What Is GLBA Safeguards Rule?

The Safeguards Rule turns the Gramm-Leach-Bliley Act's general promise of customer data protection into specific program requirements. Covered institutions must run a written information security program built on a documented risk assessment and implement defined controls: access management, data inventory, encryption of customer information at rest and in transit, multifactor authentication, secure development practices, continuous monitoring or periodic testing, workforce training, service provider oversight, and an incident response plan. A designated Qualified Individual oversees the program and reports to the board or senior leadership in writing at least annually.

The rule's reach surprises many businesses because the FTC's definition of financial institution extends well beyond banks. Auto dealers that arrange financing, mortgage brokers, payday and title lenders, tax preparers, collection agencies, investment advisors not covered by other regulators, and many fintechs all qualify. Depository institutions answer to their banking regulators under parallel interagency guidelines instead.

The practical implication is that the rule demands a functioning program, not a policy binder, and the FTC notification requirement for security events affecting 500 or more consumers means weak programs become visible. Our guide to GLBA Safeguards Rule compliance walks through the requirements, and our financial services page shows how Z Cyber operates these programs for mid-market institutions.