Drive GLBA sensitive data compliance

Provide evidence to auditors of steps taken to secure the confidentiality of customer information collected and protect it against threats and unauthorized access.

GLBA Overview

Passed in 1999, The Gramm-Leach-Bliley Act applies to both financial institutions and any business that offers consumers financial products or services (loans, financial or investment advice, insurance, etc.). 

It requires businesses to explain their information-sharing practices to customers and to provide evidence to auditors that they take active steps to safeguard sensitive data.

GLBA applies to any size business that provides financial products or services for personal, family, or household purposes, and in doing so, collects non-public personal info (NPI) on consumers.

Companies subject to GLBA either identify as a financial institution or receive NPI from a financial institution as a 3rd party. 

GLBA does not apply when a financial institution collects information for business or commercial purposes, such as commercial loans, commercial checking accounts, and other B2B services. GLBA also does not apply to information collected on individuals not applying for a financial product. 

Any “non-public personal info” or NPI about consumers collected by companies offering financial services is covered under the act. 

NPI is any personally identifiable financial information collected about an individual, including:

  • any personal information provided by a consumer to obtain a financial product
  • any information collected during a transaction (credit card and bank account numbers)
  • any information collected while providing a financial service

The act has three main sections, consisting of two rules and a set of provisions. 

To be GLBA compliant, financial institutions must: 

  1. communicate to customers how they share sensitive data
  2. inform customers of their right to opt-out if they prefer that their personal data not be shared with third parties
  3. provide auditors evidence that they’ve taken steps to protect customers’ private data in accordance with their written information security policy

The primary data protection implications of the GLBA are outlined in its Safeguards Rule, with additional privacy and security requirements issued by the FTC’s Financial Privacy Rule.

The Safeguards Rule requires businesses to have controls in place to protect, store and dispose of customer information. It requires businesses to identify risks to consumer’s private information in each relevant area of the company’s operation, evaluate the effectiveness of the current safeguards for controlling these risks and to provide evidence to auditors that steps. 

All GLBA rules went into effect on November 12, 1999 and are enforced by the FTC, the federal banking agencies, and other federal regulatory authorities, as well as state insurance oversight agencies.

If a GLBA non-compliance allegation is proven, the punishment can have business-altering – and even life-altering – ramifications. Non-compliance penalties include:

  • Financial institutions found in violation face fines of $100,000 for each violation.
  • Individuals in charge found in violation face fines of $10,000 for each violation.
  • GLBA also includes provisions for criminal enforcement. In criminal cases, financial institutions, officers, and directors can face statutory fines, and officers and directors can also face up to 5 years of federal imprisonment.

Six ways Qohash drives compliance

Monitor insider risk 24/7 and track data lineage
Find sensitive data, everywhere
Fulfill deletion requests
Identify and correct exposure points
Prove enforcement of privacy policies
Regulate access to your data

Schedule a demo

See how you can maintain an inventory of NYCRR-regulated data and provide regulators proof of 24/7 data monitoring, fulfillment of right-to-be-forgotten requests at endpoints, and policy enforcement.

Contact us​

Logo Qohash
By initiative
Regulatory compliance:
Find, classify and inventory all sensitive data, across every data source
Data breach prevention:
Monitor sensitive data 24/7, track data lineage, and enforce policies at endpoints
Microsoft 365
One easy-to-use platform to secure sensitive data on Windows workstations and M365
By regulation
Law 25
Why Qohash
Defy legacy limitations
What our customers say about us