Definition
Gramm-Leach-Bliley Act (GLBA)
Federal privacy and data-security law requiring financial institutions to explain their information-sharing practices and safeguard customer information. In securities exams, GLBA usually appears through SEC Regulation S-P, which governs nonpublic personal information, initial and annual privacy notices, opt-out rights before certain sharing with nonaffiliated third parties, and written safeguards for customer records.
An investment adviser sends a privacy notice at account opening explaining what nonpublic personal information it collects, when it may share that information with nonaffiliated third parties, how the client can opt out of certain sharing, and how the firm protects client records.
Students often mix up GLBA with AML rules. GLBA and Regulation S-P are about customer privacy, nonpublic personal information, privacy notices, opt-out rights, and information safeguards; AML is Bank Secrecy Act and FinCEN driven and focuses on suspicious activity, CIP, SARs, and money laundering controls.
How is Gramm-Leach-Bliley Act (GLBA) tested on the exam?
- Recognizing GLBA as the statutory foundation for SEC Regulation S-P privacy rules
- Identifying nonpublic personal information and when clients receive privacy notices
- Applying the opt-out rule before certain sharing with nonaffiliated third parties
- Distinguishing GLBA privacy and safeguard duties from AML, CIP, SAR, and CTR rules
- Understanding that firms must maintain written policies and procedures to safeguard customer information
Regulatory limits
Regulatory Limits
| Description | Limit | Notes |
|---|---|---|
| Initial privacy notice | At or before customer relationship begins | The notice explains what nonpublic personal information is collected, how it is shared, and how the customer can exercise any opt-out rights. |
| Annual privacy notice | Annually, unless a statutory no-change exception applies | Annual delivery is a classic exam point, but firms may qualify for an exception when privacy practices have not changed and certain sharing conditions are met. |
| Opt-out right | Before covered sharing with nonaffiliated third parties | The customer must receive notice and a reasonable opportunity to opt out before covered information sharing, unless an exception applies. |
| Safeguards requirement | Written policies and procedures | SEC registrants must reasonably protect customer records and information against unauthorized access or use. |
GLBA = Guard, List, Block: Guard customer information with safeguards, List privacy practices in notices, and let customers Block certain third-party sharing through opt-out rights.
Practice questions
Test your understanding with the questions below. Pick an answer to reveal the explanation.
A registered investment adviser wants to share a new client's nonpublic personal information with a nonaffiliated marketing company. Under GLBA and Regulation S-P, what must generally happen before that sharing occurs?
B is correct. GLBA and SEC Regulation S-P generally require a privacy notice and a reasonable opportunity to opt out before a firm shares nonpublic personal information with a nonaffiliated third party, unless an exception applies.
A is incorrect because opening an account does not waive privacy rights. C confuses privacy rules with AML reporting. D overstates the rule because the securities-exam framework is generally opt-out, not opt-in, for covered third-party sharing.
Privacy questions often test the opt-out mechanism. Students who assume written opt-in is always required, or who confuse privacy with AML, miss an easy regulatory point.
SEC Regulation S-P is best described as the SEC rule that implements which federal law for broker-dealers, investment advisers, and registered investment companies?
B is correct. Regulation S-P is the SEC privacy rule that implements the privacy provisions of the Gramm-Leach-Bliley Act for SEC-regulated financial institutions.
A is incorrect because the Bank Secrecy Act is the foundation for AML obligations. C relates to SIPC customer protection, not privacy notices. D relates mainly to public-company governance and auditing, not customer privacy notices.
Exams often ask for the legal source of a rule. GLBA equals privacy and safeguards; BSA equals AML.
Which of the following is least likely to be a GLBA or Regulation S-P requirement?
D is correct. SAR filing is an AML requirement, not a GLBA privacy requirement. GLBA and Regulation S-P focus on privacy notices, opt-out rights, nonpublic personal information, and safeguards for customer information.
A, B, and C are core GLBA or Regulation S-P concepts.
Negative-stem questions often test whether you can separate privacy rules from AML rules. GLBA does not create SAR filing thresholds.
A firm gives customers a privacy notice when the account relationship begins. Which statement about future delivery is most accurate under GLBA and Regulation S-P?
C is correct. GLBA privacy rules generally require an initial privacy notice and an annual privacy notice, although firms may qualify for a statutory no-change exception in certain circumstances.
A ignores the annual-notice framework. B invents a monthly delivery rule. D is incorrect because delivery is not triggered only by complaints.
Initial versus annual notice timing is a recurring exam pattern, especially when paired with the no-change exception.
Which firm practice best reflects the GLBA safeguards requirement as applied through Regulation S-P?
A is correct. The safeguards requirement expects written policies and procedures reasonably designed to protect customer records and information.
B is too informal and leaves privacy protection to individual judgment. C misunderstands record and compliance obligations. D ignores the privacy notice, opt-out, and vendor-control concepts that can apply to information sharing.
GLBA is not only about notices. Exams also test the firm-level duty to safeguard customer information through written controls.
What concepts relate to Gramm-Leach-Bliley Act (GLBA)?
This term is part of these clusters :
Where does Gramm-Leach-Bliley Act (GLBA) appear on the Series 6 exam?
This term is tested in the following FINRA Series 6 topic areas: