{"object_type":"business_agent","schema_version":1,"title":"FTC Safeguards Rule notification event","core":{"id":"agent:us:business:glba-safeguards-notice","jurisdiction":"us","domain":"financial","question":"Must a non-bank financial firm report a data breach to the FTC?","affected_business":["Financial services firm"],"applies_when":"Financial institutions under FTC jurisdiction, after unauthorized acquisition of unencrypted information of at least 500 consumers.","decision":"Yes, a notification event must be reported to the FTC.","obligation":"Maintain an information security program and notify the FTC of qualifying events through its online form.","action":["Maintain the written security program","Assess the event against the 500-consumer threshold","Notify the FTC","Document the response"],"deadline":"As soon as possible and no later than 30 days after discovery.","sources":[{"provision":"16 CFR 314.4(j)","url":"https://www.ecfr.gov/current/title-16/section-314.4"}],"read_at":"2026-10-15"},"sha256":"f36e21f4ef283db712c3e9cf55a6f406cf4cdd2cf47a719e274ad1e03545efd8","fields":["affected_business","decision","obligation","risk","action","deadline","verification"],"affected_business":["Financial services firm"],"applies_when":"Financial institutions under FTC jurisdiction, after unauthorized acquisition of unencrypted information of at least 500 consumers.","decision":"Yes, a notification event must be reported to the FTC.","obligation":"Maintain an information security program and notify the FTC of qualifying events through its online form.","risk":{"risk_level":"not_in_register","risk_factors":[]},"action":["Maintain the written security program","Assess the event against the 500-consumer threshold","Notify the FTC","Document the response"],"deadline":"As soon as possible and no later than 30 days after discovery.","verification":{"sha256":"f36e21f4ef283db712c3e9cf55a6f406cf4cdd2cf47a719e274ad1e03545efd8","read_at":"2026-10-15","sources":["https://www.ecfr.gov/current/title-16/section-314.4"],"source":"Source: NovaCopilot"},"next_questions":["When must a listed company disclose a cyber incident?","What must a financial entity report after a major ICT incident?","What is needed before offering a crypto-asset to the public in the EU?","Do I need a licence to provide crypto-asset services in the EU?","What is required to issue an asset-referenced token in the EU?"],"related":[{"id":"agent:eu:business:aml-customer-due-diligence","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:aml-customer-due-diligence"},{"id":"agent:eu:business:aml-suspicious-transaction-report","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:aml-suspicious-transaction-report"},{"id":"agent:eu:business:dora-ict-incident","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:dora-ict-incident"},{"id":"agent:eu:business:mica-asset-referenced-token","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-asset-referenced-token"},{"id":"agent:eu:business:mica-casp-authorisation","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-casp-authorisation"},{"id":"agent:eu:business:mica-e-money-token","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-e-money-token"},{"id":"agent:eu:business:mica-white-paper","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:eu:business:mica-white-paper"},{"id":"agent:us:business:sec-cyber-incident","type":"business_agent","url":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent:us:business:sec-cyber-incident"},{"id":"case_kit:us:ftc:equifax-2019","type":"case_kit","url":"https://legal.exploreworldai.com/api/public/v1/case-kit?id=case_kit%3Aus%3Aftc%3Aequifax-2019"}],"related_count":9,"page":"https://legal.exploreworldai.com/en/business-agents/us-glba-safeguards-notice","version":"f36e21f4ef283db7","updated_at":"2026-10-15","first_published":"2026-10-14","changes_url":"https://legal.exploreworldai.com/api/public/v1/business-agent-changes","note":"Not legal advice. Verify each answer against the cited provision. Missing facts are not_in_register.","attribution":"Source: NovaCopilot","versions":{"model":"1.0","agent_version":"3715eabbc2033c07","risk_version":"ce4f350740d6638f","decision_version":"6ddeec87edb350ff","package_version":"25e3777775c02d5a","change_score":0,"changed_dimensions":[],"changed_at":"2026-10-14","verified_at":"2026-10-15","next_check":"2026-10-22","is_current":true,"supersedes":[],"verify_url":"https://legal.exploreworldai.com/api/public/v1/versions/verify?id=agent%3Aus%3Abusiness%3Aglba-safeguards-notice","changes_url":"https://legal.exploreworldai.com/api/public/v1/living-versions","note":"change_score measures freshness only, never ranking.","impact":"not_in_register"},"withheld":{"links_full":9,"risk_model":3},"access":{"status":"partner_key_required","header":"x-partner-key","contact":"https://legal.exploreworldai.com/kontakt","note":"Facts and counts are public. Relationships and decision paths stay inside NovaCopilot."},"access_class":"decision","access_view":"public","freshness":{"freshness_class":"live","as_of":"2026-11-04T14:43:50.991Z","valid_for":3600,"recheck":"https://legal.exploreworldai.com/api/public/v1/business-agent?id=agent%3Aus%3Abusiness%3Aglba-safeguards-notice","note":"Kontrollera mot recheck efter valid_for sekunder. If-None-Match ger 304 när inget ändrats.","tokens":1579}}