Identify the customer information
Check the proposed extract for details unrelated to the provider’s assignment.
GLBA · Customer-information safeguards
GLBA safeguards for sharing customer information
Start with one service-provider request for customer information. Identify the fields required, the person approving disclosure and the safeguards your security program expects.
Assign release authority
Confirm who may approve the disclosure and who at the provider can receive it.
Test the approved safeguards
Use sample records to check identity verification, access duration and evidence.
Review a service-provider handoff
Map the request, approval, delivery and access review. Keep unresolved provider questions with the security program owner.
Before sharing
- Identify the information and its business purpose.
- Confirm the recipient and their authority.
- Check which documents are actually needed.
While work continues
- Reconsider access when responsibilities change.
- Review activity and investigate exceptions.
- Keep a named owner for the exchange.
When the task ends
- Remove access that is no longer justified.
- Apply the approved retention and disposal process.
- Confirm the handling of copies held by providers.
Put the exchange
inside your
security program.
The FTC Safeguards Rule requires covered institutions to maintain an information-security program. A file-sharing service forms only part of that assessment.
- People
- Define accountability, access approvals and staff training.
- Protection
- Evaluate encryption, authentication and controls against the identified risks.
- Providers
- Set contractual expectations and review whether providers can safeguard the information entrusted to them.
- Response
- Connect suspicious activity and incidents to the organization’s response process.
Ask better questions
of every provider.
Use a documented review to establish what the service does, where responsibilities sit and what evidence is available.
Bring a customer task.
Use sample data.
Walk through the handover with MX and your security team. Capture the control requirements before deciding whether the service fits your program.
Explore your access requirementsQuestions for
your review.
Does GLBA apply only to banks?
No. Coverage depends on the activities and applicable regulator. The FTC’s financial-institution definition includes several types of non-bank businesses.
Does this cover all GLBA obligations?
No. This page focuses on safeguarding customer information during file exchange. Privacy obligations and other regulatory requirements need separate consideration.
Does using MX establish GLBA compliance?
No. Your organization must assess applicable obligations, the complete security program and the service configuration. No blanket compliance claim is made here.
Who remains responsible when a provider handles the information?
Outsourcing a task does not remove the covered institution’s responsibilities. Define safeguards, contractual expectations and ongoing review with the provider.