A question that comes up often: are the Gramm-Leach-Bliley Act (GLBA) and the General Data Protection Regulation (GDPR) similar enough that the same layered controls can satisfy both? GDPR is often understood to set a higher bar around a narrower definition of protected data, which raises a real question: do FFIEC data protection requirements extend as fully to confidential PII as they do to the narrower data type GDPR calls out?

Comparing GLBA and GDPR is useful because both address the same underlying challenge: privacy and security, specifically protecting information shared between a customer and a service provider. GLBA applies specifically to financial institutions, while GDPR defines a “data processor” as any third party that processes personal data, a broader scope. Even so, the two define protected data in strikingly similar terms. GDPR’s “personal data” covers any information that relates to an individual who can be directly or indirectly identified, and GLBA’s term for the same concept is non-public personal information, or NPI.

So, are the two similar enough to use the same layered controls? Yes. Layered controls are a sound risk mitigation strategy regardless of which regulation is in play, which means the same approach applies equally to both.

The more important distinction is structural. GLBA splits into two sections: 501(a), which establishes the right to privacy and requires you to protect the security and confidentiality of customer NPI, and 501(b), which gives regulators authority to require safeguards against threats to that NPI. Put simply, 501(a) is the what, and 501(b) is the how. That “how” is where the 12 FFIEC IT Examination Handbooks, cybersecurity regulations, penetration tests, and IT audits all come from, with more guidance arriving every year.

GDPR runs the opposite direction. It focuses heavily on the what, what a third party can and can’t do with customer data, and what control the customer retains, including the right to have their data deleted, while saying much less about the how.

GLBA’s scope, and the information security standards built on it, is limited strictly to customer NPI. It doesn’t extend to confidential data or PII more broadly. One distinguishing factor: in U.S. regulations, NPI always refers to a “customer,” while PII refers to a “consumer,” even though there’s rarely any real difference between data you obtain from a customer versus a consumer in the course of pursuing or maintaining a business relationship. From a data classification standpoint, NPI and confidential PII data carry the same level of sensitivity, even though guidance technically concerns itself only with customer NPI. GDPR doesn’t draw that same distinction.

Federal regulation is likely headed toward merging NPI and PII treatment altogether, and some states have already gotten there. So while protecting anything beyond NPI isn’t strictly required of you yet, it’s a sound move regardless, and classifying NPI and PII/confidential data at the same sensitivity level accomplishes exactly that.

One last note on enforcement: there’s little indication so far of U.S. regulators checking domestic financial institutions for GDPR compliance specifically. Still, your own EU exposure, however limited, is worth weighing on its own terms.