Gramm-Leach-Bliley Act (GLBA)

What this entry covers

The Gramm-Leach-Bliley Act requires financial institutions, meaning companies that offer consumers financial products or services such as loans, financial or investment advice, or insurance, to explain their information-sharing practices to customers and to safeguard sensitive customer data. The FTC’s Safeguards Rule (16 CFR Part 314) and the CFPB’s Regulation P (12 CFR Part 1016) implement parts of the law.

MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid; it is not legal advice and is not a substitute for the official text.

Official documentation

• Primary official source: https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act
• FTC Safeguards Rule: https://www.ftc.gov/legal-library/browse/rules/safeguards-rule
• CFPB Regulation P (12 CFR Part 1016): https://www.consumerfinance.gov/rules-policy/regulations/1016/

Recent changes

• 2024-05-13: The FTC Safeguards Rule’s notification requirement took effect: covered financial institutions must notify the FTC no later than 30 days after discovering an unauthorized acquisition of unencrypted customer information involving at least 500 consumers. FTC

How to use this index entry

1. Open the official link above (or the agency home if the deep link drifts).
2. Confirm edition / revision date against your program scope.
3. Map applicability by sector and jurisdiction listed in the metadata.
4. Follow related frameworks only after checking their own official sources.

Disclaimers

• MyRHC does not host proprietary standards text (ISO, some industry bodies).
• Where standards are paywalled, we link to the publisher’s catalog page.
• Always verify current requirements with counsel and the issuing authority.