GLBA

Framework Name

‍Gramm-Leach-Bliley Act (GLBA)

Type

‍Mandatory

Region / Jurisdiction

‍United States

Enforcing Body / Certifying Party

‍Multiple regulators depending on the type of institution: the Federal Trade Commission (through its Safeguards Rule and Privacy Rule) for most non-bank financial institutions, federal banking regulators for banks and credit unions, state insurance regulators for insurers, and the Department of Education for colleges handling federal financial aid

Penalty / Consequence of Non-Compliance

‍Civil penalties enforced through consent orders, often requiring years of mandated security audits and program overhauls, plus separate criminal penalties, including fines and imprisonment, for the law's "pretexting" provisions, which make it illegal to obtain someone's financial information under false pretenses

What It Is & Why It Matters

GLBA is a US federal law requiring financial institutions to protect customers' nonpublic personal financial information. It has two main pillars: a Privacy Rule that requires notifying customers how their data is shared and giving them a way to opt out of certain sharing, and a Safeguards Rule that requires a written information security program covering how that data is actually protected. "Financial institution" is defined broadly here, well beyond banks, it also covers auto dealers who arrange financing, mortgage brokers, tax preparers, payday lenders, and colleges handling federal student aid.

It matters because the Safeguards Rule was significantly strengthened in 2021, adding specific, mandatory technical requirements, encryption, multi-factor authentication, written risk assessments, that many of these "non-traditional" financial institutions never had to meet before. The FTC has moved from an education-first posture to active enforcement in recent years, bringing real cases against auto dealer groups and others who hadn't caught up. Many companies are surprised to learn GLBA applies to them at all, simply because they don't think of themselves as a "financial institution" in the traditional sense.

Who Needs It

• You are a bank, credit union, insurance company, or securities firm handling customer financial data
• You are a "non-traditional" financial institution, an auto dealer offering financing, a mortgage broker, a tax preparer, or a payday lender
• You are a college or university participating in federal student financial aid programs
• You provide software or services to any of the above and handle their customers' nonpublic financial information on their behalf