FTC Safeguards Rule

FTC Standards for Safeguarding Customer Information, updated under the GLBA rulemaking authority (16 CFR Part 314) to require financial institutions to maintain a comprehensive information security program. Applies to a broad swath of "financial institutions" — not just banks — including lenders, brokerages, and personal-finance apps. Attention is triggered by gaps in the designated qualified individual office, by 30-day notification deadlines for unauthorized acquisitions affecting 500+ consumers, by missing annual reporting to the board, and by an absent written incident response plan.

/ftc-safeguards