GLBA

GLBA has two parts that matter day to day. The Privacy Rule requires clear notices about information sharing and an opt-out for certain disclosures. The Safeguards Rule requires an information security program with administrative, technical and physical safeguards. Banks are supervised by their banking regulators; the FTC covers non-bank institutions such as dealers, lenders and advisors.

For a growing financial firm the law follows the customer data into every system: the CRM, the phone recordings, the video meetings with clients and the vendors behind them. Adding an AI agent that answers client calls means adding a service provider who must be vetted and bound by contract.

Ask vendors how they protect nonpublic personal information at rest and in transit, who can access it, how they support your vendor-oversight duties and whether they will sign safeguards terms. Ask your compliance officer which regulator supervises you, because the detailed expectations differ. This entry is a definition, not legal advice.