The Gramm-Leach-Bliley Act is a federal law that requires financial institutions to protect the security and confidentiality of their customers personal financial information. Its data-security requirements are spelled out in the FTC Safeguards Rule.

Who has to comply with GLBA?

Any business the law defines as a financial institution, which goes well beyond banks. Accountants, tax preparers, mortgage brokers, auto dealers that arrange financing, financial advisors, and collection agencies are all typically covered.

What is the difference between GLBA and the FTC Safeguards Rule?

GLBA is the law. The FTC Safeguards Rule is the regulation under GLBA that lists the specific security controls a non-bank financial institution must put in place, such as encryption, multi-factor authentication, and a written incident response plan.

What happens if we are not GLBA compliant?

A financial institution that fails to protect customer data can face FTC enforcement, financial penalties, and significant reputational damage after a breach. Increasingly, business partners and insurers also expect proof of GLBA controls.

How does bdManagedIT help with GLBA compliance?

We build and document the written information security program GLBA requires: risk assessment, access controls, encryption, multi-factor authentication, monitoring, testing, vendor oversight, training, and an incident response plan, all maintained as part of managed IT.

Does GLBA apply to small businesses?

Yes. A small accounting firm or auto dealer is just as much a financial institution under GLBA as a large lender. The rule scales to your size and risk, but the core obligation to protect customer financial data applies regardless of headcount.

Compliance center

GLBA Compliance for Financial Institutions

Gramm-Leach-Bliley Act (GLBA)

GLBA is the federal law that requires financial institutions to protect the personal financial information of their customers and to be clear about how that information is used.

Who needs to comply with GLBA

Any business the law treats as a financial institution, which is far broader than banks. It includes accountants and tax preparers, mortgage lenders and brokers, auto dealers that arrange financing, financial advisors and planners, collection agencies, and many fintech and lending businesses. If you handle customer financial information, GLBA likely applies to you.

What GLBA requires

A written information security program that fits your size and risk
A qualified individual responsible for the security program
A written risk assessment of where customer data lives and how it could be exposed
Access controls and a current inventory of where customer information is stored
Encryption of customer information at rest and in transit
Multi-factor authentication for anyone accessing customer data
Regular testing, including vulnerability scans and penetration testing
Security awareness training for staff
Oversight of vendors and service providers that handle your data
A written incident response plan and reporting to leadership

Source: FTC, Gramm-Leach-Bliley Act business guidance

How bdManagedIT helps

We map your environment to GLBA, remediate the gaps, and document everything so you walk into an audit ready. Start with the free Cyber Insurance and Compliance Readiness Checker or book a first appointment.

Check your readiness Book a call

GLBA, FAQs

What is GLBA?: The Gramm-Leach-Bliley Act is a federal law that requires financial institutions to protect the security and confidentiality of their customers personal financial information. Its data-security requirements are spelled out in the FTC Safeguards Rule.
Who has to comply with GLBA?: Any business the law defines as a financial institution, which goes well beyond banks. Accountants, tax preparers, mortgage brokers, auto dealers that arrange financing, financial advisors, and collection agencies are all typically covered.
What is the difference between GLBA and the FTC Safeguards Rule?: GLBA is the law. The FTC Safeguards Rule is the regulation under GLBA that lists the specific security controls a non-bank financial institution must put in place, such as encryption, multi-factor authentication, and a written incident response plan.
What happens if we are not GLBA compliant?: A financial institution that fails to protect customer data can face FTC enforcement, financial penalties, and significant reputational damage after a breach. Increasingly, business partners and insurers also expect proof of GLBA controls.
How does bdManagedIT help with GLBA compliance?: We build and document the written information security program GLBA requires: risk assessment, access controls, encryption, multi-factor authentication, monitoring, testing, vendor oversight, training, and an incident response plan, all maintained as part of managed IT.
Does GLBA apply to small businesses?: Yes. A small accounting firm or auto dealer is just as much a financial institution under GLBA as a large lender. The rule scales to your size and risk, but the core obligation to protect customer financial data applies regardless of headcount.