GLBA Safeguards Rule
16 CFR Part 314 · Read 2026-08-15
In force. The amended rule applies in full, including the notification duty added in 2023.
Identifier
- Identifier
- 16 CFR Part 314
- Level
- Federal
- Status
- In force
- Adopted
- 2021-12-09
- Applies from
- 2023-06-09
- Supervisory bodies
- FTC
Named requirements
Information security program
A written programme with a named qualified individual responsible for it.
Risk assessment
Written assessment of foreseeable risks to customer information.
Safeguards
Access controls, encryption, multi-factor authentication, disposal and change management.
Notification of a security event
Notice to the agency when unencrypted customer information of 500 or more consumers is acquired without authorisation.
Official source
EU acts on the same ground
- CELEX 32022L2555
Both texts require a written security programme, a documented risk assessment and notice of significant incidents. The EU text covers essential entities, the US rule covers financial institutions.
United States case law
20 decisions · Read from CourtListener, Free Law Project on 2026-08-22.
- Trump v. Slaughter
SCOTUSFinal, the decision cannot be appealed
- Christine McGoveran v. Amazon Web Services Inc
3rd Cir.Open to review by a higher court, the source does not state the outcome
- United States v. David Paitsel
D.C. Cir.Open to review by a higher court, the source does not state the outcome
- Victor Sasay v. Attorney General United States
13 F.4th 2913rd Cir.Open to review by a higher court, the source does not state the outcome
- Brendan Holbein v. Baxter Chrysler Jeep, Inc.
983 F.3d 10498th Cir.Open to review by a higher court, the source does not state the outcome
- Brendan Holbein v. Baxter Chrysler Jeep, Inc.
8th Cir.Open to review by a higher court, the source does not state the outcome
- Donald J. Trump v. Deutsche Bank AG
943 F.3d 6272d Cir.Open to review by a higher court, the source does not state the outcome
- Kidd v. Thomson Reuters Corp.
925 F.3d 992d Cir.Open to review by a higher court, the source does not state the outcome
- Mehrbach v. Citibank, N.A.
316 F. Supp. 3d 264D.C. Cir.Open to review by a higher court, the source does not state the outcome
- Bean LLC v. John Doe Bank
291 F. Supp. 3d 34D.C. Cir.Open to review by a higher court, the source does not state the outcome
- Leland Stevens v. Interactive Financial Advisors
830 F.3d 7357th Cir.Open to review by a higher court, the source does not state the outcome
- Federal Trade Commission v. Wyndham Worldwide Corp.
799 F.3d 2363rd Cir.Open to review by a higher court, the source does not state the outcome
Change monitoring
The row is re-read against the publisher's own publication on a fixed interval. The dates below can be checked on the spot and travel with the API response.
| Field | Value |
|---|---|
| Register | FTC — 16 CFR Part 314 |
| Publisher | U.S. Federal Trade Commission |
| Last read | 2026-08-15 |
| Interval | Every 30 days |
| Next re-read | 2026-09-14 |
| Status | Checked against the publisher |
Row history
Dated events concerning this exact row, newest first. No event appears here without a date in a primary source.
| Date | Event | Source |
|---|---|---|
| 2026-08-15 | Row read against the official publication | U.S. Federal Trade Commission |
| 2023-06-09 | Date of application according to the publisher | U.S. Federal Trade Commission |
| 2021-12-09 | Adopted under 16 CFR Part 314 | U.S. Federal Trade Commission |
Monitoring states when the row was checked, not how the legal position should be assessed.
Cite this row
The string below travels with a memo, a case file or an agent chain. The same string sits in the citation field of the API response.
16 CFR Part 314, GLBA Safeguards Rule. ExploreWorld Legal, https://legal.exploreworldai.com/us/regler/glba-safeguards-rule (hämtad 2026-08-25, bevis sha256:45574f77705ec182, bygge legal-2026-08-25).
- sha256:
- 45574f77705ec1826affb039c830016be79da3e60e60873ef6f250786367a474
- hämtad:
- 2026-08-25
- source_confidence:
- official
- bygge:
- legal-2026-08-25
Official publication. The address points to the authority or court that published the row. Office of the Federal Register, eCFR.
The row is a source reference with an official identifier. No legal advice and no compliance decision.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act