The Gramm-Leach-Bliley Act Cybersecurity Considerations (And How They Apply to Businesses Besides Banks)

You don’t have to be a bank to be held responsible for protecting your customers’ financial data.

Many organizations collect customer financial information as part of normal business operations through a credit application, financing arrangement, tax return, student aid process, lease agreement or other customer transaction.

In some cases, those financial activities create obligations under the Gramm-Leach-Bliley Act (GLBA). While often associated with banks, the GLBA can also apply to other types of organizations that interact with this kind of customer financial information. And organizations that are subject to GLBA must account for how customer financial information is collected, stored, accessed and protected.

Which Organizations Besides Banks Must Comply With the Gramm-Leach-Bliley Act?

Organizations fall within the scope of the GLBA based on how they collect, process or use consumer financial information (not based on industry). Any entity that offers financial products or services to consumers, including lending money, taking deposits or selling insurance, must comply.

The GLBA can apply to organizations you may not traditionally think fall into the category of “financial institutions,” such as:

• Mortgage lenders
• Mortgage brokers
• Payday lenders
• Finance companies
• Account servicers
• Check cashing companies
• Wire transferors
• Collection agencies
• Credit counselors
• Other financial advisors even if they aren’t required to register with the SEC

Even institutions of higher education and automobile dealerships would be subject to these regulations.

Colleges and universities that process federal financial aid for students are subject to the Gramm-Leach-Bliley Act and have been advised by the Department of Education to consider implementing cybersecurity standards to help protect confidential information concerning applications for and receipt of Title IV student assistance.

Automobile dealerships may be subject to the provisions of the GLBA if they offer financing for vehicle purchases. It’s important to note that the exact applicability of the GLBA to automobile dealerships depends on the specific products and services offered and the jurisdictions in which they operate.

Tax preparers and accounting service providers also have separate data security responsibilities related to taxpayer information. IRS Publication 4557 emphasizes that protecting taxpayer data is required by law and outlines expectations for safeguarding client information, employee training, risk management and incident response. The publication also directs tax professionals to IRS Publication 5708, which provides guidance for developing a Written Information Security Plan (WISP). Organizations that prepare tax returns or handle taxpayer information should understand that these obligations exist alongside any GLBA requirements that may apply to their operations. Evaluating both frameworks can help ensure customer and taxpayer information is being protected appropriately.

Rent-to-own companies may also fall under this definition, as they provide consumer credit through lease agreements.

All of these organizations, much like the other more traditional financial institutions, must comply with the GLBA’s cybersecurity provisions. Applicability ultimately depends on the organization’s actual activities.

What Does the Gramm-Leach-Bliley Act Mean for My Company’s Cybersecurity?

The Gramm-Leach-Bliley Act outlines cybersecurity provisions (known as Privacy and Safeguards Rules) for protecting consumer financial information, such as:

• Implementing written information security plans and risk assessments
• Training employees on information security
• Safeguarding sensitive information through encryption and access control measures
• Providing annual privacy notices to their customers
• Describing their information-sharing practices

Your cybersecurity programs must encompass all systems, databases and processes that collect, process and distribute information, including Personally Identifiable Information (PII).

For organizations subject to the GLBA, the cybersecurity program should address the systems, databases, processes and third parties involved in collecting, storing, accessing, transmitting and disposing of customer financial information. GLBA compliance can affect employee access, vendor relationships, document retention, incident response, leadership oversight and the documentation available for regulatory review.

Organizations handling customer financial information should be able to confirm:

• What customer financial information is collected
• Where that information is stored
• Who has access to it
• Which third parties receive, process or store it
• Whether a Written Information Security Plan exists
• Whether risk assessments are completed and documented
• Whether employees are trained on the information they handle
• Whether vendor security responsibilities are documented
• Who is responsible for oversight

Gaps in these areas can indicate that customer financial information is moving through the business without clear ownership, current controls or sufficient documentation.

What Are the Penalties for Not Being in Compliance With the Gramm-Leach-Bliley Act’s Cybersecurity Provisions?

The consequences of not being compliant with the Gramm-Leach-Bliley Act can include fines, legal action and damage to a company’s reputation.

The Federal Trade Commission (FTC) is the primary enforcement agency for the GLBA and can take enforcement action against financial institutions that fail to comply with the provisions of the Act. The FTC has the authority to impose severe financial penalties per violation for companies that violate the GLBA.

In certain cases, individuals may be held accountable for GLBA compliance as part of their roles as company officers, directors or managers. In these cases, the regulatory agencies may take enforcement action against the individuals who participate in unfair or deceptive practices in connection with the provision of financial products or for failing to exercise sufficient oversight or control over the company’s compliance with the GLBA.

Finally, non-compliance with the GLBA cybersecurity provisions can result in damage to a company’s reputation and loss of customer trust, as customers may view the failure to protect their personal information as a breach of privacy and security. In today’s increasingly security-conscious business environment, these consequences can be significant and long-lasting.

Learn More About the Gramm-Leach-Bliley Act Cybersecurity Considerations for Businesses Besides Banks

While the Gramm-Leach-Bliley Act may be most commonly associated with banks, many other organizations that conduct certain financial activities are subject to its provisions.

It’s always critical to know your organization’s regulations and how to best adhere to them.

To learn more about the GLBA cybersecurity provisions and how your organization should respond to and implement them in your specific situation, reach out to your Warren Averett advisor, or ask a member of our team to reach out to you.

This article was originally published on February 13, 2023, and most recently updated on July 28, 2026.