transmission containing confidential information, credit card data, and Personally Identifiable Information (PII). This encryption requirement applies to data that travels across any network and is processed by the franchisee's business systems that have access to Budget's System. For data stored, such as in email or on local media, industry-standard encryption tools are required.

This requirement ensures that sensitive data is protected during transmission, reducing the risk of unauthorized access or interception. Franchisees must implement and maintain these encryption standards to comply with Budget's security policies and procedures. Failing to meet these requirements could result in a breach of contract and potential penalties.

In addition to encryption, Budget also mandates other security controls, including hardware firewall protection, anti-malware protection, personal firewall protection, and intrusion detection systems. These controls collectively aim to safeguard the Budget system and customer data from various cyber threats. Franchisees should ensure they understand and adhere to all these security requirements to maintain the integrity of the Budget brand and protect sensitive information.