GLBA Compliance Checklist

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect consumer financial data through two complementary rules:

  • The Safeguards Rule (16 CFR Part 314) requires a written information security program with specific administrative, technical, and physical safeguards. It tells you how to protect customer information.
  • The Financial Privacy Rule (16 CFR Part 313 / Regulation P) governs privacy notices, consumer opt-out rights, and restrictions on sharing nonpublic personal information (NPI). It tells you what you must disclose and what consumers can control.

This checklist covers both rules and is designed for any entity “significantly engaged” in financial activities under GLBA §509, including banks, credit unions, broker-dealers, insurance companies, mortgage lenders, higher education institutions (Title IV), auto dealers offering financing, tax preparers, and others.

This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.

The InfoSec GRC Brief
Join 1,500+ security and compliance professionals who get monthly regulatory updates, GRC strategies, and threat intel with actionable next steps.
Let’s Chat
Streamline every step of your org’s security GRC workflows
Book a Demo