GLBA Safeguards Rule
CIPP/US glossary · Last reviewed: · By Victor Humenhuk (CIPP/US certified)
GLBA Safeguards Rule - The Gramm-Leach-Bliley Act rule requiring financial institutions to maintain an information security program, conduct risk assessments, and oversee service providers; applies to universities holding financial aid information.
In the CIPP/US body of knowledge, GLBA Safeguards Rule comes up under Chapter 10: Education Privacy; Chapter 4: Information Management and Privacy Risk Management; Chapter 7: State Data Breach Notification, Data Security, and Data Destruction Laws.
GLBA Safeguards Rule in context
- A documented inventory can ==reduce penalties== if a problem later occurs, and is legally required for entities under the ==GLBA Safeguards Rule==. (Data Inventory and Data Classification)
- Three exceptions excuse notice: an entity subject to a ==more stringent law== (e.g., ==HIPAA== or the ==GLBA Safeguards Rule==), an entity following its ==own compatible policy==, or data within the ==encryption safe harbor==. (Exceptions to Notification)
- The ==TaxSlayer== FTC matter shows how the [[GLBA Safeguards Rule]] and [[GLBA Privacy Rule]] apply to a single failure. (The FAST Act GLBA Annual-Notice Exception and the TaxSlayer Case)
Where GLBA Safeguards Rule is covered in the CIPP/US study notes
- Data Inventory and Data Classification
- Exceptions to Notification
- Cybersecurity Requirements in Education
- The FAST Act GLBA Annual-Notice Exception and the TaxSlayer Case
Related terms
- Data inventory
- Data classification
- Encryption safe harbor
- NIST Framework
- FAST Act
- GLBA Privacy Rule
Test yourself on GLBA Safeguards Rule
Recognising a definition is not the same as applying it in an exam scenario. Work through the free CIPP/US practice questions, or read the full CIPP/US study guide - every study note is free.