GLBA (Gramm-Leach-Bliley Act)

· About GLBA (Gramm-Leach-Bliley Act)

Key Takeaways

  • GLBA applies to “financial institutions” that collect, process, or share consumers’ nonpublic personal information, and it requires privacy notices plus security safeguards for customer data.[1][2]
  • The statute is enforced by the FTC, the CFPB, the federal banking agencies, the SEC, the CFTC, and state insurance authorities, depending on the institution’s charter and product line.[2][5]
  • The Privacy Rule requires covered institutions to tell customers what information they collect and share, with whom they share it, and when consumers may opt out of nonaffiliated third-party sharing.[1][10]
  • The Safeguards Rule requires a written information security program, a designated qualified individual, risk assessments, access controls, encryption, monitoring, and periodic testing.[11][13]
  • The FTC’s breach-reporting amendment requires notification to the FTC within 30 days after discovering a qualifying notification event involving unencrypted customer information affecting 500 or more consumers.[11][3]
  • GLBA does not currently include a single new 2025–2026 federal overhaul of Title V in force; CFPB and congressional activity in 2025–2026 was exploratory or proposed, not yet enacted as of 6 September 2026.[3][4][12]

What It Is

The Gramm-Leach-Bliley Act, enacted in 1999, is the federal privacy-and-security framework for financial institutions handling nonpublic personal information. Its Title V, subtitle A, requires disclosures about information-sharing practices and mandates safeguards to protect customer information.[2][5]

GLBA’s core implementing rules are split across regulators: the FTC’s Privacy Rule and Safeguards Rule for institutions under FTC jurisdiction, CFPB Regulation P for many institutions subject to CFPB jurisdiction, and parallel regimes administered by the SEC, CFTC, federal banking agencies, and state insurance authorities.[2][8][14]

For the statutory framework itself, the enactment date is 12 November 1999. The current Safeguards Rule modernization culminated in the FTC’s 2021 final rule and the later breach-reporting amendment effective in 2024; the FTC’s GLBA guidance page remains current as of 5 September 2026, and no enacted 2025–2026 federal amendment replacing Title V appears in the sources reviewed.[1][11][3]

Who Must Comply

GLBA generally applies to financial institutions, meaning entities significantly engaged in financial activities, including many lenders, broker-dealers, investment advisers, insurers, payment businesses, and other firms depending on regulator and activity.[2][8]

The Privacy Rule’s consumer-notice and opt-out regime applies when a covered institution discloses nonpublic personal information to nonaffiliated third parties outside an exception.[1][10]

The Safeguards Rule applies to financial institutions under FTC jurisdiction and requires a formal information security program for customer information.[11][13]

GLBA has broad extraterritorial practical reach when a covered institution offers financial products or services to U.S. consumers or handles consumer data subject to the U.S. regime, but the precise jurisdictional hook depends on the controlling regulator and charter.[2][8]

Common exemptions and carve-outs include disclosures permitted by statutory exceptions, such as service providers, joint marketing, legal process, fraud prevention, and certain consumer-requested transactions; the precise scope is rule-specific and regulator-specific.[1][10]

Core Requirements

  1. Privacy notice: Provide clear notices describing what personal information is collected, how it is used, and with whom it is shared, including affiliated and nonaffiliated third-party disclosures where required.[1][10]
  1. Opt-out rights: Give consumers the right to opt out of certain disclosures of nonpublic personal information to nonaffiliated third parties when no exception applies.[1][10]
  1. Written security program: Maintain a written information security program appropriate to the institution’s size, complexity, and the nature and scope of its activities.[11][13]
  1. Risk assessment: Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and reassess as operations change.[11][13]
  1. Administrative, technical, and physical safeguards: Implement controls such as access restrictions, encryption, secure development, authentication, vendor oversight, monitoring, and incident response.[11][13]
  1. Qualified individual and governance: Designate a qualified individual to oversee the program and report regularly to the governing body, with board oversight where required.[11][13]
  1. Testing and monitoring: Regularly test or monitor key controls, including vulnerability management, logging, and effectiveness of safeguards.[11][13]
  1. Breach reporting: Notify the FTC within 30 days after discovering a notification event involving unencrypted customer information affecting 500 or more consumers, where the rule applies.[11][3]

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | GLBA enacted | 12 November 1999 | Title V privacy and safeguard framework becomes law.[2] | | FTC Safeguards Rule modernization finalized | 9 December 2021 | Expanded security-program requirements for FTC-covered financial institutions.[11] | | FTC breach-reporting amendment effective | 13 May 2024 | 30-day FTC notice for qualifying notification events affecting 500+ consumers.[11][3] | | CFPB privacy-rule review period | January–April 2025 | CFPB requested public input on possible modernization; no final 2025 rule change is shown in the sources reviewed.[3] | | Current status checkpoint | 6 September 2026 | No enacted 2025–2026 federal GLBA replacement is evident in the sources reviewed.[1][3][12] |

Maximum penalties vary by enforcement authority and violation type. The statute authorizes enforcement by the FTC and other regulators using their ordinary civil-penalty and injunctive powers, which means exposure depends on the regulator, the count of violations, and whether conduct is treated as unfair or deceptive.[2][5]

For FTC jurisdiction, penalties can include cease-and-desist orders, injunctive relief, civil penalties for rule violations, and mandated corrective action; banking regulators and the CFPB can also impose supervisory and enforcement remedies against covered institutions in their portfolios.[2][5][8]

How to Comply

  1. Map your regulatory lane. Determine whether the institution is governed by the FTC, CFPB, SEC, CFTC, a federal banking agency, or a state insurance authority, because the implementing rule and examiner expectations differ.[2][8][14]
  1. Classify data and products. Identify what qualifies as nonpublic personal information, customer information, and excluded information, then map where notices, opt-outs, and safeguards are triggered.[1][10][11]
  1. Build or refresh the information security program. Use ISO 27001 for control structure, NIST CSF 2.0 for risk framing and continuous improvement, and ISO 42001 only where AI systems process customer data or support security operations.[11][13]
  1. Perform a documented risk assessment. Cover threats, likelihood, impact, third parties, authentication, encryption, endpoint security, backups, logging, and incident response, then tie each risk to a control owner and due date.[11][13]
  1. Rewrite privacy notices and consumer workflows. Ensure notices accurately describe data collection, sharing, opt-out mechanisms, and any applicable exceptions, and verify that operational systems honor those disclosures.[1][10]
  1. Harden third-party governance. Contractually require service providers to maintain safeguards, support audits, notify the institution of incidents, and limit use of customer data to authorized purposes.[11][13]
  1. Test, monitor, and train. Run periodic vulnerability scans, penetration tests where appropriate, access reviews, phishing exercises, and board or management reporting so the program remains demonstrably effective.[11][13]
  1. Prepare breach reporting and response. Set an internal decision tree to determine whether a notification event occurred, whether the 500-consumer threshold is met, and whether the FTC’s 30-day clock applies.[11][3]

Related Regulations

Regulation P implements GLBA privacy requirements for many CFPB-supervised institutions and can overlap with the FTC’s Privacy Rule in mixed financial groups.[2][14]

SEC Regulation S-P overlaps for broker-dealers, investment advisers, and investment companies, creating parallel privacy and safeguard obligations for securities firms.[8][14]

FTC Safeguards Rule is the key security rule for many non-bank financial institutions and is the most operationally detailed GLBA safeguard regime.[11][13]

COPPA can overlap where a financial app or platform knowingly collects children’s data; its consent and retention rules may add obligations beyond GLBA.[6]

State privacy and breach-notification laws may apply alongside GLBA, especially where a state law is not preempted or where a breach notice is required on a different timetable.[4][12]

Does GLBA apply to companies outside the United States?

Yes, if the company falls within U.S. jurisdiction as a financial institution serving U.S. consumers or operating under a U.S. regulator’s jurisdiction.[2][8] The precise extraterritorial analysis depends on the activity, charter, and regulator, not simply the company’s place of incorporation.[2][8]

Does GLBA require an opt-out for all sharing?

No. The opt-out rule is limited to certain disclosures of nonpublic personal information to nonaffiliated third parties, and many statutory exceptions permit sharing without opt-out.[1][10] Service-provider, joint-marketing, legal, and consumer-requested exceptions are the most common.[1][10]

Does GLBA require encryption?

The Safeguards Rule requires encryption or an approved equivalent for customer information in transit over external networks and often at rest, unless the institution’s written risk assessment justifies a compensating control.[11][13] Encryption is therefore a core expectation for most covered firms, not a mere best practice.[11][13]

Does GLBA have a 2026 amendment I must implement now?

No enacted 2026 federal overhaul of GLBA Title V appears in the reviewed sources. CFPB review activity and congressional discussion in 2025–2026 indicate possible future change, but those efforts were not final law as of 6 September 2026.[3][4][12]

What is the biggest penalty risk under GLBA?

The biggest practical risk is usually a combined enforcement action: privacy failures, inadequate safeguards, and delayed incident response can trigger supervisory findings, injunctions, remediation orders, and civil penalties.[2][5][11] For FTC-covered firms, the new breach-reporting obligation also creates a specific, measurable compliance deadline that can be enforced separately.[11][3]

Sources

Put it into practice

More compliance guides