United States. Cybersecurity. Regulation
GLBA Safeguards RuleFTC Standards for Safeguarding Customer Information (Safeguards Rule), 16 C.F.R. Part 314
Partly verified
Medium confidence.dpo_required Conditional: a 'qualified individual' must oversee the security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
§1Summary
- Synopsis
Requires non-bank financial institutions under FTC jurisdiction to maintain a written information security program with a qualified individual, risk assessments, encryption, MFA and vendor oversight. Since May 2024 they must report qualifying security events to the FTC.
- Key themes
- Unique features
Prescriptive control list (MFA, encryption, penetration testing) unusual for US federal rules; notification goes to the FTC, not to individuals.
- SaaS relevance
Covers fintech, lenders, tax preparers and similar SaaS; service providers must be contractually required to maintain safeguards.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- FTC within 30 days of discovery where unencrypted data of 500+ consumers is acquired without authorisation
- DPO
- Conditional
- Cross-border transfers
- None
- Maximum penalty
- FTC civil penalties for rule violations (via order or rule enforcement)
§3Dates
- Key dates
- Adopted
- In force
- Major revision 2021 with most requirements effective 2023-06-09; notification amendment adopted 2023-10-27, effective 2024-05-13.
§4Text and authority
- Text
- Authoritative text ecfr.gov
- Authority
- Federal Trade Commission (FTC)
§5Where it applies
- Domestic law of
- United States
- Also applies in
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Guam
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- New York
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Puerto Rico
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- US Virgin Islands
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.dpo_required Conditional: a 'qualified individual' must oversee the security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.