GRAMM LEACH BLILEY ACT

Which GLBA Rules
APPLY TO YOU

One statute, three rules and several regulators. The Safeguards Rule, the Privacy Rule and the pretexting provisions reach different businesses through the FTC, the SEC and the banking agencies. ITS works out which apply to you, then builds and runs the security program underneath.

Talk to a Compliance Expert ↗ Get My Free Assessment ↗

WHY IT GETS MISSED

Why GLBA Catches Firms Off Guard

Nobody sends you a GLBA notice. It arrives as a question from an insurer, a lender, a franchisor or an examiner, usually phrased as though you already knew. It sits inside our wider IT compliance services.

What we usually find when somebody finally asks:

GLBA obligations that were not identified during earlier compliance reviews
Privacy notices nobody has reviewed in years
Customer information in places nobody inventoried
No written security program to hand over on request

Customer information shared with nonaffiliated third parties without required privacy notices or opt-out procedures
Service providers handling customer information without required security terms or oversight
Two possible regulators, and a program written for neither

Talk to a Compliance Expert See Who the Rule Covers

Identify Your Regulator and Applicable Rules

Which rule text binds you depends on what kind of institution you are. We establish that first, because it decides everything after it.

A Program, Not a Folder

A written security program with a named owner and controls that are actually on, rather than a binder assembled the week somebody asks.

Customer Data You Can Locate

An inventory of where customer information lives, who can reach it and how long you keep it, because you cannot protect what nobody has mapped.

Two neighbors worth naming rather than blurring. If your business answers to the Federal Trade Commission, the security half of this statute is the Safeguards Rule, and it has a page of its own: FTC Safeguards compliance. If you are a broker dealer or an investment adviser, your examiner is different and so are the rule texts: see FINRA compliance.

Talk to a Compliance Expert

WHAT THE STATUTE CONTAINS

One Act, Multiple Requirements, and Your Regulator

GLBA is a statute from 1999, and most of what people call "GLBA compliance" is one of the rules made under it. Knowing which one you are being asked about is the whole job.

Rule names, citations and scope are taken from the Gramm Leach Bliley Act and the Federal Trade Commission's published business guidance at ftc.gov. This page is not legal advice on whether the Act applies to your business.

Who Counts as a Financial Institution

Who Counts as a Financial Institution GLBA reaches beyond traditional banks. Depending on the applicable rule, covered financial institutions can include businesses such as mortgage brokers, tax preparers, lenders, and companies involved in arranging or providing financial products and services.

See who the FTC covers

The Privacy Half

Written privacy notices, limits on what you may share with nonaffiliated third parties, and the customer's right to opt out of some of that sharing. Which rule text you follow depends on your regulator, because rulemaking for many institutions moved to the Consumer Financial Protection Bureau.

The Security Half

Section 501(b) of the Act is the reason a safeguards rule exists at all: it told the agencies to set standards for protecting customer information. At the Federal Trade Commission those standards are the Safeguards Rule, 16 CFR Part 314, and they have their own page.

FTC Safeguards compliance

The Pretexting Provisions

The Act also makes it unlawful to obtain customer information from a financial institution under false pretenses. In practice that is social engineering, which makes it a staff training and identity verification problem rather than a paperwork one.

Which Regulator Answers For You

Non-bank financial institutions answer to the Federal Trade Commission. Banks and credit unions answer to their federal banking regulator. Broker dealers and investment advisers answer to the SEC and FINRA. Insurance is regulated by the states. The obligation is similar; the rule text and the examiner are not.

FINRA compliance

HOW TO START

Three Steps to a Program You Can Show

These three steps help establish the foundation for an ongoing GLBA compliance program.

STEP 1

Establish Which Rules Reach You

Establish Which Rules Apply to You Review the financial activities your business performs, the customer information you handle, and the regulator with jurisdiction to determine which GLBA requirements apply.

Talk to a Compliance Expert

STEP 2

Find the Customer Data and the Gaps

Where customer information lives, who can reach it, how long you keep it and what is missing from the program you have. You get that in writing, yours to keep.

Get My Free Assessment

STEP 3

Run the Program and Keep the Proof

Controls go in and stay on, the written program stays current, vendors get reviewed, and the evidence exists before somebody asks to see it.

CLIENT RESULTS

What Clients Say About Working With Us

Hear from ITS clients about the security and operational improvements they've experienced. These testimonials are not specific to GLBA or financial institutions.

We always get a technician or an engineer that can solve the problem remotely and we have very little downtime. We’ve had a couple of times where we have had an employee that is prevented from working, and when we call in and we escalate quickly, we always have someone readily available to solve the problem.

Kathy Mickelson Office Manager, Tower Arch Capital

FAQ

What Finance Teams Ask Us First

1. What is GLBA, and does it apply to us?

The Gramm-Leach-Bliley Act is a federal law that establishes privacy and security requirements for financial institutions. The definition is broader than traditional banks and can include mortgage brokers, tax preparers, consumer lenders, and automobile dealers that finance or facilitate financing for consumers. Whether GLBA applies depends on the financial activities your organization performs and the regulator with jurisdiction.

2. Is GLBA the same thing as the FTC Safeguards Rule?

Not quite, and the difference is worth two minutes of your time. GLBA is the statute. The Safeguards Rule is one of the rules made under it: section 501(b) of the Act told the agencies to set standards for protecting customer information, and the Federal Trade Commission's version of those standards is the Safeguards Rule at 16 CFR Part 314. If you are a non-bank financial institution, that rule is the security half of your GLBA obligation.

3. Which parts of GLBA are about security, and which are about privacy?

Which parts of GLBA are about security, and which are about privacy? GLBA privacy requirements address how covered financial institutions provide privacy notices and, in certain circumstances, give consumers an opportunity to opt out of sharing nonpublic personal information with nonaffiliated third parties. Security requirements focus on protecting customer information through an appropriate written security program, safeguards, service provider oversight, and ongoing program maintenance.

4. Who enforces GLBA against a business like ours?

It depends on the type of financial institution and the regulator with jurisdiction. Many non-bank financial institutions fall under FTC oversight. Banks and credit unions are overseen by their applicable banking regulators. Broker-dealers are subject to SEC requirements and FINRA oversight where applicable, while investment advisers may be regulated by the SEC or state securities authorities. Insurance companies are generally regulated at the state level.

5. Is GLBA different from what FINRA asks of us?

They overlap and they are not interchangeable. GLBA and its rules are about customer information: notice, choice and protection. FINRA's rulebook is about being a member firm: records you can produce, supervision you can evidence, continuity you have tested. A broker dealer is usually dealing with both at once, through different examiners, which is why the answer to "are we compliant" depends on who is asking.

6. What does ITS actually do here, and what does it not do?

ITS does the technology half. We map where customer information lives, put the controls in and keep them on, help write and maintain the written security program, oversee the vendors who touch your data, and make sure evidence exists before somebody asks. What ITS is not is your lawyer, your privacy counsel or your examiner. We do not draft your privacy notice, we do not give a legal opinion on whether the Act applies to you, and no provider can certify you compliant with a statute.

Find Out Which Rules Reach Your Business

Review what your business does with customer information, identify which GLBA requirements may apply, and see what is missing from your current program. You'll leave with a documented view of your gaps and next steps.