The Gramm-Leach-Bliley Act is organized around three sections that together govern how financial institutions handle personal data: the Financial Privacy Rule, the Safeguards Rule, and the Pretexting Provisions. The first tells institutions what they must disclose to customers about data sharing and when people can opt out. The second requires a written information security program to protect that data. The third makes it a federal crime to obtain someone’s financial records by deception. Each section targets a different problem, and each carries its own compliance obligations and penalties.
Who Has to Comply
GLBA reaches far beyond traditional banks. A “financial institution” under the law is any business significantly engaged in financial activities as defined by the Bank Holding Company Act.1Office of the Law Revision Counsel. 15 USC 6809 – Definitions The FTC’s Safeguards Rule lists specific examples: auto dealers that arrange financing or lease vehicles for more than 90 days, check-cashers, money-wiring services, real estate appraisers, and retailers that issue their own credit cards.2eCFR. 16 CFR 314.2 – Definitions Mortgage lenders, tax preparers, and debt collectors are also covered.3Federal Trade Commission. Gramm-Leach-Bliley Act If a business regularly touches consumer financial data, it likely falls under all three sections.
Section One: The Financial Privacy Rule
The Financial Privacy Rule, at 15 U.S.C. §§ 6801–6809, controls what institutions must tell people about data sharing and what choices those people get. When a customer relationship starts, the institution must deliver a clear written privacy notice describing what nonpublic personal information it collects, which categories of third parties may receive it, and how it protects that information.4Office of the Law Revision Counsel. 15 USC 6803 – Disclosure of Institution Privacy Policy That notice goes out again at least once a year for as long as the customer relationship lasts.
Customers with ongoing relationships, like account holders and mortgage borrowers, get both the initial notice and the annual updates. Someone with a one-time interaction, like a check-cashing walk-in, receives a notice only if the institution plans to share their data with a nonaffiliated third party.5Federal Trade Commission. Gramm-Leach-Bliley Act
Opt-Out Rights
Before sharing nonpublic personal information with a nonaffiliated third party, the institution must disclose that intent, explain how to say no, and give the person a real chance to opt out.6Office of the Law Revision Counsel. 15 USC 6802 – Obligations With Respect to Disclosures of Personal Information The mechanism must be simple: a toll-free number, a detachable mail-in form, or an online portal. Sharing data before offering that opt-out violates federal law.
Several sharing scenarios don’t trigger opt-out rights. Institutions can share data with a service provider handling tasks like account processing or marketing the institution’s own products, as long as a contract requires the provider to keep the information confidential. Sharing is also permitted to process a transaction the consumer requested, to prevent fraud, to comply with legal requirements, or when the consumer gives direct consent.6Office of the Law Revision Counsel. 15 USC 6802 – Obligations With Respect to Disclosures of Personal Information
The Annual Notice Exemption
The FAST Act, signed in 2015, added an exemption most institutions can use. An institution can skip the annual notice if two things are true: it only shares data under the exceptions that don’t trigger opt-out rights, and it hasn’t changed its data-sharing policies since the last notice it sent.4Office of the Law Revision Counsel. 15 USC 6803 – Disclosure of Institution Privacy Policy Once practices change in a way that would require an opt-out, a revised notice must go out, and the institution must collect the customer’s opt-out preference before sharing.
Section Two: The Safeguards Rule
The Safeguards Rule, at 16 CFR Part 314, converts privacy obligations into concrete security duties. Every covered institution must develop, implement, and maintain a written information security program tailored to its size, the complexity of its operations, and the sensitivity of the data it handles.7eCFR. 16 CFR 314.4 – Elements The FTC strengthened the rule with amendments finalized in 2021 and taking effect in 2023, replacing broad discretion with specific technical mandates.
Required Elements
The amended rule spells out nine core elements. The ones that shape daily operations include:
- A designated Qualified Individual to oversee and implement the program. This person can be an employee, an affiliate, or a third-party service provider, but if the role is outsourced, a senior staff member must still direct and oversee that person’s work.7eCFR. 16 CFR 314.4 – Elements
- A written risk assessment identifying reasonably foreseeable internal and external risks to customer data.
- Encryption of all customer information both in transit over external networks and at rest. Where encryption is genuinely infeasible, the Qualified Individual must approve an alternative safeguard in writing.8eCFR. 16 CFR 314.4 – Elements
- Multi-factor authentication for anyone accessing the institution’s information systems, unless the Qualified Individual has approved an equivalent or stronger control in writing.8eCFR. 16 CFR 314.4 – Elements
- Either continuous system monitoring or annual penetration testing plus vulnerability assessments every six months.9Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know
- A written incident response plan in place before anything goes wrong.
- An annual written report from the Qualified Individual to the board of directors or equivalent governing body on the status of the security program.
The Small Business Carve-Out
Institutions that maintain customer information on fewer than 5,000 consumers get a lighter load. The FTC’s 2021 final rule exempts these smaller organizations from four of the more resource-intensive requirements: the written risk assessment, the penetration testing and vulnerability assessment schedule, the written incident response plan, and the annual board report.10Federal Register. Standards for Safeguarding Customer Information The rest of the rule, including encryption, MFA, and the Qualified Individual requirement, still applies in full. Small tax preparers and independent advisors often trip up here by assuming “small” means “exempt.”
Breach Notification
When unencrypted customer data is accessed without authorization and at least 500 consumers are affected, the institution must notify the FTC as soon as possible and no later than 30 days after discovering the breach.8eCFR. 16 CFR 314.4 – Elements The notice goes through an electronic form on the FTC’s website and must describe the types of information involved, the date range, the number of consumers affected, and the event itself. If law enforcement determines that public disclosure would interfere with a criminal investigation, the agency can request a delay of up to 30 days, extendable up to an additional 60.11Federal Register. Standards for Safeguarding Customer Information Most states have their own breach notification laws with different thresholds and deadlines, so a single breach can trigger both federal and state obligations.
Section Three: The Pretexting Provisions
The third section, at 15 U.S.C. §§ 6821–6827, makes it a federal crime to obtain someone’s financial records through fraud. Pretexting is the con itself: impersonating an account holder, posing as a bank employee, or handing over forged documents to trick a financial institution into releasing customer data.12Office of the Law Revision Counsel. 15 USC 6821 – Privacy Protection for Customer Information of Financial Institutions The prohibition covers account numbers, balances, transaction histories, and any other customer information a bad actor might extract.
The law also prohibits soliciting someone else to obtain financial data through deception. A private investigator who hires a subcontractor to impersonate a bank customer, or a company that pays someone to talk records out of a call center, faces the same legal exposure as the person doing the talking. Both can be prosecuted.
Exceptions
Several situations are carved out. Law enforcement agencies acting in their official capacity can obtain financial records without violating the pretexting rules. Financial institutions themselves can test their own security procedures, investigate employee misconduct, or recover data that was previously stolen. Insurance companies can obtain information as part of an authorized fraud investigation. State-licensed private investigators can access financial records to collect court-ordered child support from a delinquent parent.13Office of the Law Revision Counsel. 15 USC 6821 – Privacy Protection for Customer Information of Financial Institutions
Criminal Penalties
Anyone who knowingly and intentionally violates the pretexting ban faces up to five years in federal prison, a fine, or both. Fines follow the general federal sentencing structure under Title 18, which caps them at $250,000 for individuals and $500,000 for organizations.14Office of the Law Revision Counsel. 15 USC 6823 – Criminal Penalty
Aggravated cases carry stiffer penalties. If the pretexting violation happens alongside another federal crime or forms part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum prison sentence doubles to 10 years and the maximum fine doubles as well.14Office of the Law Revision Counsel. 15 USC 6823 – Criminal Penalty An individual engaged in a pattern of pretexting could face up to $500,000 in fines and a decade in prison.
Who Enforces GLBA
Enforcement is split across agencies by institution type. Federal banking agencies handle national banks and FDIC-insured institutions. The SEC covers brokers, dealers, and investment advisers. State insurance authorities oversee insurance companies. The FTC handles everyone else, including tax preparers, auto dealers, and mortgage brokers.15Office of the Law Revision Counsel. 15 USC 6805 – Enforcement
On the civil side, the FTC can impose penalties of up to $53,088 per violation as of the January 2025 inflation adjustment, with a new adjustment expected in early 2026.16Federal Register. Adjustments to Civil Penalty Amounts Because each affected consumer can constitute a separate violation, a single breach or systemic failure can generate large totals fast.
GLBA does not create a private right of action. If a bank mishandles your data, you cannot sue under GLBA directly. Courts have consistently held that only the designated federal regulators, state insurance authorities, and the FTC can bring enforcement actions.15Office of the Law Revision Counsel. 15 USC 6805 – Enforcement Affected individuals may have claims under state consumer protection statutes or common-law theories like negligence, but the federal enforcement mechanism runs entirely through agencies. Filing a complaint with the relevant federal regulator or a state attorney general is the most direct route when a financial institution appears to be violating its obligations.