Last updated: 5 November 2026
Quick answer: The GLBA Safeguards Rule (16 CFR Part 314) requires non-bank financial institutions under FTC jurisdiction to run a written information security program with nine elements, including a Qualified Individual, a written risk assessment, encryption, multi-factor authentication, testing, vendor oversight, an incident response plan, annual board reporting and FTC notice of breaches affecting 500 or more consumers.
The GLBA Safeguards Rule is the Federal Trade Commission’s data security rule for financial institutions that are not banks. It reaches far beyond lenders: tax preparers, auto dealers that arrange financing, collection agencies, mortgage brokers and many fintechs are in scope.
The rule was significantly strengthened in 2021, and a breach notification requirement was added in 2023. Both are now in force. This guide explains who is covered, what each element requires in practice, how the FTC notification works, and gives you a checklist to test your program against.
What is the GLBA Safeguards Rule?
The GLBA Safeguards Rule is a federal regulation, issued under the Gramm-Leach-Bliley Act, that requires covered financial institutions to develop, implement and maintain an information security program to protect customer information. The full text sits in 16 CFR Part 314 on the eCFR.
The program must be written, appropriate to your size and complexity, and cover administrative, technical and physical safeguards. The amended rule is fairly prescriptive, naming specific controls such as encryption and MFA.
A short timeline
- 2021: The FTC finalized a major update that added the detailed program elements found in section 314.4.
- 2023: On October 27, 2023, the FTC amended the rule to require breach reporting to the agency.
- 2024: Under section 314.5, the notification requirement in 314.4(j) took effect on May 13, 2024.
Who must comply with the Safeguards Rule?
The rule applies to “financial institutions” under FTC jurisdiction, meaning businesses significantly engaged in financial activities that are not regulated by a federal banking agency. Banks and credit unions follow separate interagency guidelines, and SEC-registered firms follow Regulation S-P.
The FTC’s business guidance on the Safeguards Rule gives examples of covered entities:
- Mortgage lenders and mortgage brokers
- Payday lenders and finance companies
- Check cashers and wire transferors
- Collection agencies and credit counselors
- Tax preparation firms
- Investment advisers that are not registered with the SEC
- “Finders” that bring together buyers and sellers of a product or service
Common mistake: Assuming you are out of scope because you do not call yourself a financial company. A car dealership that arranges loans, or a small accounting practice that prepares tax returns, can be a financial institution for the purposes of this rule.
Is there a small business exemption?
Partly. Under section 314.6, institutions that maintain customer information on fewer than 5,000 consumers are exempt from four requirements: the written risk assessment, continuous monitoring or periodic penetration testing and vulnerability assessments, the written incident response plan, and the annual report to the board. Everything else still applies, including encryption, MFA, access controls and vendor oversight.
What are the nine elements of the GLBA Safeguards Rule?
Section 314.4 lists the elements every program must include.
1. Designate a Qualified Individual
One person must oversee, implement and enforce the program. The Qualified Individual can be an employee, or work for an affiliate or service provider. If you outsource the role, you stay responsible for compliance, must designate a senior member of your staff to direct and oversee the provider, and must require the provider to maintain a compliant program.
2. Write a risk assessment
The risk assessment must be written and identify reasonably foreseeable internal and external risks to the security, confidentiality and integrity of customer information. It must include criteria for evaluating and categorizing risks, and you must reassess periodically. A structured risk management process makes this repeatable rather than a one-off document.
3. Design and implement safeguards
Section 314.4(c) names the controls:
- Access controls, limiting authorized users to the customer information they need
- An inventory of data, personnel, devices, systems and facilities
- Encryption of customer information in transit over external networks and at rest, unless the Qualified Individual approves effective alternative controls
- Secure development practices for in-house applications and procedures to test externally developed applications
- Multi-factor authentication for any individual accessing any information system
- Secure disposal of customer information no later than two years after it was last used to provide a product or service, unless a legitimate business or legal reason requires retention
- Change management procedures
- Monitoring and logging of authorized users’ activity and detection of unauthorized access
4. Monitor and test your safeguards
You must test the effectiveness of your controls. Unless you use continuous monitoring, the rule requires annual penetration testing and vulnerability assessments at least every six months, plus additional testing when material changes occur.
5. Train your staff
Provide security awareness training updated to reflect the risks identified in your risk assessment, and use qualified information security personnel to manage the program.
6. Oversee service providers
Select providers capable of maintaining appropriate safeguards, require those safeguards by contract, and periodically assess the providers based on their risk. A vendor and third-party risk management process gives you the evidence trail. See also our post on vendor risk as an executive liability.
7. Keep the program current
Adjust the program based on testing results, changes to your operations or business arrangements, and anything else that may materially affect it.
8. Maintain a written incident response plan
The plan must cover its goals, internal processes, clear roles and decision-making authority, internal and external communications, remediation of weaknesses, documentation and reporting of security events, and evaluation and revision of the plan after a security event.
9. Report to the board
The Qualified Individual must report in writing, regularly and at least annually, to the board of directors or equivalent governing body, or to a senior officer if there is no board. The report covers the overall status of the program and material matters such as risk assessment, risk management decisions, testing results, security events and recommended changes.
In practice: Build the annual board report from the same records you already keep for risk, testing and incidents. If the report takes weeks to assemble, the underlying program is probably not being run continuously.
If you want those records in one place rather than scattered across spreadsheets, you can start your 14-day free trial of Enactia and map your program to the rule’s elements.
How does the FTC breach notification requirement work?
If you discover a “notification event” involving at least 500 consumers, you must notify the FTC as soon as possible and no later than 30 days after discovery. The FTC confirmed in its May 2024 business blog that notices are filed through an online form.
A notification event is the acquisition of unencrypted customer information without the authorization of the individual it relates to. Unauthorized acquisition is presumed where there has been unauthorized access, unless you have reliable evidence that the information was not, or could not reasonably have been, acquired. Encrypted data is treated as unencrypted if the encryption key was also accessed.
The notice must include:
- The name and contact information of the reporting institution
- A description of the types of information involved
- The date or date range of the event, if known
- The number of consumers affected or potentially affected
- A general description of the event
- Whether a law enforcement official has requested a delay in public notice, and why
Common mistake: Treating the FTC notice as a replacement for state breach laws. State notification duties to consumers and state attorneys general run in parallel and have their own thresholds and deadlines. An incident and data breach management workflow should track every clock at once.
How does the Safeguards Rule compare with other US financial data rules?
Which rule applies depends on who regulates you.
| Rule | Who it covers | Breach notice |
|---|---|---|
| FTC Safeguards Rule (16 CFR 314) | Non-bank financial institutions under FTC jurisdiction | To the FTC within 30 days of discovery if 500+ consumers affected |
| Interagency Guidelines (banking agencies) | Banks, savings associations and other federally supervised depository institutions | Governed by the banking agencies’ own guidance and rules |
| SEC Regulation S-P (amended 2024) | Broker-dealers, investment companies, registered investment advisers, transfer agents | To affected individuals no later than 30 days after discovery |
The SEC adopted its Regulation S-P amendments on May 16, 2024, with an incident response program requirement and 30-day customer notice. Larger entities had to comply by December 3, 2025 and smaller entities by June 3, 2026, so both deadlines have now passed.
GLBA Safeguards Rule compliance checklist
Each line maps to a section of Part 314.
| Requirement | Evidence to keep | Section |
|---|---|---|
| Qualified Individual named | Board or owner designation, job description, oversight of any outsourced provider | 314.4(a) |
| Written risk assessment | Dated assessment with risk criteria, reassessment schedule | 314.4(b) |
| Access controls and inventory | Access reviews, data and asset inventory | 314.4(c)(1)-(2) |
| Encryption in transit and at rest | Configuration records, approved compensating controls | 314.4(c)(3) |
| MFA for all system access | MFA coverage report, approved exceptions | 314.4(c)(5) |
| Disposal within two years | Retention schedule, disposal logs | 314.4(c)(6) |
| Testing | Annual pen test, semiannual vulnerability scans, or continuous monitoring evidence | 314.4(d) |
| Training | Training records and content updates | 314.4(e) |
| Service provider oversight | Due diligence, contract clauses, periodic reviews | 314.4(f) |
| Incident response plan | Written plan, exercise records, post-incident reviews | 314.4(h) |
| Annual board report | Signed written report | 314.4(i) |
| FTC notification process | Procedure for 500+ consumer events, 30-day tracking | 314.4(j) |
In practice: Write your security policies so each one points to the element it satisfies. Policy management with version history also shows examiners that the program is kept current, which is element seven.
How can you reuse other frameworks for the Safeguards Rule?
The rule does not mandate a framework, but its elements line up closely with common ones:
- NIST CSF 2.0: The Govern function covers roles and board oversight, Identify covers inventory and risk assessment, and Protect covers access control, MFA and encryption. See our NIST Cybersecurity Framework page.
- ISO 27001 and SOC 2: Risk assessment, supplier management, incident management and management review map directly to several elements.
A cross-framework control mapping lets one piece of evidence, such as a penetration test report, count toward several obligations at once.
Key takeaways
- The GLBA Safeguards Rule covers many non-bank businesses, including tax preparers, auto dealers, mortgage brokers and collection agencies.
- The program has nine elements, with specific requirements such as MFA, encryption, annual penetration tests and semiannual vulnerability assessments.
- Since May 13, 2024, notification events affecting 500 or more consumers must be reported to the FTC within 30 days of discovery.
- Institutions with fewer than 5,000 consumers are exempt from only four requirements, not the whole rule.
- Mapping the rule to NIST CSF or ISO 27001 avoids duplicate work.
Frequently asked questions
What does the GLBA Safeguards Rule require?
It requires covered financial institutions to maintain a written information security program. The program must include a Qualified Individual, a written risk assessment, safeguards such as encryption and MFA, regular testing, staff training, service provider oversight, ongoing updates, a written incident response plan, an annual written board report and FTC notification of qualifying breaches involving at least 500 consumers.
When did the FTC breach notification requirement take effect?
The requirement in section 314.4(j) took effect on May 13, 2024. Since then, covered institutions must notify the FTC as soon as possible, and no later than 30 days after discovery, of any notification event involving unencrypted customer information of at least 500 consumers. Notices are submitted through the FTC’s online form.
Can the Qualified Individual be outsourced?
Yes. The Qualified Individual may be employed by you, an affiliate or a service provider. If you use a provider, you keep responsibility for compliance, must designate a senior staff member to direct and oversee the provider, and must require the provider to maintain an information security program that protects you in line with the rule.
Are small businesses exempt from the Safeguards Rule?
Not entirely. Institutions that hold customer information on fewer than 5,000 consumers do not need a written risk assessment, continuous monitoring or periodic testing, a written incident response plan or an annual board report. All other requirements, including encryption, multi-factor authentication, access controls, training and vendor oversight, still apply to them.
Does the Safeguards Rule apply to banks?
Generally no. The FTC rule applies to financial institutions under FTC jurisdiction, which are mainly non-bank businesses. Banks, savings associations and credit unions follow information security standards issued by their federal regulators, while SEC-registered broker-dealers and investment advisers follow Regulation S-P, which the SEC amended in 2024.
Next steps for Safeguards Rule compliance
The GLBA Safeguards Rule rewards organizations that run security as an ongoing program rather than an annual document exercise. Start by confirming whether you are a covered financial institution, name your Qualified Individual, and work through the checklist above. Close gaps in MFA, encryption and testing first.
Enactia’s AI-powered GRC platform brings risk assessments, vendor reviews, incidents and policies into one place and maps them across frameworks. To see how it fits your program, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
