The Gramm-Leach-Bliley Act (GLBA): Compliance Guide for Financial Institutions

While the GLBA fostered competition and innovation, it also introduced a robust framework for consumer privacy and data security. For compliance professionals, understanding GLBA’s structure, requirements, and enforcement mechanisms is essential to safeguarding both institutional integrity and consumer trust.

The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, transformed the U.S. financial landscape by repealing key provisions of the Glass-Steagall Act and enabling affiliations among banks, securities firms, and insurance companies. While the Act fostered competition and innovation, it also introduced a robust framework for consumer privacy and data security. For compliance professionals, understanding GLBA’s structure, requirements, and enforcement mechanisms is essential to safeguarding both institutional integrity and consumer trust.

NETBankAudit experts have over 25 years of experience in GLBA audits and compliance. If you have any questions after reading this guide, please reach out to our team.

GLBA’s Legislative Background and Structure

Enacted on November 12, 1999, the GLBA marked a pivotal shift in financial regulation. By repealing the Glass-Steagall Act’s restrictions, it allowed financial institutions to consolidate and offer a broader range of services. The Act is organized into several key titles, each addressing a different aspect of financial modernization and consumer protection.

‍

Title	Main Focus
Title I	Facilitating affiliations among banks, securities firms, and insurance companies; introduction of financial holding companies
Title II	Functional regulation and clarification of regulatory authority among agencies
Title V	Privacy and data security requirements for consumer information

‍

This structure not only modernized the industry but also established a foundation for the privacy and security obligations that are central to today’s compliance environment.

Expanded Definitions and Scope of GLBA

GLBA defines “financial institution” broadly, encompassing a wide array of entities that provide financial products or services to consumers. This includes not only traditional banks and credit unions, but also insurance companies, securities firms, investment advisers, and even consumer reporting agencies. The Act’s reach is intentionally expansive to ensure that privacy and security standards apply across the financial sector.

Institutions covered by GLBA must comply with its privacy and data security provisions if they maintain credit, deposit, trust, or other financial accounts or relationships with consumers. This broad definition ensures that nearly all organizations handling sensitive financial data are subject to the Act’s requirements.

Privacy and Data Security: The Heart of GLBA

Title V of GLBA is perhaps its most influential component for compliance professionals. It establishes strict requirements for the protection of nonpublic personal information (NPI) and mandates transparency in how consumer data is collected, used, and shared. The privacy and data security provisions are designed to give consumers control over their information while holding institutions accountable for safeguarding it.

Privacy Notice Obligations

Financial institutions must provide clear and conspicuous privacy notices to consumers at the start of a customer relationship and annually thereafter. These notices must explain the institution’s policies regarding the collection, use, and disclosure of NPI, as well as the consumer’s right to opt out of certain information sharing with nonaffiliated third parties.

A model privacy form, developed by federal regulators, helps standardize these disclosures. However, the form has limitations, as it covers only a subset of the personal information types and collection methods identified in Regulation P. Compliance professionals should ensure that their institution’s privacy notices are both accurate and comprehensive, going beyond the minimum requirements when necessary.

Information Security Program Requirements

GLBA requires financial institutions to develop, implement, and maintain a comprehensive information security program. This program must include administrative, technical, and physical safeguards to protect customer records and information from unauthorized access, anticipated threats, and hazards. The FTC Safeguards Rule further clarifies these obligations, requiring regular monitoring and testing of security measures.

Administrative safeguards: Policies, procedures, and training to manage information security risks.
Technical safeguards: Use of technology such as encryption, firewalls, and secure access controls.
Physical safeguards: Measures to protect physical access to sensitive data, such as locked facilities and secure disposal of records.

Institutions must regularly review and update their security programs to address emerging threats and vulnerabilities.

Limitations on Information Sharing and Opt-Out Rights

GLBA places strict limitations on the sharing of NPI with nonaffiliated third parties. Consumers must be given the opportunity to opt out of such sharing, except in cases where disclosure is necessary to process transactions, prevent fraud, comply with legal requirements, or respond to judicial processes. Notably, financial institutions are prohibited from disclosing account numbers or similar access codes to nonaffiliated third parties for marketing purposes.

The opt-out process must be easy for consumers to understand and exercise. Institutions should clearly explain the categories of information collected, the types of third parties with whom information may be shared, and the consumer’s right to limit this sharing.

Prohibition of Pretexting and Social Engineering

GLBA explicitly prohibits “pretexting”—the practice of obtaining customer information through false pretenses or deception. This provision is a direct response to the growing threat of social engineering and phishing scams targeting financial institutions. Compliance professionals must ensure that employees are trained to recognize and prevent such attempts.

Effective anti-pretexting measures include:

Employee education on common social engineering tactics.
Verification procedures for customer requests involving sensitive information.
Incident response protocols for suspected pretexting attempts.

Regulatory Authority, Coordination, and Enforcement

GLBA’s enforcement framework is notable for its coordination among multiple federal and state agencies. The Federal Trade Commission (FTC), Office of the Comptroller of the Currency (OCC), Federal Reserve Board, Federal Deposit Insurance Corporation (FDIC), National Credit Union Administration (NCUA), and Securities and Exchange Commission (SEC) all play roles in enforcing GLBA provisions. The Dodd-Frank Act further transferred rulemaking authority for most privacy provisions to the Consumer Financial Protection Bureau (CFPB), except for securities and futures-related companies and certain motor vehicle dealers.

The table below summarizes the primary enforcement responsibilities:

‍

Safeguard Type	Description
Administrative safeguards	Policies, procedures, and training to manage information security risks
Technical safeguards	Use of technology such as encryption, firewalls, and secure access controls
Physical safeguards	Measures to protect physical access to sensitive data, such as locked facilities and secure disposal of records

‍

Violations of GLBA can result in enforcement actions, including injunctive relief, monetary penalties, and requirements for corrective action. Institutions should be prepared for rigorous examinations and audits by their primary regulators.

Recent Developments: FTC Safeguards Rule Amendments

Expanded and Updated FTC Safeguards Rule

The Federal Trade Commission’s Safeguards Rule, which implements the GLBA’s data security requirements for non-bank financial institutions, has undergone significant updates in recent years. Originally effective in 2003, the Rule was amended in 2021 to provide more concrete, prescriptive guidance for information security programs. The amendments require covered financial institutions to implement a written information security program that is appropriate to the size and complexity of the business, the nature and scope of its activities, and the sensitivity of the customer information at issue.

Key requirements now include:

Designation of a Qualified Individual to oversee the information security program.
Written risk assessments that identify and evaluate internal and external risks to customer information.
Implementation and regular review of access controls, encryption of customer information both in transit and at rest (or use of effective alternative controls), and periodic inventory of data and systems.
Development of a written incident response plan that covers goals, internal processes, roles and responsibilities, communications, remediation, documentation, and post-incident review.
Ongoing monitoring and periodic reassessment of service providers, including contractual requirements for security and regular performance reviews.
Annual written reports by the Qualified Individual to the Board of Directors or governing body, covering the overall status of the information security program, risk assessments, test results, security events, and recommendations for program changes.

2024 Breach Notification Requirements

A major new provision took effect in May 2024: covered financial institutions must notify the FTC as soon as possible, and no later than 30 days after discovery, of any “notification event.” A notification event is defined as the unauthorized acquisition of unencrypted customer information of at least 500 consumers. This includes situations where encrypted data is compromised along with its encryption key.

The breach notification must be submitted via the FTC’s online reporting form and include basic information such as the company name, event dates, number of affected customers, types of information involved, and a brief summary of the incident. If details are incomplete at the time of reporting, updates must be submitted as more information becomes available. The FTC may make these reports public, and law enforcement delay is available if requested.

THE GOLD STANDARD IN
Cybersecurity and Regulatory Compliance

Request For Proposal Ask a Question

State-Level Changes: Montana and Connecticut Narrow GLBA Exemptions

Montana SB 297: Narrowing the GLBA Exemption

Montana’s 2025 legislative session brought a significant change to the state’s data privacy landscape. SB 297, effective October 1, 2025, eliminates the broad entity-level GLBA exemption from the Montana Consumer Data Privacy Act (MCDPA). Now, most financial institutions and their affiliates are subject to the MCDPA unless they qualify for a narrow exemption.

The law retains a data-level exemption for personal data collected, processed, sold, or disclosed in accordance with Title V of GLBA.
Specific entity-level exemptions remain for state or federally chartered banks and credit unions (and their affiliates/subsidiaries), as well as insurers, insurance providers, and third-party administrators.

This means that while GLBA-regulated data is still exempt, financial institutions operating in Montana must carefully assess whether their activities or data fall outside the scope of Title V and are thus subject to state privacy requirements.

Connecticut SB 1295: Changes to the Connecticut Data Privacy Act

Connecticut’s SB 1295, effective July 1, 2026, similarly removes the entity-level GLBA exemption from the Connecticut Data Privacy Act (CTDPA). GLBA-covered entities are no longer categorically exempt; instead, only data that is specifically regulated by GLBA (Title V) is exempt.

Entity-level exemptions are now limited to state/federally chartered banks, credit unions, insurers, broker-dealers, investment advisers, and their agents.
All other financial institutions must comply with the CTDPA for data and activities not expressly covered by GLBA.

This change requires financial institutions in Connecticut to conduct a detailed review of their data processing activities to determine which are subject to state privacy law and which remain under the federal GLBA framework.

Compliance Implications for Financial Institutions

The narrowing of GLBA exemptions at the state level in Montana and Connecticut signals a growing trend: financial institutions can no longer rely on broad federal preemption to avoid state privacy laws. Instead, they must:

Map and classify all personal data to determine whether it is covered by GLBA, state law, or both.
Update privacy notices, policies, and procedures to reflect overlapping federal and state requirements.
Train staff on the distinctions between GLBA-covered data and data subject to state privacy laws.
Monitor legislative developments in other states, as similar changes may be adopted elsewhere.

Institutions should work closely with legal and compliance experts to ensure that their privacy and data security programs are robust, up-to-date, and responsive to this evolving regulatory environment.

Compliance Examination Procedures and Best Practices

GLBA compliance is not a one-time event but an ongoing process that requires continuous attention and adaptation. Examiners will assess the adequacy of an institution’s training programs, audit procedures, and management oversight. They will also evaluate how well the institution identifies and addresses risks associated with information sharing and data security.

Best practices for GLBA compliance include:

Conducting regular risk assessments to identify vulnerabilities in information handling and sharing.
Implementing comprehensive training programs for all employees, with a focus on privacy, security, and anti-pretexting measures.
Maintaining detailed records of compliance activities, including privacy notices, opt-out requests, and incident response actions.
Promptly correcting any deficiencies identified during audits or examinations.
Reviewing and updating privacy and security policies to reflect changes in regulations and emerging threats.

Institutions must also ensure that third parties receiving consumer information comply with GLBA’s restrictions on reuse and redisclosure.

Annual Reporting and Model Privacy Form

GLBA requires insured depository institutions and certain affiliates to submit annual reports to their federal banking agencies. These reports must detail payments, fees, loans, and services provided under covered agreements, as well as itemized fund usage by nongovernmental entities. This reporting promotes transparency and accountability in financial relationships.

To assist with privacy notice compliance, federal regulators have developed a model privacy form. While widely adopted, the form has limitations, as it covers only a subset of the personal information types and collection methods identified in Regulation P. Compliance professionals should ensure that their institution’s privacy notices are both accurate and comprehensive, going beyond the minimum requirements when necessary.

GLBA’s Relationship to Other Laws

GLBA’s privacy provisions complement the Fair Credit Reporting Act (FCRA), which governs the sharing of consumer report information with affiliates. Financial institutions must integrate GLBA disclosures into their privacy policies and ensure continued compliance with FCRA requirements. The interplay between these laws underscores the importance of a holistic approach to privacy and data security compliance.

Why GLBA Compliance Matters for Financial Institutions

GLBA compliance is not just a regulatory requirement—it is a critical component of consumer trust and institutional reputation. Non-compliance can result in significant financial penalties, legal exposure, and reputational harm. Conversely, a strong compliance program can enhance consumer confidence, reduce the risk of enforcement actions, and support long-term business growth.

Protects consumer privacy and data security.
Reduces risk of regulatory penalties and litigation.
Supports positive customer relationships and institutional reputation.

Partner with NETBankAudit for GLBA Compliance Excellence

Navigating the complexities of GLBA can be challenging, but you don’t have to do it alone. NETBankAudit offers specialized GLBA audit and compliance services tailored to the unique needs of financial institutions. Our team brings over 25 years of experience, deep regulatory expertise, and a commitment to helping clients achieve and maintain compliance with confidence.

Whether you need a GLBA compliance review, targeted audit support, or ongoing advisory services, NETBankAudit delivers actionable insights and practical solutions. Contact us today to learn how we can help your institution strengthen its compliance program and protect both your customers and your business.

‍

 
class SampleComponent extends React.Component { 
  // using the experimental public class field syntax below. We can also attach  
  // the contextType to the current class 
  static contextType = ColorContext; 
  render() { 
    return <Button color={this.color} /> 
  } 
}

The Gramm-Leach-Bliley Act (GLBA): Compliance Guide for Financial Institutions

GLBA’s Legislative Background and Structure

Expanded Definitions and Scope of GLBA