The Gramm‑Leach‑Bliley Act (GLBA) is a federal privacy and data‑security law enacted in 1999 that requires financial institutions to:
- Explain how they collect, use, and share consumer financial information,
- Give consumers the right to opt out of certain data sharing, and
- Implement administrative, technical, and physical safeguards to protect customer information.
According to the Federal Trade Commission, the GLBA requires financial institutions to disclose their information‑sharing practices and safeguard sensitive data. The law also mandates compliance with the Privacy Rule, which limits when institutions may disclose nonpublic personal information (NPI) and requires clear privacy notices and opt‑out rights. The Safeguards Rule (16 CFR Part 314) further requires institutions to maintain reasonable administrative, technical, and physical protections for customer information.

