GLBA Privacy and Safeguards Rules: Compliance Guide

If you are significantly engaged in financial activities as defined by the Bank Holding Company Act's implementing rules: lending, loan brokering or servicing, financial advisory, debt collection, check cashing, tax preparation, wiring money, and financing product sales all qualify. Car dealerships arranging financing, universities administering Perkins or Direct Loans, and buy-now-pay-later fintechs are covered. Merely accepting credit cards is not. The test is the activity, not the industry label.

A clear initial privacy notice at the customer relationship's start, annual notices thereafter (streamlined if practices haven't changed and no opt-out applies), accurate description of sharing practices, and a reasonable opt-out mechanism before NPI goes to nonaffiliated third parties outside the exceptions. The model form provides a safe harbor. The recurring failure mode is notices that no longer match actual data flows, particularly after adding analytics, ad-tech, or data-monetization arrangements.

Nine program elements including: a designated qualified individual reporting periodically (at least annually) to the board; written risk assessments; specific controls, access management with reviews, encryption of customer information at rest and in transit (or documented CISO-approved alternatives), MFA for any system with customer information, secure development, logging, and change management; continuous monitoring or annual pen tests plus semiannual vulnerability scans; workforce training; service-provider oversight; and a written incident response plan. Institutions under 5,000 consumers get partial relief.

Effective May 13, 2024: FTC-regulated financial institutions must notify the FTC, via its online portal, within 30 days of discovering a 'notification event,' unauthorized acquisition of unencrypted customer information involving at least 500 consumers. The reports are public. This runs alongside (not instead of) all 50 states' consumer breach-notification laws and any obligations to banking regulators, so incident-response plans need a consolidated notification matrix.

Most comprehensive state laws exempt GLBA-regulated data (data-level) and many exempt GLBA institutions entirely (entity-level), but the map is uneven: California exempts only the data, Oregon only the data, while Virginia and Texas exempt the institution. Marketing data, website analytics, and non-customer prospect data typically fall outside GLBA's NPI definition and thus outside the exemption, landing back in CCPA-style regimes. NYDFS Part 500 adds a stricter state security overlay for New York licensees.