United States (federal)

GLBA

27 controls. 106 other frameworks in our corpus share controls with it. Here is all of it, and how much of it you are already doing.

Page built . This page is derived from the framework corpus, which changes when the corpus is extended rather than daily.

27 controls 106 frameworks share controls with it United States (federal) verified against its source document

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

Every control

CodeControlAlso in
GLBA-2024-2025-Pipeline-Section-1033-AIGLBA 2024-2025 Pipeline - SEC Reg S-P, CFPB Section 1033, NAIC AI Bulletin0
GLBA-Coordination-FCRA-HIPAA-CCPA-SectoralGLBA Coordination with FCRA, ECOA, HIPAA, CCPA, State Privacy Laws and Sectoral Frameworks0
GLBA-Crosswalk-Subordinate-Substantive-RulesGLBA Crosswalk to FTC Safeguards Rule, FTC Privacy Rule, SEC Reg S-P, Interagency Guidelines, NAIC Model Law0
GLBA-Implementation-Roadmap-ExaminationGLBA Implementation Roadmap, Examination Readiness, Roles and Tooling39
GLBA-Scope-FinancialInstitution-NPI-DefsGLBA Scope, Financial Institution + Nonpublic Personal Information Definitions0
GLBA-Sec6801-PolicyDuty-SafeguardingStandardGLBA Section 6801 - Privacy Obligation Policy and Safeguarding Standard68
GLBA-Sec6802-6803-Disclosure-Notice-OptOutGLBA Section 6802-6803 - Disclosure Limits, Privacy Notice and Opt-Out0
GLBA-Sec6804-6805-Rulemaking-EnforcementGLBA Section 6804-6805 - Rulemaking Authority and Enforcement Mechanism0
GLBA-Sec6821-Pretexting-Prohibition-CriminalGLBA Section 6821 + 6823 - Pretexting Prohibition and Criminal Penalties0
GLBA-Sectoral-Higher-Ed-Insurance-BankingGLBA Sectoral Application: Banking, Securities, Insurance, Non-Bank, Higher Education0
GLBA-Status-FTC-CFPB-SEC-NAIC-EnforcementGLBA Status, Enforcement Activity, FTC + CFPB + SEC + NAIC Recent Actions39
GLBA-Subordinate-Rules-OperationalisationGLBA Operationalisation through FTC Safeguards Rule, Privacy Rule, SEC Reg S-P and Banking-Agency Guidelines65
501(a)Sec. 501(a) (15 U.S.C. 6801(a)) Privacy obligation policy0
501(b)Sec. 501(b) (15 U.S.C. 6801(b)) Safeguards standard: security and confidentiality, anticipated threats, unauthorised access0
502(a)Sec. 502(a) (15 U.S.C. 6802(a)) No disclosure to nonaffiliated third parties without a compliant notice0
502(b)(1)Sec. 502(b)(1) (15 U.S.C. 6802(b)(1)) Opt-out before disclosure to nonaffiliated third parties0
502(b)(2)Sec. 502(b)(2) (15 U.S.C. 6802(b)(2)) Service provider and joint marketing exception with disclosure and a confidentiality contract0
502(c)Sec. 502(c) (15 U.S.C. 6802(c)) Limits on reuse by the receiving third party0
502(d)Sec. 502(d) (15 U.S.C. 6802(d)) No sharing of account numbers for marketing0
502(e)Sec. 502(e) (15 U.S.C. 6802(e)) General exceptions to the notice and opt-out requirements0
503(a)Sec. 503(a) (15 U.S.C. 6803(a)) Initial and annual privacy notice0
503(b)Sec. 503(b) (15 U.S.C. 6803(b)) Contents of the privacy notice0
504-510Sec. 504-510 (15 U.S.C. 6804 to 6809 and 6801 note) Rulemaking, enforcement, relation to other laws, study, definitions and effective date0
521(a)Sec. 521(a) (15 U.S.C. 6821(a)) Prohibition on obtaining customer information by false pretences0
521(b)Sec. 521(b) (15 U.S.C. 6821(b)) Prohibition on soliciting another to obtain customer information by false pretences0
522-527Sec. 522-527 (15 U.S.C. 6822 to 6827) Enforcement, criminal penalty, state laws, agency guidance, reports and definitions of Subtitle B0
ACTThe Gramm-Leach-Bliley Act, Title V: structure, implementing rules and amendments0

Tell me when GLBA files something new

One email when a public company newly discloses something this framework governs, naming the company and what our corpus says it puts in scope. Nothing else, and one click to stop.

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

  • Pipeline tracking + impact assessment
  • Pipeline-tracking + implementation plan per rule
  • SEC Reg S-P readiness 2025-2026
  • Section 1033 readiness 2026-2030
  • NY DFS + NAIC AI compliance
  • International framework alignment
  • Role inventory + RACI
  • Metrics + management review
  • Operational controls + tooling investment
  • Examination response procedures

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

What this page is

A control-level reference for GLBA, drawn from our framework corpus. Control codes and titles are references to the standard, not reproductions of it. The overlap counts and the auditor artefacts are our own work and are the part you will not find elsewhere.

Measure this against what you already run · All frameworks · Today's edition