What Is the GLBA (Gramm-Leach-Bliley Act)? Safeguards Rule Explained

The Gramm-Leach-Bliley Act (GLBA), also called the Financial Services Modernization Act of 1999, is the US law that governs how financial institutions handle their customers' nonpublic personal information. For security and privacy teams, it comes down to three rules — privacy, safeguards and anti-pretexting — and a recently toughened security standard. This article is general information, not legal advice.

What GLBA is for

GLBA was a sweeping financial-sector law, but its enduring relevance to security and privacy lies in how it treats customer data. Financial institutions sit on some of the most sensitive personal information there is — account numbers, balances, transaction histories, Social Security numbers. GLBA sets baseline expectations for how that "nonpublic personal information" is disclosed and protected, and it gives consumers some say and some transparency. It is enforced by multiple regulators depending on the type of institution, with the Federal Trade Commission covering many non-bank financial businesses.

The Financial Privacy Rule

The Financial Privacy Rule governs the collection and disclosure of customers' personal financial information. Its most visible requirement is the privacy notice: institutions must tell customers what information they collect, with whom they share it, and how they protect it, and must provide these notices at the start of the relationship and periodically thereafter. The rule also gives consumers the right to opt out of certain sharing of their information with nonaffiliated third parties, within limits. In effect it makes data-sharing practices transparent and gives customers a measure of control over secondary sharing.

The Safeguards Rule

If the Privacy Rule is about disclosure, the Safeguards Rule is about protection, and it is where security teams spend most of their time. It requires a financial institution to develop, implement and maintain a comprehensive written information security program with administrative, technical and physical safeguards appropriate to its size and the sensitivity of the information it holds. The program has to be designed to keep customer information secure and confidential, protect against anticipated threats, and protect against unauthorized access that could harm customers. For years this was a fairly principles-based obligation; a major update changed that.

The 2023 Safeguards Rule update

The Safeguards Rule was significantly revised, with key provisions taking effect in 2023, to make it far more prescriptive — closer to a modern security-control checklist than a general duty of care. The additions include:

• Designate a qualified individual responsible for overseeing and enforcing the information security program.
• Base the program on a written risk assessment that is periodically updated.
• Implement access controls and limit who can reach customer information.
• Encrypt customer information at rest and in transit, or use an approved equivalent.
• Require multi-factor authentication for anyone accessing customer information.
• Adopt secure development practices for in-house and externally developed applications.
• Maintain logging and monitoring to detect and respond to unauthorized activity.
• Keep a written incident response plan.
• Oversee service providers by selecting capable vendors, binding them contractually, and assessing them over time.
• Test regularly through continuous monitoring or periodic penetration testing and vulnerability assessments.
• Train staff and keep security personnel current.
• Report to a board or governing body on the program's status.

Smaller institutions have some scaled-back obligations, but the direction is clear: the FTC now expects specific, demonstrable controls, not just a policy on a shelf. Much of this maps directly onto general security frameworks, so if you have already organised your controls around the NIST Cybersecurity Framework or built an information security management system, you are most of the way there. The service-provider oversight requirement in particular is a third-party risk mandate — assessing vendors with a vendor risk scorecard and the vendor security assessment checklist is exactly the kind of evidence it calls for.

The Pretexting provisions

GLBA also addresses pretexting — obtaining customer financial information under false pretenses, such as impersonating an account holder to trick a call center into handing over account details. The pretexting provisions push institutions to protect against this kind of social engineering. In practical terms that means robust identity verification, staff training to recognise manipulation, and controls that make it hard for an attacker to talk their way into customer data. It is GLBA's acknowledgment, decades ahead of the current wave of social-engineering attacks, that people and processes are a primary target.

Who has to comply

GLBA applies to financial institutions, and that category is much wider than "banks." The law covers businesses significantly engaged in financial activities, which sweeps in lenders and mortgage brokers, loan servicers, check cashers and payday lenders, investment and financial advisers, tax-preparation firms, some debt collectors, and a great many fintech companies and the data-processing vendors that serve them. If your business handles consumers' nonpublic personal financial information as part of offering a financial product or service, assume GLBA may reach you and confirm your specific obligations with counsel. Note that GLBA sits alongside, not instead of, other obligations — a fintech may also be in scope for frameworks like SOC 2 that customers demand contractually.

Frequently asked questions

What is the GLBA? A 1999 US law governing how financial institutions collect, share and protect customers' nonpublic personal information, through the Financial Privacy Rule, the Safeguards Rule and the Pretexting provisions.

What is the Safeguards Rule? The security component — a requirement to maintain a written information security program with administrative, technical and physical safeguards appropriate to the institution.

What did the 2023 update add? Prescriptive requirements: a designated qualified individual, written risk assessment, access controls, encryption, multi-factor authentication, logging, incident response, vendor oversight, testing, training and board reporting.

Who must comply? "Financial institutions" broadly defined — not just banks, but lenders, advisers, tax preparers, many fintechs and the vendors that serve them.

What is pretexting? Obtaining financial information under false pretenses, such as impersonating a customer; GLBA requires institutions to protect against this social-engineering threat.