🇺🇸Gramm-Leach-Bliley Act

Skin

← Back to laws in United States

Gramm-Leach-Bliley Act

Gramm-Leach-Bliley Act: financial privacy and safeguards

The Gramm-Leach-Bliley Act is a major United States financial privacy law. Its privacy provisions are built around nonpublic personal information handled by financial institutions. The law recognises that financial institutions have an affirmative and continuing obligation to respect customer privacy and protect the security and confidentiality of customer information.

GLBA compliance is usually discussed through two practical pillars: privacy notices and information sharing controls, and safeguards for customer information. It is especially important for banks, lenders, insurance businesses, securities firms, financial advisors, fintechs and other businesses that fall within the meaning of financial institution for the relevant rule.

Privacy notice and opt-out framework

GLBA restricts disclosure of nonpublic personal information to nonaffiliated third parties unless the financial institution provides the required notice and, where applicable, an opportunity to opt out. The privacy notice should describe the institution’s information-sharing practices and the consumer’s choices.

The law also contains exceptions, including disclosures for servicing, processing transactions, maintaining accounts, compliance, fraud prevention and other permitted purposes. These exceptions should be applied carefully and documented.

Key Provisions

Privacy obligation: financial institutions must respect customer privacy and protect customer information.

Notice: consumers must receive privacy notices explaining information-sharing practices.

Opt-out: disclosure to nonaffiliated third parties may require a clear opt-out opportunity unless an exception applies.

Safeguards: administrative, technical and physical safeguards must protect customer records and information.

Vendor confidentiality: third parties receiving information to perform services should be bound by confidentiality and use restrictions.

Safeguards are not optional

GLBA requires standards for administrative, technical and physical safeguards. These safeguards should protect the security and confidentiality of customer records, protect against anticipated threats or hazards, and protect against unauthorised access or use that could cause substantial harm or inconvenience to a customer.

In practice, this means a written security programme, risk assessment, access controls, vendor oversight, incident response, encryption or equivalent controls where appropriate, employee training and ongoing monitoring. The exact requirements may depend on the regulator and rule applicable to the institution.

Information sharing needs classification

A financial institution should know when it shares information with affiliates, nonaffiliated third parties, service providers, joint marketing partners, payment processors, cloud vendors, analytics providers and other recipients. Each disclosure should be classified against the GLBA notice, opt-out and exception framework.

Vendor contracts should restrict use and disclosure, require confidentiality, support security obligations and provide incident escalation. The fact that a disclosure is operationally convenient does not automatically make it compliant.

Practical risk area

Many fintech businesses focus on app privacy notices but miss GLBA vendor and safeguards obligations. If the business is a financial institution for GLBA purposes, information security and third-party controls are central compliance obligations.

Relationship with state privacy laws

Many state consumer privacy laws include exemptions for financial institutions or data subject to Title V of GLBA. The wording of the exemption matters. Some exemptions are entity-level, some are data-level and some depend on whether the particular processing activity is actually regulated by GLBA.

A financial institution should still map non-GLBA data flows, including website analytics, employment data, marketing leads and product telemetry, to determine whether other privacy laws apply.

What this means for you

If you handle financial customer information in the United States, treat GLBA as a privacy and security programme. Build accurate notices, opt-out handling where required, third-party confidentiality controls, a written safeguards programme, breach response and evidence that security controls are actively maintained.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis