Financial Services
GLBA
GLBA, the Gramm-Leach-Bliley Act, establishes federal privacy and safeguarding obligations for covered financial institutions and customer information.
GLBA, the Gramm-Leach-Bliley Act, establishes federal privacy and safeguarding obligations for covered financial institutions and customer information.
What GLBA means
GLBA, the Gramm-Leach-Bliley Act, establishes federal privacy and safeguarding obligations for covered financial institutions and customer information.
The law addresses privacy notices, certain information-sharing practices, and protection of nonpublic personal information. Regulatory responsibility varies by institution. The FTC Safeguards Rule applies to covered financial institutions under FTC jurisdiction and requires a written information-security program with administrative, technical, and physical safeguards.
How it works
A covered organization identifies customer information, assesses risk, defines safeguards, manages service providers, controls access, tests its program, and maintains incident and reporting procedures. Voice, transcriptTranscriptA transcript is the written record generated from a spoken conversation, typically showing what the caller and agent said during a call., CRMCRMA CRM is the system used to manage leads, contacts, accounts, opportunities, activity, ownership, and follow-up., and vendor data flows belong in that inventory.
Practical use cases
Protecting financial intake data in transcripts
Reviewing service providers that handle customer information
Applying retention and access controls to account workflows
GLBA compliance is organization-wide. A secure call platform does not compensate for uncontrolled exports, broad CRM access, unmanaged vendors, or weak incident procedures.
Frequently asked questions
Why does GLBA matter?
GLBA compliance is organization-wide. A secure call platform does not compensate for uncontrolled exports, broad CRM access, unmanaged vendors, or weak incident procedures.
Does GLBA apply only to banks?
No. Coverage can include other businesses significantly engaged in financial activities, but the applicable regulator and requirements depend on the entity and activity.
Source: FTC GLBA guidance.
Related concepts: piiPersonally Identifiable Information (PII)Personally identifiable information, or PII, is information that can distinguish or trace an individual’s identity alone or when combined with linked data., data retentionData retentionData retention defines how long recordings, transcripts, messages, personal data, and conversation metadata are kept before deletion or archival., crm integrationCRM integrationA CRM integration connects an agent or communications platform with a CRM so the systems can exchange records, events, and actions., account openingAccount openingAccount opening is the process of collecting, verifying, reviewing, and approving the information required to establish a financial account..