GLBA, Financial privacy and customer data
16 CFR Part 314
- What this page is
- GLBA, Financial privacy and customer data
- Checked against the official source
- 2026-08-15Current
- Responsible publisher
- ExploreWorld Legal, editorial deskLiability position
Short answer
Does GLBA apply to your operation, and which paragraph decides?
GLBA rests on 16 CFR Part 314 and is tested here by a deterministic rule tree of 5 rules with a coverage score of 100 percent. The tree reads your facts, names the paragraph that decides the question and returns an outcome carrying citation, content hash and read date 2026-08-15. The outcome is a machine classification, not a compliance decision.
16 CFR Part 314Checked against the publisher 2026-08-15Official text
A source reference, not legal advice.
- Jurisdiction
- Federal
- Risk dimensions
- privacy, security, financial reporting
- Tier
- Tier 1
- Coverage
- 100 %
- Impact
- 5/5
- Read
- 2026-08-15
Source chain
Every block in the register row has its own address, so an outcome can be cited down to the paragraph. The node carries the reference, the scope, the link to the official text and the outcomes in the tree that rest on the block.
- Information security program
16 CFR 314.4(a)
A written programme with a named qualified individual responsible for it.
- Risk assessment
16 CFR 314.4(b)
Written assessment of foreseeable risks to customer information.
- Safeguards
16 CFR 314.4(c)
Access controls, encryption, multi-factor authentication, disposal and change management.
- Notification of a security event
16 CFR 314.5
Notice to the agency when unencrypted customer information of 500 or more consumers is acquired without authorisation.
Rule tree
Rules are tested top down. Conditions are statutory elements and each outcome points to the register blocks it rests on.
glba-program
The written information security program is absent
prohibited · Requirement applies · program
16 CFR 314.3(a) requires a written information security program appropriate to the size and complexity of the activity and the information handled.
glba-qualified
No qualified individual is designated
risk · Requirement applies · program, controls
16 CFR 314.4(a) requires designating a qualified individual responsible for the program, and 16 CFR 314.4(i) requires reporting to the board or equivalent.
glba-encryption
Encryption is required, or a documented equivalent control
risk · Requirement applies conditionally · controls
16 CFR 314.4(c)(3) requires encryption of customer information at rest and in transit, or an equivalent compensating control approved in writing by the qualified individual.
glba-small
The full rule applies, including risk assessment and incident response
risk · Requirement applies · risk-assessment, notification, controls
16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from certain parts. At 5,000 customers or more the written risk assessment in 16 CFR 314.4(b), the incident response plan in 314.4(h) and the board report in 314.4(i) also apply.
glba-base
The rule applies, with the exemption for smaller holdings
risk · Requirement applies conditionally · program, risk-assessment
16 CFR 314.1 states the scope for financial institutions under the Commission's jurisdiction. 16 CFR 314.6 exempts those maintaining information on fewer than 5,000 customers from parts of 314.4.
Outcome
allowed · Outside the scope
The rule yields no requirement for the facts supplied
No activity is stated to be financial under 16 CFR 314.1 and 16 CFR 314.2.
fallback · sha256:sha256:8a31c1c15cc39333fa03a89ba
Monitoring
The journal shows what moved in the register row, with the hash before and after. The impact score follows a rule stated in plain words.
How impact is scored: Grund: tillagd eller borttagen uppgift ger 3, ändrad uppgift 2, omläsning utan ändring 0. Tillägg: +1 när ändringen rör status eller tillämpningsdatum. Tillägg: +1 när agenten ligger i klass 1. Siffran begränsas till 0 till 5.
2026-08-15 · 0/5 · lasning
Raden läst mot den officiella publiceringen utan ändring
2023-06-09 · 4/5 · tillampningsdatum, status
Regeln började tillämpas enligt utgivaren
2021-12-09 · 5/5 · antagande, identifierare, status
Regeln antogs enligt 16 CFR Part 314
Supervision
European counterparts
- nis2-2022-2555 · Båda texterna kräver ett skriftligt säkerhetsprogram, en dokumenterad riskbedömning och anmälan av allvarliga incidenter. EU-texten gäller väsentliga verksamheter, den amerikanska regeln finansiella institut.
Artifacts and integrity
- https://legal.exploreworldai.com/api/public/v1/us-agents/glba/manifest.json
- https://legal.exploreworldai.com/api/public/v1/us-agents/glba/run
- https://legal.exploreworldai.com/api/public/v1/us-agents/glba/monitor.json
- sha256:3810851e37977f8637dece51a038643fbb7f777178da3128492e0a6203729d0d
- sha256:3d1a8b0a25f771aa833b3764d22468d59e410439b1113c204bb3c5c1eea20eaf
The verdict is a machine classification of the outcome, not legal advice and not a compliance decision. Responsibility position · 16 CFR Part 314
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act