{
  "node_id": "us-glba-gramm-leach-bliley-act-1999",
  "title": "US Gramm-Leach-Bliley Act 1999 (GLBA) - Financial Privacy and Data Protection",
  "domain": "Banking & Global Finance",
  "version": "1.0.1",
  "last_updated": "2026-04-30",
  "bluf": "The Gramm-Leach-Bliley Act 1999 (GLBA, Pub.L. 106-102) requires financial institutions to protect consumers' nonpublic personal information (NPI). The Financial Privacy Rule (16 CFR Part 313) mandates annual privacy notices and opt-out rights for sharing NPI with nonaffiliated third parties. The Safeguards Rule (16 CFR Part 314), updated in 2023, requires a written information security program with specific technical controls including encryption, access controls, MFA, and penetration testing for covered financial institutions. The Pretexting Rule prohibits social engineering to obtain NPI.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "iso_standard",
      "eu_regulation",
      "us_equivalent",
      "uk_equivalent",
      "global_framework"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "us-bank-secrecy-act-31-cfr-1010-aml",
    "us-investment-advisers-act-1940",
    "us-investment-company-act-1940"
  ],
  "primary_citations_count": 5
}