GLBA: Gramm-Leach-Bliley Act Compliance Guide
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices and safeguard sensitive consumer data. Originally enacted in 1999, GLBA received a significant update in 2023 when the FTC revised the Safeguards Rule to impose more specific security requirements on non-banking financial institutions.
What GLBA Covers
GLBA has three primary components. The Financial Privacy Rule requires institutions to provide customers with privacy notices explaining what data is collected and how it is shared. The Safeguards Rule requires a written information security program with administrative, technical, and physical safeguards. The Pretexting provisions prohibit the use of false pretenses to access consumer financial information.
The 2023 Safeguards Rule update added prescriptive requirements including encryption of customer data, multi-factor authentication, designated qualified individuals, annual penetration testing, and incident response planning.
Who Needs GLBA Compliance
GLBA applies broadly to "financial institutions" — a definition that extends well beyond banks. It covers mortgage brokers, payday lenders, tax preparers, debt collectors, financial advisors, insurance companies, real estate settlement services, and even auto dealers that arrange financing. The FTC enforces compliance for non-banking institutions while banking regulators oversee banks and credit unions.
Implementation Approach
Begin with a comprehensive risk assessment identifying threats to customer information. Designate a qualified individual to oversee the program. Implement access controls, encryption, multi-factor authentication, and activity monitoring. Establish vendor oversight procedures and an incident response plan. Train all employees with access to customer data.
Cost Considerations
Smaller financial institutions can achieve compliance for $25,000 to $75,000 using a combination of compliance automation tools and targeted consulting. Larger institutions with complex data environments and multiple business lines may invest $150,000 to $300,000. The 2023 Safeguards Rule updates increased costs for many organizations that previously relied on less prescriptive requirements.