Free tools Windows power users keep installed
One-click scans. No signup required.
The Gramm-Leach-Bliley Act (GLBA) is a U.S. law that requires covered financial institutions to explain certain information-sharing practices and protect customer information. Its privacy and security duties are related but distinct: Regulation P governs privacy notices and certain disclosures, while the Safeguards Rule requires a risk-based information security program. Which requirements apply depends on an organization’s activities, regulator, customer relationships, and information practices—not just the name of its business.
What is the Gramm-Leach-Bliley Act?
The Gramm-Leach-Bliley Act is a federal law addressing the privacy and security of consumers’ financial information. Title V contains its privacy and safeguards provisions. In broad terms, covered institutions must explain how they share information in specified circumstances, safeguard customer information, and avoid obtaining it through false pretenses. The FTC’s GLBA overview summarizes these duties.
“GLBA compliance” is not a single certification or one universal checklist. The applicable requirements depend on the institution’s business activities and the regulator responsible for it. Some institutions are overseen by banking regulators or other agencies rather than the FTC, so an FTC guide is not automatically the controlling rule for every financial business.
Who is covered by GLBA?
Coverage turns on what an organization does and which agency has authority over it. Under the FTC Safeguards Rule, a financial institution is generally a business engaged in financial activities, or activities incidental to them, to a significant extent and within FTC jurisdiction. A business does not necessarily fall outside the law just because it does not describe itself as a bank or financial company.
#1 Best Overall
The FTC identifies examples that can include mortgage and payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counselors, tax preparers, certain non-federally insured credit unions, certain investment advisers, and finders. The rule also has exclusions and examples of businesses that are not significantly engaged in financial activity. For instance, accepting another issuer’s credit card does not, by itself, make a retailer a financial institution under the rule’s example. These examples do not replace an entity-specific jurisdiction and coverage analysis. See the FTC Safeguards Rule guide.
The FTC says privacy rulemaking authority transferred to the Consumer Financial Protection Bureau (CFPB), except for certain motor vehicle dealers, while the FTC retains enforcement authority; Safeguards Rule rulemaking authority did not transfer. Banking regulators also supervise institutions within their jurisdictions. Identify the regulator and applicable regulation before treating any agency’s materials as definitive for a particular institution. The Congressional Research Service overview of banking, privacy, and cybersecurity regulation describes the broader agency landscape.
Rank #2
- Income And Expense Log Book: This Income and Expense Record Book（8.5" x 10.5"） is a necessary item for any small business owner or entrepreneur. It is an essential part of any business - helping you understand your overall earnings to determine if you are profitable.
- Daily Tracking and Weekly Overview: let our log tell you if you are profitable today! There are two pages per week to help you you track your income and expenses. At the end of each day or week, you can note whether you made a profit or a loss for the day.
- Clear P&L Statement For Your Business: This income and expense book makes it easy to see your expenses and how they fluctuate from time to time. This makes it easy for you to decide where you can cut back on expenses and assess your total annual net profit.
- Main Features: Expense Review + Income Review + Weekly Pages + Summary of The Year + Twin-Wire Binding + Waterproof Cover + Rounded corner design + Thicker paper
- Effective Organization: This budget book has a twin-wire binding and you can easily lay it flat at 180°. This effective design can help you work better and bring you great convenience in the process of using.
GLBA privacy rules: notices and information sharing
Regulation P implements GLBA’s privacy provisions. Covered institutions generally provide privacy notices describing their information practices, including collection, disclosure, and protection. Notices must reflect what the institution actually does; they are not a substitute for aligning real practices with applicable requirements.
Opt-out rights are limited. Before certain disclosures of nonpublic personal information to unaffiliated third parties, an institution generally must provide notice and an opportunity to opt out. That does not mean a consumer can block every disclosure: the rule includes exceptions, and requirements depend on the relationship and the type of sharing. Regulation P distinguishes initial, annual, and revised notices. An annual notice is not invariably required: an institution may qualify for an exception if it meets the statutory conditions implemented in a 2018 amendment.
The CFPB provides official Regulation P resources and model privacy forms. Institutions should assess which notices apply, when they must be delivered, whether a disclosure is covered by an exception, and whether a revised notice is needed when practices change.
GLBA security rules: the Safeguards Rule
The FTC Safeguards Rule is codified in 16 CFR Part 314. For institutions within its scope, it requires a written information security program with administrative, technical, and physical safeguards. The program must be appropriate to the institution’s size and complexity, the nature and scope of its activities, and the sensitivity of the customer information it handles. Its purpose is to protect information’s security and confidentiality, guard against anticipated threats, and prevent unauthorized access or use that could cause substantial harm or inconvenience.
Rank #4
The rule specifies program elements rather than a required product, vendor, or one-size-fits-all checklist. The institution remains responsible for its program even if a service provider supplies personnel or performs security work.
1. Assign responsibility and assess risk
- Appoint a qualified individual to oversee and implement the information security program. That person may be an employee, work for an affiliate, or work for a service provider, but the institution must oversee the work and retains compliance responsibility.
- Maintain a written risk assessment that identifies reasonably foreseeable internal and external risks, evaluates safeguards, and is revisited as risks change.
2. Put safeguards into operation
- Control access to customer information, including limiting access to what people need for their duties, and manage relevant assets and systems.
- Encrypt customer information at rest and in transit, or use approved effective compensating controls where encryption is infeasible.
- Use application-security procedures and multifactor authentication (MFA), or approved equivalent controls.
- Securely dispose of customer information no later than two years after its last use in connection with the relevant product or service. The rule provides exceptions for specified legitimate business purposes, legal retention requirements, and infeasibility; institutions must periodically review retention policies.
3. Test, train, and oversee providers
- Regularly test or monitor key controls. The rule describes continuous monitoring or periodic penetration testing and vulnerability assessments. If the specified continuous-monitoring alternative is not used, it sets annual intervals for penetration testing and vulnerability assessments, along with additional assessment triggers.
- Train personnel and use qualified security personnel, whether internal or external.
- Assess service providers when selecting them, put appropriate safeguards in contracts, and periodically assess their security practices.
- Adjust the program when business operations, technology, or risk circumstances change.
4. Prepare for incidents and report to leadership
- Maintain a written incident-response plan.
- At least annually, require the qualified individual to provide a written report to the board or equivalent governing body, or an appropriate senior officer. The report addresses the program’s status, compliance, material risks, and recommendations as specified by the rule.
Limited exceptions for smaller information holdings
An institution maintaining customer information concerning fewer than 5,000 consumers is exempt from certain Safeguards Rule provisions: the written risk-assessment requirement in §314.4(b)(1), specified testing in §314.4(d)(2), the incident-response requirement in §314.4(h), and the annual written report in §314.4(i). This is a limited set of exceptions, not a blanket exemption from the Safeguards Rule or GLBA.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- THIS IS ESSENTIAL FOR ANY BUSINESS OR CENTER: Track who comes in and out and when the do it. This can be an important security feature. This book can be used to track visitors of companies large and small. Help your staff feel safe and secure by always knowing who’s in the building. This book is the perfect front desk book for schools, clinics, offices, spas, gyms, hospitals, hotels, and more
- ITAR and EAR COMPLIANT: This book is in compliance with ITAR (International Traffic in Arms Regulations) and EAR (Export Administration Regulations). This visitor log book has information fields to accommodate the necessary records to be kept for foreign-national visitors to a company’s facility.
- KEEP TRACK OF VISITORS: Visitor information is recorded on a single page, there are spaces for 4 entries per page. There are spaces to track date, name printed, name signed, company/organization name, person visiting, time in, time out, US citizen, nationality, ITAR, badge number, purpose of visit, summary of visit, other notes. This wire-o book is 8.5" x 11"
- Reorder SKU: LOG-120-7CW-PP(ITAR-Visitor-Log)
When must a covered institution notify the FTC about a breach?
The FTC notification provision applies to a defined “notification event,” not simply to any security incident. It concerns unauthorized acquisition of unencrypted customer information. For this purpose, information is treated as unencrypted if an unauthorized person accessed the encryption key. Unauthorized acquisition is presumed when there has been unauthorized access, unless reliable evidence shows otherwise.
If a notification event involves the information of at least 500 consumers, the covered institution must notify the FTC as soon as possible and no later than 30 days after discovery. This requirement took effect May 13, 2024. The timing and threshold are set out in the current text of 16 CFR Part 314. State breach-notification laws, other regulators’ rules, and contractual duties may also apply; the FTC rule alone does not determine every obligation for a particular incident.
How to approach GLBA compliance
A practical starting point is to determine which law and regulator apply, then map the institution’s actual information practices to the relevant privacy and security duties. The following sequence helps organize that work; it is not a substitute for the applicable rule or a legal determination of coverage.
- Identify the institution and its regulator. Document the financial activities performed, the agency with authority, and whether the FTC Safeguards Rule applies or another regulator’s requirements govern.
- Map information and relationships. Identify customer information handled or maintained by the institution or its affiliates, where it is stored or transmitted, who can access it, and which service providers handle it. Apply the relevant rule’s definitions rather than assuming all personal data is GLBA information.
- Review privacy practices. Compare actual collection and disclosure practices with privacy notices. Determine which initial, annual, or revised notices are required and whether each disclosure to a nonaffiliated third party is subject to an opt-out right or an exception.
- Build and document the security program. For institutions under the FTC rule, assign a qualified individual, assess risks, select safeguards proportionate to the business and information sensitivity, and document testing, training, provider oversight, retention, and incident response.
- Set review and escalation routines. Reassess risks and safeguards as the institution changes, ensure the required written report reaches the appropriate governing body or senior officer, and establish who evaluates potential notification events and applicable deadlines.
There is no single GLBA software product or universal checklist that makes an organization compliant. Tools and outside advisers may help with documentation, risk assessment, testing, or oversight, but responsibility remains with the covered institution.
Recommended Free Tools
Which official sources should an institution consult?
- FTC: Gramm-Leach-Bliley Act for the statute and a high-level explanation.
- FTC: Safeguards Rule guide for FTC guidance on scope and compliance duties.
- CFPB: Privacy notices (GLBA) for Regulation P resources and model forms.
- eCFR: 16 CFR Part 314 for the codified FTC Safeguards Rule. The eCFR page states that Title 16 is up to date through October 6, 2026, and was last amended October 1, 2026.
Requirements can differ by regulator, institution, and incident. For an individualized compliance decision, consult the rule and regulator applicable to the institution and seek qualified legal or compliance advice where needed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
