Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
GLBA
Ley Gramm-Leach-Bliley y la Regla de Salvaguardas de la FTC
Avisos de privacidad y exclusiones voluntarias para el intercambio de información financiera de los clientes, y un programa de seguridad de la información con salvaguardas específicas conforme a la Safeguards Rule.
The law in brief
The Gramm-Leach-Bliley Act governs how financial institutions protect and share consumers' personal financial information. In practice it works through two rules: the Privacy Rule, on privacy notices and the right to opt out of certain sharing, and the Safeguards Rule, which requires a written information security program.
"Financial institution" reaches far beyond banks: mortgage brokers, lenders, tax preparers, car dealers that arrange financing and many others are covered, and for them the FTC's rules apply.
A quién se aplica
- Financial institutions: businesses significantly engaged in financial activities, such as lending, brokering, advising, insuring or collecting debt.
- Banks and credit unions follow their banking regulators' versions of the rules; most non-bank financial companies follow the FTC's.
- It covers nonpublic personal information about consumers and customers who obtain financial products or services for personal, family or household purposes.
What it requires
A written information security program
Develop, implement and maintain a written program with administrative, technical and physical safeguards appropriate to your size, complexity and the sensitivity of the customer information you hold.
The Safeguards Rule's required elements
Name a qualified individual, base safeguards on a written risk assessment, encrypt customer information, require multi-factor authentication, test continuously or through annual penetration tests and twice-yearly vulnerability scans, train staff, oversee service providers, keep an incident response plan, and report to the board at least annually.
Notify the FTC of security events
Tell the FTC as soon as possible, and no later than 30 days after discovery, of a security event in which unencrypted information of 500 or more consumers was acquired without authorization.
Privacy notices and opt-out
Give customers a clear privacy notice and, before sharing nonpublic personal information with nonaffiliated third parties outside the exceptions, a reasonable chance to opt out.
Derechos de las personas
Consumers get a privacy notice explaining what the institution collects and shares, and can opt out of sharing their nonpublic personal information with nonaffiliated third parties, subject to exceptions (Privacy Rule, Regulation P).
Enforcement and penalties
La aplican la FTC, la Oficina de Protección Financiera del Consumidor y los reguladores bancarios, mediante órdenes, programas de cumplimiento y, según el regulador y la infracción, sanciones civiles. Obtener información de clientes con pretextos falsos es un delito federal.
What to do first
- Confirm you are a financial institution and which regulator's rules apply to you.
- Name a qualified individual to run the information security program.
- Run a written risk assessment and build the controls in 16 CFR 314.4 on it.
- Turn on multi-factor authentication and encryption for customer information.
- Oversee service providers by contract and periodic assessment.
- Prepare to notify the FTC of qualifying security events within 30 days.
- Check your privacy notice and opt-out process under the Privacy Rule.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Novedades recientes
Aún no hay nada que informar. Regulatory Watch enumera las nuevas normas, medidas de cumplimiento y decisiones judiciales a medida que llegan.
Fuentes
- Normas de la FTC para la Protección de la Información de los Clientes (16 CFR Parte 314) eCFR · Texto oficial o regulador
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales