GLBA Compliance Guide (2026): Safeguards Rule, Privacy Rule and Breach Reporting

Who it applies to

• What makes a business a "financial institution". The test is the activities a business carries out, not its label: any business engaged in activities that are "financial in nature" under section 4(k) of the Bank Holding Company Act (§ 314.1).
• Examples the FTC gives (FTC):
• mortgage lenders and brokers
• payday lenders and finance companies
• account servicers, check cashers and wire transferors
• collection agencies
• credit counsellors and financial advisers
• tax preparers
• non-federally insured credit unions
• investment advisers that don't have to register with the SEC
• finders, added in 2021
• Motor vehicle dealers. The FTC published dealer-specific FAQs in June 2025 (FTC).
• Who enforces. The FTC covers institutions not overseen by another regulator. Banks, credit unions, SEC registrants and insurers fall to their own federal or state regulators, which have issued substantially similar rules (FTC Privacy Rule guide).
• Small-institution exemption. Institutions holding information on fewer than 5,000 consumers are exempt from four requirements (§ 314.6):
• the written risk assessment
• penetration testing and vulnerability scanning
• the incident response plan
• board reporting

Key requirements

The Safeguards Rule's nine elements (§ 314.4)

The written program must be appropriate to your size, complexity and data sensitivity (§ 314.3). It must cover nine elements:

1. Qualified Individual. This person can be employed by you, an affiliate or a service provider. If outsourced, you keep responsibility, must designate a senior overseer, and must require the provider to keep its own security program.
2. Written risk assessment. It must set criteria for categorising risks and for assessing confidentiality, integrity and availability, and explain how risks will be mitigated or accepted. Repeat it periodically.
3. Safeguards, including:

• least-privilege access controls
• a data and asset inventory
• encryption of customer information in transit over external networks and at rest, or compensating controls approved by the Qualified Individual
• secure development practices
• MFA for anyone accessing any information system
• disposal of customer information within two years of last use, unless an exception applies
• change management
• logging and monitoring of user activity

1. Testing. Either continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months and after material changes.
2. Training. Security awareness for all staff, and qualified security personnel who keep their knowledge current.
3. Service provider oversight. Select capable providers, require safeguards by contract, and assess providers periodically.
4. Program adjustment. Update the program based on testing results, changes and new risk assessments.
5. Written incident response plan. It must cover goals, processes, roles, communications, remediation, documentation, and post-incident review.
6. Board reporting. The Qualified Individual reports in writing at least annually on program status and material matters.

FTC breach notification (§ 314.4(j))

These requirements come from § 314.4(j), the FTC press release and FTC guidance:

• Trigger. A "notification event" is the unauthorised acquisition of unencrypted customer information involving at least 500 consumers.
• Encrypted data. Information counts as unencrypted if the encryption key was also compromised.
• Access versus acquisition. Unauthorised access is presumed to be acquisition unless reliable evidence shows otherwise.
• Deadline and channel. Notify the FTC as soon as possible, and no later than 30 days after discovery, using its online form.
• What the notice includes:
• your institution's details
• the types of data involved
• the dates
• the number of consumers affected
• a description of the event
• any law enforcement delay request
• Law enforcement delays. Disclosure can be delayed by up to 30 days at law enforcement's request, extendable by 60 days.
• When discovery happens. An event counts as discovered on the first day any employee, officer or agent knows about it.

Privacy Rule

The FTC Privacy Rule guide sets out these obligations:

• Initial privacy notice. Give customers a clear and conspicuous notice by the time the customer relationship begins.
• Annual notice. Give customers a notice at least once every 12 months for as long as the relationship lasts.
• Opt-out before sharing. Before sharing nonpublic personal information (NPI) with non-affiliated third parties outside the exceptions, give an opt-out notice and a reasonable opportunity to opt out, for example 30 days.
• Reasonable means to opt out. A toll-free number counts. Requiring a letter as the only option doesn't.
• Account numbers. Sharing them with non-affiliates for marketing is prohibited.
• Received NPI. Recipients are limited in how they reuse and redisclose it.

Penalties and enforcement

• FTC enforcement. The FTC enforces the Privacy Rule in federal district court and can seek injunctive and equitable relief. It also uses its authority under Section 5 of the FTC Act against deceptive or unfair practices (FTC Privacy Rule guide).
• Other regulators. Banking regulators, the SEC, the NCUA and state insurance authorities enforce their own versions of the rules.
• Penalty amounts. We didn't verify specific civil penalty amounts, so none are given here.

Certification process and timeline

There's no GLBA certificate. Examiners and the FTC review your written program, risk assessments, test results and board reports. Many institutions use SOC 2 or ISO 27001 reports as supporting evidence for vendor oversight.

Mapping to related frameworks

• NIST CSF 2.0: the nine elements map well to Govern, Identify, Protect, Detect, Respond and Recover.
• PCI DSS: overlaps on MFA, encryption and testing where card data is processed.
• SOC 2 / ISO 27001: evidence for vendor oversight (element 6) and for safeguards.
• CCPA: check how state privacy laws treat GLBA-covered data before assuming an exemption.

Readiness checklist

1. Confirm whether you are a "financial institution", and which regulator covers you.
2. Count the consumers whose information you hold, against the 5,000 threshold.
3. Appoint a Qualified Individual and, if outsourcing the role, a senior overseer.
4. Write the risk assessment with explicit criteria.
5. Deploy MFA everywhere, plus encryption at rest and in transit, or documented compensating controls.
6. Set up logging and monitoring, and schedule pen tests and six-monthly scans, or implement continuous monitoring.
7. Review data retention against the two-year disposal rule.
8. Update vendor contracts and assess vendors periodically.
9. Write and test the incident response plan, including the 30-day FTC reporting workflow.
10. Deliver the annual written report to the board.
11. Review privacy notices and opt-out mechanisms.

Common pitfalls

• Assuming you're not a financial institution because you're a dealer, tax preparer or finder.
• MFA gaps on internal systems or service accounts.
• Encrypted data whose keys were also exposed, which still triggers notification.
• Outsourcing the Qualified Individual role without senior oversight.
• Keeping customer data indefinitely.

How AssureCore helps

• The Controls Register maps the nine elements to controls.
• Evidence Management stores pen test reports, scans and board reports, with expiry alerts.
• The Risk Register documents the written risk assessment.
• Policy Management drafts the information security program and the incident response plan.
• Audit Reports (PDF/CSV) support examinations.

Frequently asked questions

Official references

• eCFR – 16 CFR Part 314 (Safeguards Rule)
• FTC – Safeguards Rule: What Your Business Needs to Know
• FTC – Safeguards Rule legal library
• FTC – Amends Safeguards Rule to require breach reporting (Oct 2023)
• FTC – Guidance on Updated Safeguards Rule (June 2025)
• FTC – How to Comply with the Privacy Rule

Related frameworks

• GDPR guide
• UK GDPR guide
• CCPA guide
• HIPAA guide