If your business provides financial products or services to consumers — loans, insurance, investment advice, tax prep, even mortgage brokering — GLBA is the federal privacy law that governs how you handle their personal financial information.
You're in the NerdSquad IT Dictionary — where compliance frameworks get explained like a human wrote them, not a lawyer.
GLBA was signed into law in 1999, and for years it flew under the radar compared to flashier regulations like HIPAA or PCI-DSS. That changed in 2023, when the FTC significantly updated the Safeguards Rule — the part of GLBA that financial institutions care most about from an IT standpoint — adding specific technical requirements that look a lot like modern cybersecurity standards. If you haven't revisited your GLBA posture since before 2023, there's a good chance you're out of date.
Gramm-Leach-Bliley Act.
Named after the three legislators who sponsored it: Senator Phil Gramm, Representative Jim Leach, and Representative Thomas Bliley. The law had two major purposes: it repealed Depression-era restrictions that prevented banks from also being insurance companies or investment firms, and it created new privacy and security requirements for how financial institutions handle consumer data.
The IT and compliance world is almost exclusively focused on the second part.
GLBA is the financial services equivalent of HIPAA. Where HIPAA protects health information, GLBA protects nonpublic personal information (NPI) — the financial details a consumer shares with a company in the course of seeking or using financial services.
Think: bank account numbers, Social Security numbers, income data, credit history, investment holdings, tax return information. The kind of data that, in the wrong hands, enables identity theft, account takeover, and fraud at scale.
GLBA applies to "financial institutions" — but the FTC's definition of that term is broader than most people expect. It's not just banks. Under GLBA, financial institutions include:
If your business is on that list — or adjacent to it — GLBA almost certainly applies to you. Many small businesses in financial services operate for years without realizing they're covered.
GLBA is built around three core requirements:
The Privacy Rule requires financial institutions to tell customers what personal information they collect, how it's used, and with whom it's shared. Customers must be given the opportunity to opt out of certain types of sharing with third parties. This is the "privacy notice" you've seen at the bottom of every bank statement.
The Safeguards Rule requires financial institutions to develop, implement, and maintain a comprehensive information security program to protect customer NPI. This is the IT-heavy rule — the one with specific technical requirements. The 2023 FTC update added explicit requirements for encryption, multi-factor authentication, access controls, incident response planning, and annual reporting to the board of directors.
The Pretexting Rule prohibits social engineering attacks against financial institutions — specifically, the practice of impersonating a customer to extract their information. This is less of an IT requirement and more of an operational awareness issue, but it's relevant to employee training programs.
The 2023 FTC Safeguards Rule update is where most of the IT action is. Financial institutions covered by the FTC (non-bank financial institutions) are now required to:
Organizations with fewer than 5,000 customers are exempt from some of the more administrative requirements (like the written incident response plan and board reporting), but the core technical controls apply regardless of size.
This one shows up constantly in small financial services firms. The logic goes: GLBA is for big banks, not a three-person mortgage brokerage or an independent tax preparer.
It's wrong. GLBA's coverage is based on what you do, not how big you are. A sole-proprietor financial advisor with 50 clients is a covered financial institution under GLBA. The 2023 Safeguards Rule update did create some carve-outs for very small institutions, but those carve-outs are narrow and mostly apply to documentation requirements — not the underlying security obligations.
Enforcement is split across multiple regulators depending on the type of institution:
Penalties vary by regulator but can reach $100,000 per violation for institutions, with personal liability up to $10,000 per violation for officers and directors who knowingly participate in violations. Criminal penalties (up to 5 years imprisonment) apply in cases of intentional disclosure. And that's before state attorneys general pile on with their own data breach and privacy statutes.
The FTC has become meaningfully more aggressive on Safeguards Rule enforcement since the 2023 update. Several high-profile enforcement actions have targeted mortgage servicers, auto dealers, and financial technology firms.
The updated Safeguards Rule reads like a checklist of what a good MSP should already be doing for any client. For financial services clients specifically, that includes:
The vendor oversight requirement is worth flagging specifically: under GLBA, financial institutions are responsible for the security practices of their service providers. That means your MSP, your cloud storage vendor, your email platform, and your CRM all need to meet the bar — not just your internal systems.
Financial services firms often operate under multiple overlapping frameworks:
As with other compliance frameworks, the security controls that satisfy GLBA — MFA, encryption, access controls, logging, endpoint protection — are largely the same controls that satisfy the others. A well-designed IT security program doesn't need to be rebuilt for each framework; it needs to be documented and mapped.
Financial services firms often have the most complex compliance stacks of any industry we work with. If you're trying to figure out what GLBA actually requires of your specific environment, we're a good starting point.