GLBA Compliance for Data Teams
The Gramm-Leach-Bliley Act (GLBA) is the US federal law that governs how financial institutions protect and share consumers' nonpublic personal information. GLBA compliance for data teams is the practical side of that obligation: knowing where customer financial data lives, who can reach it, how long it is kept, and being able to prove all of it to an examiner or, after an incident, to a regulator.
Most GLBA guides are written for security teams and focus on penetration tests and policies. Those matter, but the current rules also ask questions only a data team can answer. The FTC Safeguards Rule requires an institution to identify and manage the data that supports its business, dispose of customer information within two years of last use unless there is a reason to keep it, and log what authorized users do with it. None of that works without an accurate picture of the data estate.
The GLBA (1999) has three parts: a Financial Privacy Rule (privacy notices and opt-out of sharing with nonaffiliated third parties), a Safeguards Rule (a written information security program), and pretexting provisions. It covers far more than banks: any business significantly engaged in financial activities, including lenders, mortgage brokers, and auto dealers. The protected data is nonpublic personal information (NPI). Since June 9, 2023, the FTC Safeguards Rule has required a data and systems inventory, encryption, multi-factor authentication, disposal within two years of last use, change management, and activity logging; since May 13, 2024, a breach affecting 500 or more consumers must be reported to the FTC within 30 days. For data teams, compliance comes down to finding NPI, restricting and logging access to it, and deleting it on schedule.
What Is the GLBA?
The Gramm-Leach-Bliley Act, also known as the Financial Services Modernization Act of 1999 (Public Law 106-102), is best known for allowing banks, securities firms, and insurers to combine. Its Title V is the part that matters for data: it states that each financial institution has "an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information."
GLBA privacy obligations are usually described as three parts:
- The Financial Privacy Rule. Institutions must give customers a privacy notice explaining what they collect and share, and must let consumers opt out before NPI is shared with nonaffiliated third parties, with limited exceptions. For most institutions it is implemented by the CFPB's Regulation P.
- The Safeguards Rule. Institutions must run a written information security program with administrative, technical, and physical safeguards for customer information. For non-bank financial institutions this is the FTC's rule at 16 CFR Part 314; banks follow equivalent interagency guidelines from their federal regulators, and SEC-registered firms follow Regulation S-P.
- The pretexting provisions. It is unlawful to obtain customer financial information under false pretenses, for example by impersonating a customer to a call center.
Who Must Comply With GLBA?
The law defines a financial institution as any institution whose business is engaging in financial activities. That is much wider than banks and credit unions. The FTC's Safeguards Rule covers non-bank financial institutions such as mortgage brokers, motor vehicle dealers, and payday lenders, along with many other lenders, servicers, and financial service providers that hold consumer financial data.
Who enforces the rules depends on the type of institution:
- Banks, savings associations, and credit unions follow the interagency information security guidelines of their federal regulator (Federal Reserve, OCC, FDIC, or NCUA).
- Broker-dealers, investment companies, registered investment advisers, and transfer agents follow the SEC's Regulation S-P.
- Most other financial institutions fall under the FTC Safeguards Rule, with the CFPB's Regulation P setting privacy notice requirements.
Size changes the details but not the obligation. Institutions that hold customer information about fewer than 5,000 consumers are exempt from a few Safeguards Rule requirements, including the written risk assessment, the incident response plan, and the annual report to the board, but still need a security program.
What Data Does GLBA Protect?
GLBA protects nonpublic personal information (NPI). Under the FTC rule, NPI means personally identifiable financial information, plus any list, description, or grouping of consumers derived from personally identifiable financial information that is not publicly available. In practice that includes account numbers and balances, payment and transaction histories, loan applications, credit information obtained from a customer or a credit report, and even the fact that someone is a customer of a particular institution.
The Safeguards Rule works with a related term, customer information: "any record containing nonpublic personal information about a customer of a financial institution, whether in paper, electronic, or other form." Two details make this a data team problem. First, the definition follows the data, so derived tables, extracts, analytics sandboxes, and files held by service providers all count. Second, NPI overlaps with but is not the same as PII: a customer list with no account data can be NPI because it reveals a financial relationship, while some PII, such as a public directory listing, falls outside it.
GLBA Safeguards Rule Requirements
The FTC rewrote the Safeguards Rule in 2021 to replace general principles with specific controls. Section 314.4 now requires an institution to:
- Designate a Qualified Individual to oversee and enforce the information security program.
- Base the program on a written risk assessment of foreseeable internal and external risks to customer information.
- Implement and review access controls that limit authorized users to the customer information they need for their duties.
- Identify and manage the data, personnel, devices, systems, and facilities that support the business, in line with their importance and the risk strategy.
- Encrypt customer information in transit over external networks and at rest, or use approved compensating controls.
- Use multi-factor authentication for anyone accessing any information system.
- Dispose of customer information no later than two years after it was last used to serve the customer, unless it is needed for business operations, a legitimate business purpose, or the law, and periodically review the data retention policy.
- Adopt change management procedures.
- Monitor and log the activity of authorized users and detect unauthorized access, use, or tampering.
- Test the safeguards through continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months.
- Train staff, oversee service providers by contract and periodic assessment, and keep a written incident response plan.
- Report in writing to the board, regularly and at least annually.
Recent GLBA Changes
The statute has not changed, but its rules have changed several times since 2021, and many published checklists still describe the old versions:
- June 9, 2023: the amended FTC Safeguards Rule takes full effect. The FTC published the rewrite on December 9, 2021, then delayed its most demanding provisions, including the Qualified Individual, encryption, multi-factor authentication, and the written risk assessment, from December 9, 2022 to June 9, 2023.
- May 13, 2024: breach reporting to the FTC. Non-bank financial institutions must notify the FTC of a "notification event," the unauthorized acquisition of unencrypted customer information, that involves at least 500 consumers, as soon as possible and no later than 30 days after discovery. Information counts as unencrypted if the encryption key was also accessed.
- December 3, 2025 and June 3, 2026: amended Regulation S-P. The SEC's 2024 amendments require broker-dealers, investment companies, registered investment advisers, and transfer agents to keep a written incident response program, oversee service providers, and notify affected individuals no later than 30 days after becoming aware that sensitive customer information was, or was reasonably likely to have been, accessed or used without authorization. Larger entities had to comply 18 months after Federal Register publication and smaller entities 24 months after.
One older change is often missed too. Annual privacy notices are not required in every case: an institution that limits its sharing to the ways that do not trigger an opt-out right and has not changed its policies can skip them.
GLBA vs CCPA
Financial institutions that serve Californians often ask whether the CCPA applies to them at all. The answer is that the CCPA exemption covers data, not companies. The CCPA "shall not apply to personal information collected, processed, sold, or disclosed subject to" the GLBA and its implementing regulations, but that exemption does not apply to the CCPA's private right of action for data breaches. Personal information an institution holds outside GLBA, such as marketing data on prospects, website analytics, or employee data, can still fall under the CCPA.
| Topic | GLBA | CCPA |
|---|---|---|
| Type of law | Federal, sector-specific (financial institutions) | California state law, cross-sector |
| Protected data | Nonpublic personal information about consumers and customers | Personal information about California residents and households |
| Core privacy mechanism | Privacy notice and opt-out of sharing NPI with nonaffiliated third parties | Rights to know, delete, correct, opt out of sale or sharing, and limit sensitive data use |
| Security obligation | Detailed program under the Safeguards Rule or interagency guidelines | Duty to maintain reasonable security, backed by a breach private right of action |
| Deletion | Disposal within two years of last use, unless there is a reason to keep the data | Consumer right to request deletion, with exceptions |
| Overlap | Data collected subject to GLBA is exempt from most of the CCPA, but not from the breach private right of action; other personal data the institution holds is not exempt | |
For a data team, the practical consequence is that the same estate holds data under two regimes. Knowing which tables contain GLBA-covered NPI and which hold other personal information is the only way to apply the right rules to each.
The Data Team's Job
Read the Safeguards Rule as a data team and it reduces to five capabilities. Each maps to a requirement, and each fails for the same reason: data that nobody knows about.
- Know where NPI lives. The rule asks you to identify and manage the data that supports the business. That means an inventory of every system, table, file, and extract that holds customer information, including copies in analytics environments and at service providers. A data catalog is the natural home for it.
- Know which data is NPI. Classification that marks NPI at the column and asset level, distinct from other personal data, so access, encryption, and retention rules attach to the right assets and the GLBA and CCPA scopes can be told apart.
- Know where it flows. Data lineage shows every downstream copy and every outbound feed, which is what the two-year disposal rule and service provider oversight both depend on. A deletion that misses a derived table is not a disposal.
- Control and evidence access. Least-privilege access management backed by named data owners who approve who sees what, plus logs that show it.
- Retire data on schedule. A retention rule only works if each asset holding customer information has an owner, a documented purpose, and a last-used date someone can check.
The recurring failure is the forgotten copy: an extract shared with a vendor years ago, a sandbox table built for one analysis, a backup no one cataloged. Under the 2023 rules, each of those is customer information that must be inventoried, protected, logged, and eventually disposed of.
How Dawiso Approaches It
Dawiso does not replace a security program, an encryption platform, or a privacy notice process. It covers the data governance layer those controls depend on. The data catalog gives the institution one inventory of the systems and data assets that hold customer information, with named owners and stewards. The business glossary defines what counts as NPI and customer information in the institution's own terms, so classification is applied consistently across teams. Interactive lineage traces where customer data flows, from source systems through transformations to reports and outbound feeds, so disposal and service provider reviews start from evidence rather than interviews. When an examiner asks where customer information is held and who is responsible for it, the answer already exists. The same foundation supports CCPA and SOX work, because each of them starts with knowing what data you have.
Conclusion
GLBA has protected financial privacy since 1999, but the rules that implement it have become far more specific in the last few years. The FTC Safeguards Rule now names the controls, the FTC expects breach reports within 30 days, and the SEC has extended similar obligations to investment firms. Behind almost every requirement sits the same data question: where is our customers' nonpublic personal information, who can reach it, and when will we delete it? Institutions that can answer it from a governed inventory meet the rules as part of normal work. Those that cannot will find that no policy document substitutes for knowing where the data is.
Sources
- US Government Publishing Office - Gramm-Leach-Bliley Act, Public Law 106-102 (1999)
- Legal Information Institute - 15 U.S.C. 6801, Protection of nonpublic personal information and 15 U.S.C. 6809, Definitions
- Legal Information Institute - 16 CFR 314.4, Elements of the FTC Safeguards Rule, 314.2, Definitions, and 314.6, Exceptions
- Federal Register - Standards for Safeguarding Customer Information, final rule (December 9, 2021) and delay of effective date to June 9, 2023 (November 23, 2022)
- Federal Register - Standards for Safeguarding Customer Information, breach notification amendment (effective May 13, 2024)
- Federal Trade Commission - FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches (October 27, 2023)
- US Securities and Exchange Commission - SEC Adopts Amendments to Regulation S-P to Enhance Protection of Customer Information (May 16, 2024)
- Legal Information Institute - 12 CFR Part 1016, Privacy of Consumer Financial Information (Regulation P)
- California Privacy Protection Agency - California Consumer Privacy Act, Cal. Civ. Code 1798.145(e) (GLBA exemption)
See it in action
Data & Analytics Catalog
Create a unified view of your data assets and gain insights faster with automated data discovery.