GLBA compliance means two things for a small financial business. Tell your customers how you share their financial information, and protect that information with a written security program. If you're a tax preparer, mortgage broker, lender, appraiser or a car dealer that arranges financing, the FTC enforces it, and the security half is where most of the work sits.
The privacy half is mostly paperwork. You give customers a privacy notice, and usually an opt-out, before you share their data with outside companies. The security half is the FTC Safeguards Rule. It asks for a named person in charge of security, a written risk assessment, access limits, encryption, multi-factor authentication, staff training and security terms in your vendor contracts.
Size doesn't get you out. A two-person bookkeeping office is covered the same way a regional lender is. Firms holding data on fewer than 5,000 consumers skip four of the requirements, not the rule. And the usual consequence of ignoring it isn't a fine. It's a federal order that can last 20 years.
What GLBA is
GLBA is a 1999 federal law. Its privacy title starts with one sentence that sets the tone for everything after it. Each financial institution has "an affirmative and continuing obligation to respect the privacy of its customers and to protect the security and confidentiality of those customers' nonpublic personal information" (15 U.S.C. 6801).
"Nonpublic personal information" is the data people hand you to get a financial product. Social Security numbers, income, account numbers, credit reports, tax returns. Even the fact that someone is your customer can count.
Who has to comply with GLBA
"Financial institution" is much wider than banks. The FTC's rule lists examples that include tax preparers, mortgage brokers, real estate appraisers, title and settlement companies, finance companies, collection agencies, and car dealers that lease or arrange financing (16 CFR 314.2). It says examples on purpose. If your business is significantly engaged in a financial activity, you're in.
What changes is who checks. GLBA hands each type of business to its own regulator (15 U.S.C. 6805).
| Your business | Who enforces GLBA | Security rule you follow |
|---|---|---|
| Bank or credit union | Your bank regulator | Your regulator's own standards |
| SEC-registered adviser or broker-dealer | The SEC | The SEC's Regulation S-P |
| Insurance agency | Your state insurance department | State insurance law |
| Tax preparer, CPA firm, mortgage broker, lender, appraiser, title company, collection agency, car dealer that finances or leases | The FTC | The FTC Safeguards Rule |
That last row is most small financial businesses, and it's the one the rest of this guide follows.
The three parts of GLBA
The privacy part. Before you share a customer's information with an outside company, you give them a privacy notice and, in most cases, a chance to opt out (15 U.S.C. 6802). For most firms the detailed notice rules sit in the CFPB's Regulation P. Car dealers follow the FTC's own Privacy Rule instead.
The safeguards part. The law told each regulator to set security standards for the firms it oversees. The FTC's version is the Safeguards Rule, and for an FTC-covered business it is what "GLBA compliance" mostly means in practice. We walk through it requirement by requirement in our FTC Safeguards Rule guide.
The pretexting part. It's illegal to get someone's financial information by pretending to be them or lying to the firm that holds it (15 U.S.C. 6821). For you, this mostly shows up as a training topic. Your staff should know how to spot a caller fishing for a client's account details.
GLBA requirements for your security program
The Safeguards Rule asks for a written information security program with specific pieces. In plain English, you need to do these things.
- Name one person who owns the program. The rule calls them the Qualified Individual, and they can be an employee or an outside provider.
- Write down a risk assessment. Where customer data lives, who can reach it, what could go wrong.
- Put real controls in place. Access limited to people who need it, encryption, multi-factor authentication for anyone logging into your systems, secure disposal, and logs of who did what.
- Test those controls, either with continuous monitoring or with yearly penetration testing and vulnerability scans every six months.
- Train your staff on security.
- Check that your vendors protect the data you give them, and put it in their contracts.
- Keep a written incident response plan.
- Have the Qualified Individual report to the owner or board in writing at least once a year.
- Report a breach that affects 500 or more people to the FTC within 30 days of finding it.
Every one of those comes from 16 CFR 314.4. The rule doesn't hand you a checklist of products to buy. It asks for safeguards that fit your size and the data you hold.
The small-firm exemption, and what it doesn't cover
If you hold information on fewer than 5,000 consumers, you can skip four items (16 CFR 314.6). The written risk assessment, the monitoring or testing requirement, the written incident response plan and the annual report.
That is the whole exemption. You still need the written program, a Qualified Individual, multi-factor authentication, encryption, training and vendor oversight. Count every consumer whose records you still keep, not just this year's clients. A firm with a few hundred clients a year and a long retention policy can pass 5,000 without noticing.
What happens if you don't comply
GLBA's enforcement section doesn't set a fine for a first violation (15 U.S.C. 6805). Be wary of anyone who tells you otherwise. The scary per-violation numbers that float around online come from other sections of the law, mainly the pretexting penalties (15 U.S.C. 6823).
What the FTC actually does is sign a firm up for a long order. A Georgia car dealer that let file-sharing software expose 95,000 customers' records got a 20-year order with outside security audits every other year (FTC). Break an order like that and civil penalties do apply, per violation (15 U.S.C. 45(l)).
Money also comes from other laws. A one-owner California mortgage broker who posted clients' credit details while replying to Yelp reviews paid $120,000 under the Fair Credit Reporting Act. The FTC's complaint also said the firm had no security program until 2017 (FTC).
And state attorneys general act on their own. New York settled with a small accounting firm for $60,000 after a ransomware attack exposed unencrypted Social Security numbers and clients weren't told for a year and a half (NY Attorney General).
Where to start
- Confirm you're a financial institution and that the FTC is your regulator.
- Count the consumers whose information you hold, so you know which parts of the rule apply.
- Name your Qualified Individual.
- Check that your privacy notice exists and says what you actually do.
- Write the security program, starting from a risk assessment.
- Turn on multi-factor authentication everywhere customer data lives. It's the fix most small firms are missing.
If you prepare taxes, the IRS has its own version of this requirement. Our IRS WISP guide covers it.
Not sure how your firm measures up? Our security check gives you a plain score and can match you with one IT company that works with firms like yours.