Privacy, Information Security, and Third-Party Risk: GLBA, Safeguards, and Vendor Oversight
This domain tests consumer privacy, information security, and third-party risk management. Expect questions on GLBA privacy notices, opt-out rights, safeguards, data disposal, identity theft red flags, incident response, and vendor contract controls.
Core rules
- Regulation P implements GLBA privacy requirements: initial and annual privacy notices, with exceptions, and opt-out rights when sharing nonpublic personal information with nonaffiliated third parties outside exceptions. The annual notice exception can apply if the bank shares only within GLBA exceptions and has not changed its practices.
- The Safeguards Rule requires a written information security program, risk assessment, access controls, encryption, vendor oversight, employee training, and incident response.
- Reg S-ID requires an identity theft prevention program with red flags, detection, response, and periodic updates.
- Data disposal rules require reasonable measures for consumer information.
- Third-party risk management covers due diligence, risk tiering, contract protections, ongoing monitoring, and termination or exit planning.
Worked example
A bank contracts with a fintech vendor that will process loan applications and store applicant tax returns. Before signing, the bank completes security due diligence, assigns a high risk tier, and requires contractual limits on data use, encryption, breach notification, audit rights, and return or destruction of data. After launch, the bank reviews the vendor’s SOC report and tracks open issues. Reasoning: the bank retains responsibility for safeguarding customer information even when a vendor performs the work.
Traps that cost marks
- Assuming every bank must send an annual privacy notice without checking the GLBA exception.
- Confusing opt-out with opt-in; opt-in is not the general GLBA privacy rule.
- Believing a vendor contract transfers regulatory responsibility to the vendor.
- Missing state breach notification duties or the bank’s incident response plan.
- Approving a critical vendor without ongoing monitoring or exit planning.
Exam focus
Ask three questions: what data is involved, who can access it, and what evidence shows the control worked.