Gramm-Leach-Bliley Act Compliance Guide

The Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act of 1999, is a US federal law that governs how financial institutions collect, share, and protect the nonpublic personal information (NPI) of their customers. Enacted at a time when the walls separating banking, securities, and insurance businesses were coming down, GLBA introduced privacy and security obligations that remain foundational to financial-sector data protection today.

Background

Before 1999, US law largely kept commercial banks, investment banks, and insurance companies in separate regulatory lanes. GLBA repealed key provisions of the Glass-Steagall Act, allowing these institutions to consolidate and offer a broader range of services. Because this consolidation meant financial conglomerates could now aggregate enormous amounts of sensitive customer data across business lines, Congress built privacy and security requirements directly into the law.

Who Must Comply

GLBA applies broadly to "financial institutions," a term that extends well beyond traditional banks. It covers:

• Banks and credit unions
• Securities firms and investment advisors
• Insurance companies
• Mortgage lenders and brokers
• Debt collectors
• Tax preparation services
• Real estate settlement services
• Any business "significantly engaged" in financial activities

The Three Core Rules

GLBA compliance is generally organized around three key components:

1. The Financial Privacy Rule

Requires financial institutions to provide customers with a clear privacy notice explaining what information is collected and how it is shared, and to give customers the ability to opt out of having their information shared with certain third parties.

2. The Safeguards Rule

Requires institutions to develop, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to their size and complexity. The Federal Trade Commission significantly strengthened the Safeguards Rule in 2021, adding specific requirements such as encryption, multi-factor authentication, access controls, and incident response planning, with compliance required by June 2023 for most provisions.

3. The Pretexting Provisions

Prohibit obtaining customer information through false pretenses, such as impersonating a customer to a financial institution or using fraudulent documents to access account information.

What Counts as Nonpublic Personal Information

NPI includes any personally identifiable financial information that a consumer provides to a financial institution, results from a transaction with the institution, or is otherwise obtained by the institution in connection with providing a financial product or service. This includes account numbers, income, credit history, and Social Security numbers.

Enforcement

GLBA is enforced by multiple regulators depending on the type of institution, including the FTC, the federal banking agencies, the SEC, and state insurance regulators. Penalties for violations can include significant civil fines, and in cases of willful violation, criminal penalties including imprisonment for individuals.

Secure Data Disposal Under GLBA

The Safeguards Rule explicitly requires financial institutions to implement procedures for the secure disposal of customer information no later than two years after the information is last used, unless retention is otherwise required by law or business necessity. This makes data erasure a direct regulatory requirement, not just good practice. When retiring hard drives, servers, or mobile devices that stored NPI, institutions need erasure methods that render data unrecoverable and produce documented proof of destruction, since examiners and auditors will expect evidence, not just a policy statement.

Official Regulatory Reference

For the most accurate, authentic, and up-to-date legal text, we highly recommend consulting the official legislative documentation provided by the respective regional government or data protection authority. Relying on the official source of truth is the best way to ensure full compliance.

Streamlining Compliance with D-Secure Solutions

Meeting strict data sanitization requirements doesn't have to be a manual, error-prone process. Our enterprise data sanitization solutions are purpose-built to help organizations seamlessly meet these strict regulatory mandates.

By utilizing D-Secure Drive Eraser, your organization can permanently wipe sensitive data and automatically generate tamper-evident erasure certificates. This creates a rigorous, verifiable audit trail that satisfies regulatory bodies and eliminates the risk of data leaks.

Conclusion

GLBA remains one of the most detailed sector-specific privacy and security laws in the United States. For any financial institution, compliance means combining clear customer disclosures, a documented information security program, and verifiable, standards-based data disposal practices throughout the data lifecycle.