United StatesGLBA Safeguards Rule Breach Notification Amendment
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- none
What it requires
- Notify the FTC within 30 days of discovering a security event that has compromised unencrypted customer information for 500 or more consumers.
These lines are LexLint's reading of the law's text. Also read by: Federal Trade Commission (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
- Guidance body
- Federal Trade Commission
- Open questions
- Does a security event whose number of affected consumers is not yet known "involve the information of at least 500 consumers" under 16 CFR 314.4(j)(1)?
What it makes you log
Logging duty
Paragraph (j) requires a notice to the Commission, on an electronic form, within 30 days of discovering a notification event that involves the information of at least 500 consumers; the notice carries the items paragraph (j)(1) lists and no log or record is kept for it. Other paragraphs of section 314.4 do carry records and reports (a system activity monitoring and logging control in (c)(8), a written incident response plan that addresses documentation of security events in (h), and a written annual report to the board in (i)).
- Kind
- None
- As of
What this law does
Requires a financial institution covered by the FTC's Safeguards Rule to notify the FTC as soon as possible, and no later than 30 days after discovery, of a security event involving unauthorized acquisition of unencrypted customer information affecting 500 or more consumers. The notification requirement in Section 314.4(j) took effect on , per 16 CFR 314.5's own effective-date provision.
When LexLint raises it
When your app profile says your app provides financial services.
Back to the example · Lint your app
Page updated .