GLBA Outsourcing
Definition
GLBA Outsourcing
GLBA outsourcing is the practice of a financial institution having a third party handle customer information covered by the Gramm-Leach-Bliley Act. The institution keeps the safeguards duty, and its contract must oblige the provider to protect that information too.
The Act sets the policy in plain terms. Every financial institution has an affirmative and continuing obligation to respect the privacy of its customers and to protect their nonpublic personal information.
That obligation does not thin out when the work moves — it follows the data into the provider’s environment and stays with the institution that sent it.
The reach is also wider than most firms assume. “Financial institution” covers mortgage brokers, motor vehicle dealers, payday lenders, tax preparers and collection agencies, not only banks.
Key takeaways
- The Safeguards Rule requires written contracts that spell out security expectations for providers.
- Service provider oversight is a continuing duty, not a one-off selection exercise.
- The definition of covered institution extends well beyond deposit-taking banks.
- A breach notification duty was added in 2023 and took effect in May 2024.
How it works
The Safeguards Rule requires a written information security programme with named elements, one of which deals specifically with suppliers. The rule treats provider selection, contracting and monitoring as three separate obligations rather than one.
A service provider is defined broadly. It is any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services to a covered institution.
Selection comes first — you must choose providers with the skills and experience to maintain appropriate safeguards, which means the assessment happens before the commercial decision rather than after it.
| Obligation | What it looks like in practice |
|---|---|
| Select | Documented diligence on the provider’s security capability |
| Contract | Written terms stating your security expectations |
| Monitor | Built-in mechanisms to observe the provider’s work |
| Reassess | Periodic review of whether the provider still fits |
| Notify | Reporting eligible breach events within the required window |
The contracting requirement is specific. Your contracts must spell out security expectations, build in ways to monitor the provider’s work, and provide for periodic reassessment of their suitability.
Enforcement sits in several places at once — the Federal Trade Commission covers institutions outside another regulator’s authority, while banking agencies handle the rest.
Examples
The rule bites hardest where firms did not think of themselves as financial institutions at all. Each case here started with somebody reading the rule after the contract was signed.
A regional lender sends loan servicing to an offshore provider. The master agreement carries the security expectations verbatim, and the lender reviews the provider’s testing results rather than its marketing deck.
A motor vehicle dealer group outsources finance and insurance paperwork. The group is a covered institution, a fact it discovered during an enforcement sweep rather than during procurement.
A tax preparation chain uses an offshore document processing centre. Because customer information leaves the country, the chain’s programme addresses access control, device restrictions and the handling of returned files.
A fintech lender relies on a single core platform vendor. Its periodic reassessment is contractual, scheduled and evidenced, because a provider that was suitable at signature may not be suitable three renewals later.
Related terms
Financial data obligations overlap heavily, and the wrong label leads to the wrong control set. Each entry here is adjacent, and confusing any two of them causes real problems.
- PCI DSS outsourcing: card data specifically, governed by a private standard rather than statute.
- HIPAA outsourcing: protected health information, with its own contracting instrument.
- CCPA outsourcing: the Californian consumer rights that reach data this Act does not.
- SOC 2 outsourcing: the assurance report buyers often accept as diligence evidence.
- Banking outsourcing: the wider practice this obligation sits inside.
- Compliance outsourcing: contracting the compliance function rather than the data handling.
- Vendor management outsourcing: the programme that operationalises all of the above.
FAQ
Who counts as a financial institution?
Any business significantly engaged in activities that are financial in nature. That sweeps in dealers, tax preparers, mortgage brokers and collection agencies alongside conventional lenders.
Does the rule require a specific contract template?
No. It requires that your contracts state security expectations, allow monitoring and provide for periodic reassessment. The drafting is yours.
Can we rely on a provider’s certification?
You can use it as evidence, not as a substitute for diligence. A certificate describes a scope somebody else chose, which may not match the work you are buying.
What changed in 2024?
A breach notification requirement took effect in May 2024, obliging covered institutions to report qualifying events. It added a reporting duty on top of the existing safeguards.
Does offshore processing need extra steps?
The rule does not prohibit it. It does make access control, monitoring and incident response harder to evidence, so those areas need more attention.
Who enforces this?
The Federal Trade Commission enforces against institutions outside another regulator’s authority, and the banking agencies enforce against the institutions they supervise.
Browse verified partners in the Outsource Accelerator directory and check which providers can evidence the controls you need.
Independent
