The FTC Safeguards Rule turns the Gramm-Leach-Bliley Act's general duty to protect customer data into specific controls, including MFA for anyone accessing any information system, encryption, a named Qualified Individual and a 30-day breach report to the FTC. It applies to a wide range of non-bank financial institutions, from mortgage brokers and payday lenders to tax preparers and car dealers that arrange financing, many of which do not think of themselves as regulated. The 2021 amendments became enforceable on 9 June 2023 and the notification requirement on 13 May 2024. This guide explains how the Safeguards Rule differs from the GLBA Privacy Rule and the pretexting provisions, walks through each element of 16 CFR 314.4, and sets out a practical programme, metrics and evidence. It is written for security leads, compliance teams and the Qualified Individuals who report to the board.
Key takeaways
- GLBA has three separate parts. The Privacy Rule governs notices and sharing, the Safeguards Rule governs security, and the pretexting provisions make it unlawful to obtain customer information by deception.
- The Safeguards Rule is prescriptive. Section 314.4 sets nine programme elements and eight specific safeguards, including MFA, encryption in transit and at rest, change management and logging of user activity.
- One person is accountable. A Qualified Individual oversees the programme and reports in writing to the board at least annually, even when the role is outsourced.
- 500 consumers, 30 days. Unauthorised acquisition of unencrypted customer information about at least 500 consumers must be reported to the FTC no later than 30 days after discovery.
- Small institutions get partial relief. Below 5,000 consumers, the written risk assessment, testing, incident response plan and board report requirements do not apply, but the rest of the rule does.
GLBA in three parts: Safeguards Rule, Privacy Rule and pretexting
Title V of the Gramm-Leach-Bliley Act (GLBA) is often treated as one obligation. It is three, with different regulators and different failure modes.
| Part | Where it lives | What it requires | Typical owner |
|---|---|---|---|
| Safeguards Rule | 16 CFR Part 314 (FTC), implementing GLBA sections 501 and 505(b)(2) | A written information security programme with administrative, technical and physical safeguards for customer information | CISO or Qualified Individual |
| Privacy Rule | Regulation P, 12 CFR Part 1016 (CFPB); FTC Privacy Rule, 16 CFR Part 313, for certain motor vehicle dealers | Privacy notices, opt-out rights before sharing NPI with nonaffiliated third parties, limits on reuse, a ban on sharing account numbers for marketing | Privacy or compliance team |
| Pretexting provisions | 15 U.S.C. 6821 | Prohibit obtaining customer information by false statements to an institution or its customers, or with forged or stolen documents, and soliciting others to do so | Fraud, contact centre and security teams |
Key terms
- Nonpublic personal information (NPI): "personally identifiable financial information", plus lists derived from it, that is not publicly available. FTC guidance gives "the fact that an individual is your consumer or customer, account numbers, payment history" as examples.
- Consumer and customer: a consumer obtains a financial product or service for personal, family or household purposes; a customer is "a consumer who has a customer relationship with you", meaning a continuing relationship. The Safeguards Rule protects customer information; its notification and exemption thresholds count consumers.
- Customer information: any record containing NPI about a customer, in any form, held by or for the institution.
Privacy Rule duties in brief
- Initial privacy notice: "not later than when you establish a customer relationship" and, for non-customer consumers, before NPI is shared with nonaffiliated third parties (12 CFR 1016.4).
- Annual notice: during the relationship, unless the 1016.5(e) exception applies: the institution shares NPI only under the service provider, processing and legal exceptions (1016.13 to 1016.15) and has not changed its disclosure practices.
- Opt-out: a reasonable opportunity and reasonable means to opt out before sharing with nonaffiliated third parties; the FTC gives 30 days as an example period. An opt-out can be made "at any time" and lasts until revoked.
- Account numbers: may not be shared for marketing, even if the consumer has not opted out.
For the wider consumer privacy picture see the Global Privacy Regulatory Map.
Who the Safeguards Rule covers
The Safeguards Rule applies to the handling of customer information by financial institutions over which the FTC has rulemaking authority under GLBA section 501(b); institutions such as banks fall under their own regulators' safeguards standards instead. FTC guidance lists mortgage lenders, payday lenders, finance companies, mortgage brokers, account servicers, check cashers, wire transferors, collection agencies, credit counsellors, tax preparers and some credit unions and investment advisers. The 2021 amendments added finders, companies that bring together buyers and sellers of a product or service.
Auto dealers
The definition of financial institution in 314.2 expressly includes auto dealers that lease vehicles for terms of at least 90 days. FTC Privacy Rule FAQs treat dealers as covered when they extend credit for personal vehicle purchases, arrange financing or leasing, or give financial advice, and when they keep or assign retail installment contracts. Cash buyers and customers who bring their own financing fall outside. Many dealers hold Social Security numbers, credit reports and bank details for every financed sale, which makes the dealer management system, credit application portals and finance staff mailboxes the core of the programme. Regulation P does not apply to these dealers; the FTC's own Privacy Rule in 16 CFR Part 313 does.
The GLBA exemption in state privacy laws
State comprehensive privacy laws carve out GLBA in different ways. Virginia exempts any "financial institution or data subject to Title V of the federal Gramm-Leach-Bliley Act" (Va. Code 59.1-576(B)). California's CCPA instead exempts personal information collected, processed, sold or disclosed subject to GLBA (Civ. Code 1798.145(e)), and states that "This subdivision shall not apply to Section 1798.150", so the private right of action for data breaches still reaches GLBA data. An institution can therefore be outside one state law entirely and inside another for non-GLBA data such as marketing or employee records. See the US State Privacy Laws Guide.
The information security programme: 314.4(a) to (i)
Section 314.3 requires a "comprehensive" written programme with safeguards appropriate to the institution's size, complexity, activities and data sensitivity. Section 314.4 sets the elements.
| Element | Requirement | Evidence to keep |
|---|---|---|
| (a) Qualified Individual | Designate one person to oversee, implement and enforce the programme; may be an employee, affiliate or service provider, but if outsourced the institution keeps responsibility, names a senior staff overseer and requires the provider to run a compliant programme | Appointment record, outsourcing contract |
| (b) Risk assessment | Written, with criteria for evaluating and categorising risks, assessing confidentiality, integrity and availability and control adequacy, and how risks are mitigated or accepted; reassessed periodically | Dated assessment, risk register |
| (c) Safeguards | Eight specific controls (next section) | Configuration and coverage evidence |
| (d) Testing and monitoring | Regular testing or monitoring of key controls; continuous monitoring, or annual penetration testing plus vulnerability assessments at least every six months and after material changes | Test reports, scan history |
| (e) Personnel | Security awareness training updated for identified risks; qualified security staff with ongoing training | Training records |
| (f) Service providers | Select capable providers, require safeguards by contract, assess them periodically based on risk | Due diligence files, contracts, reassessments |
| (g) Adjustment | Update the programme after testing, material changes or new risks | Change log of the programme |
| (h) Incident response plan | Written plan covering goals, internal processes, roles and decision authority, communications, remediation, documentation and reporting, and post-incident review | Plan, exercise reports |
| (i) Board report | The Qualified Individual reports in writing at least annually to the board or, if none, a senior officer, on overall status and compliance, plus material matters such as risk decisions, service provider arrangements, test results, security events and recommended changes | Board papers, minutes |
The eight safeguards in 314.4(c)
- Access controls: authenticate authorised users and limit each to the customer information needed for their role. See the Access Reviews Guide.
- Inventory: identify and manage the data, personnel, devices, systems and facilities that enable business purposes, according to their relative importance to business objectives and risk strategy.
- Encryption: encrypt customer information held or transmitted, both in transit over external networks and at rest. Where infeasible, use compensating controls reviewed and approved by the Qualified Individual. See the Encryption Guide.
- Secure development: secure development practices for in-house applications and procedures for evaluating externally developed ones.
- MFA: "for any individual accessing any information system", unless the Qualified Individual approves reasonably equivalent or more secure controls in writing. MFA means at least two of knowledge, possession and inherence factors. See the MFA Guide.
- Disposal: securely dispose of customer information no later than two years after its last use for a product or service, unless it is necessary for business operations or other legitimate purposes, required by law, or targeted disposal is not reasonably feasible because of how it is maintained; review retention policy periodically.
- Change management: adopt change management procedures.
- Monitoring and logging: implement policies and controls to monitor and log the activity of authorised users and detect unauthorised access, use or tampering. See the Log Management and Retention Guide.
"Information system" is defined broadly and includes connected specialised systems such as environmental controls, so the MFA and logging duties reach more than the core lending platform.
Where identity fits
The MFA requirement is written for individuals, but service providers, integrations and scripts also reach customer information through API keys, service accounts and shared vendor logins. Those credentials fall under the access control, inventory, logging and service provider elements: give each integration its own scoped credential, store it in a vault, rotate it, and remove it when the contract ends. Vendor staff logging in to your systems are individuals and need MFA. See the Third-Party Access Guide and the API Key Management Guide.
FTC notification events: 314.4(j)
A notification event is the acquisition of unencrypted customer information without the authorisation of the individual it relates to. Unauthorised access is presumed to be acquisition "unless you have reliable evidence showing" that acquisition did not occur or could not reasonably have occurred. Encrypted information counts as unencrypted if "the encryption key was accessed by an unauthorized person".
| Element | Detail |
|---|---|
| Threshold | A notification event involving the information of at least 500 consumers |
| Deadline | As soon as possible, and no later than 30 days after discovery |
| When discovered | The first day the event is known to the institution, including when known to any employee, officer or agent other than the person who committed it |
| How | Electronically through the FTC's online Safeguards Rule form; the FTC warns "Your report may be made public" |
| Content | Institution name and contact details; types of information involved; dates or date range if determinable; number of consumers affected or potentially affected; a general description; whether law enforcement requested a delay of public notice |
| Law enforcement delay | Up to 30 days on a law enforcement request, extendable by up to 60 more days on a further written request |
This is a regulator notice only. Consumer notification still follows state breach laws, which have their own thresholds and timings. See the Data Breach Notification Checklist.
Key dates for the amended rule
| Date | Event |
|---|---|
| October 2021 | FTC approves the amended Safeguards Rule |
| 9 December 2021 | Amended rule published (86 FR 70272) |
| 9 December 2022 | Original compliance date for the new elements, extended by the FTC in November 2022 |
| 9 June 2023 | Compliance date for 314.4(a), (b)(1), (c)(1) to (8), (d)(2), (e), (f)(3), (h) and (i) |
| October 2023 | FTC announces the notification amendment |
| 13 May 2024 | 314.4(j) FTC notification requirement takes effect |
Building the programme step by step
- Confirm coverage and the consumer count. Decide whether you are a financial institution under FTC jurisdiction and whether you hold information on fewer than 5,000 consumers, and record the reasoning.
- Appoint the Qualified Individual. The FTC notes the person "doesn't need a particular degree or title", but needs authority. If outsourced, name the internal senior overseer.
- Map customer information. Inventory systems, devices, people, providers and paper stores holding NPI, including the dealer or loan origination system, document management, email and backups.
- Write the risk assessment with explicit criteria, and decide which risks to mitigate or accept.
- Deploy MFA and encryption first. Start with remote access, email and cloud applications, then every remaining system. Pilot with a small group, use report-only or audit mode where the identity platform offers it, keep monitored break-glass access, and document any Qualified Individual approved alternative.
- Turn on logging of user activity for systems holding customer information, and route alerts somewhere that is watched.
- Choose a testing model: continuous monitoring, or annual penetration tests and six-monthly vulnerability assessments.
- Bring service providers under contract and schedule risk-based reassessments.
- Write and exercise the incident response plan, including the 30-day FTC report decision.
- Deliver the first written board report and set the annual cycle.
Decision guidance
- Continuous monitoring or periodic testing: the rule does not define continuous monitoring, so if you rely on it, document what is monitored, how often and how gaps are detected. Most smaller institutions find the annual penetration test plus six-monthly scans easier to evidence; larger ones with mature vulnerability management often meet both.
- In-house or outsourced Qualified Individual: outsourcing to a managed provider is permitted and common for dealers and small lenders, but accountability stays with the institution and the provider's own programme becomes part of your evidence.
- Under 5,000 consumers: 314.6 removes the written risk assessment, (d)(2) testing, the incident response plan and the board report. MFA, encryption, access controls, disposal, training, service provider oversight and FTC notification still apply.
- Compensating controls: allowed for encryption and MFA with written approval. Treat them as time-bound for legacy systems, because they will be the first thing questioned after an incident.
Measuring the programme
- MFA coverage: percentage of individuals and information systems holding customer information enforcing MFA.
- Encryption coverage: percentage of customer information stores encrypted at rest, with approved exceptions listed.
- Disposal compliance: volume of customer records past the two-year post-use point not justified by a documented exception.
- Service provider assessments: percentage of providers with access to customer information reassessed on schedule.
- Remediation age: days open for critical and high findings from tests and scans.
- Logging coverage: percentage of in-scope systems sending user activity logs to monitoring.
Framework mapping
| 16 CFR 314.4 | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 | ISO/IEC 27001:2022 Annex A | CIS Controls v8.1 |
|---|---|---|---|---|
| (b) Risk assessment | ID.RA | RA-3 | Clause 6.1.2 | n/a |
| (c)(1) Access controls | PR.AA-05 | AC-2, AC-6 | A.5.15, A.5.18 | 5, 6 |
| (c)(2) Inventory | ID.AM | CM-8 | A.5.9 | 1, 2, 3 |
| (c)(3) Encryption | PR.DS-01, PR.DS-02 | SC-8, SC-28 | A.8.24 | 3.10, 3.11 |
| (c)(5) MFA | PR.AA-03 | IA-2(1), IA-2(2) | A.8.5 | 6.3, 6.4, 6.5 |
| (c)(6) Disposal | PR.DS | MP-6, SI-12 | A.8.10 | 3.5 |
| (c)(8) Logging | DE.CM | AU-2, AU-6 | A.8.15, A.8.16 | 8 |
| (f) Service providers | GV.SC | SA-9, SR-6 | A.5.19 to A.5.22 | 15 |
| (h) Incident response | RS.MA | IR-4, IR-8 | A.5.24 to A.5.26 | 17 |
For financial sector identity controls beyond GLBA see the Financial Services Identity Security Guide.
Common failure patterns
- Assuming GLBA is only for banks: tax preparers, dealers and finders often discover they are covered after an incident.
- MFA everywhere except the vendor portal: the Snowflake breach showed stolen credentials working against cloud tenants without MFA, and the Scania insurance portal breach came through an IT partner's infostealer-stolen login.
- Encryption at rest with the key alongside: data is treated as unencrypted for notification if the key was accessed. The Capital One breach shows how over-privileged cloud credentials can read storage regardless of encryption.
- Keeping everything forever: the two-year disposal rule is ignored, so a breach exposes years of closed accounts.
- Running the 30-day clock from the forensic report: discovery is when any non-involved employee or agent knows, not when the investigation ends.
- Treating the Privacy Rule notice as the whole of GLBA: a compliant privacy notice says nothing about security controls.
Practitioner checklist
- Document FTC jurisdiction, financial institution status and the consumer count.
- Appoint a Qualified Individual with authority and, if outsourced, a named senior overseer.
- Write a criteria-based risk assessment and reassess it periodically.
- Enforce MFA for every individual on every information system, with written approval for any alternative.
- Encrypt customer information in transit over external networks and at rest, and protect the keys.
- Log authorised user activity on systems holding customer information and review the alerts.
- Dispose of customer information within two years of last use unless an exception is documented.
- Contract for and periodically reassess every service provider with access to customer information.
- Exercise the incident response plan, including the 500-consumer, 30-day FTC report.
- Deliver the Qualified Individual's written report to the board at least annually.
Standards and references
- eCFR: 16 CFR Part 314, Standards for Safeguarding Customer Information
- FTC: FTC Safeguards Rule, What Your Business Needs to Know
- FTC: Safeguards Rule Notification Requirement Now in Effect
- Federal Register: Standards for Safeguarding Customer Information, Delay of Effective Date
- eCFR: 12 CFR Part 1016, Privacy of Consumer Financial Information (Regulation P)
- Cornell LII: 15 U.S.C. 6821, Privacy Protection for Customer Information of Financial Institutions
- FTC: The FTC's Privacy Rule and Auto Dealers, FAQs
- FTC: Gramm-Leach-Bliley Act
Related NHI Mgmt Group resources: Financial Services Identity Security Guide · Global Privacy Regulatory Map · Global Cybersecurity Regulatory Map · Third-Party Risk Management Guide · US State Privacy Laws Guide. This guide summarises the GLBA Safeguards Rule, Privacy Rule and pretexting provisions as of 18 October 2026, and is not legal advice.