GLBA nonpublic personal information, and where it hides in financial files

Under the Gramm-Leach-Bliley Act, nonpublic personal information (NPI) is the personally identifiable financial information a financial institution gets from or about a consumer: anything on an application, the account and payment history that follows, information from a credit report and even the fact that the person is a customer. A list of consumers drawn from that information counts too, even if it holds only names and addresses. Publicly available information, and blind data with no names, account numbers or addresses, does not.

Account numbers are the obvious part. Most of what the definition covers sits in loan files, servicing notes and letters, where it reads as ordinary prose.

What counts as nonpublic personal information

The definitions are in 12 CFR 1016.3, the CFPB's Regulation P, which fills out the statute's definition with examples.

Only consumers are covered: people who get a financial product for personal, family or household use, including applicants who are turned down. Business accounts fall outside the rule. Certain auto dealers follow the FTC's version of the rule instead, and firms regulated by the SEC or CFTC follow those agencies' rules.

Public information, lists and blind data

Three parts of the definition decide most hard cases.

• Public information stops being public on a customer list. Information is public if the institution has a reasonable basis to believe it's lawfully available from government records, widely distributed media or required disclosures, like a mortgage in the land records. The same names and addresses on a list derived from account data are NPI.
• Being a customer is NPI. So is any information disclosed in a way that shows someone is a customer. A letter headed "Re: Rosa Martinez, mortgage customer" discloses NPI without a single number in it.
• Blind data isn't NPI. Aggregate figures, or blind data without names, account numbers or addresses, don't identify a consumer. Redaction is one way a document gets there.

When NPI can leave the institution

Before sharing NPI with a nonaffiliated third party, an institution must give the consumer a privacy notice and a chance to opt out (15 U.S.C. 6802). Exceptions cover most of the documents that leave a lender. Without an opt-out, a file can go to a contracted service provider or to auditors, attorneys and regulators. It can also go wherever it's needed to process or service the consumer's own transactions, or to sell the loan. A recipient under an exception may use the information only for the purpose it was shared for. Card, deposit and transaction account numbers have a stricter rule: under 12 CFR 1016.12, they can't go to an outside company for telemarketing, direct mail or email marketing, with narrow exceptions.

For non-bank institutions under the FTC, such as mortgage brokers, tax preparers and collection agencies, the Safeguards Rule adds duties that cover paper records too. Customer information must be disposed of no later than two years after it was last used for the customer, unless the business still needs it, the law requires keeping it or targeted disposal isn't feasible. If unencrypted information about 500 or more consumers is acquired without authorization, the FTC must be told within 30 days of discovery; it received about 163 such notices in 2025.

Where NPI hides in financial files

The Uniform Residential Loan Application, the mortgage form Fannie Mae and Freddie Mac publish, shows how much one file collects. It asks for the borrower's Social Security number, date of birth and marital status, the ages of dependents, employers and monthly income, every bank and retirement account with its number and value, any bankruptcy or foreclosure in the past seven years and every debt with its balance. All of it is NPI from the moment it's submitted, and the documents behind it repeat much of it.

Pay stubs, tax returns and statements

Underwriting adds the proof: pay stubs, W-2s, tax returns and bank statements, which arrive as scans and phone photos. A photographed pay stub reading "Fairway Market" and "Gross pay $2,240.00" is just an image until OCR reads it.

Collection and servicing notes

Information gathered while collecting or servicing a loan is one of the rule's named examples, and agents record it in free text: "Called 3/14. Hours cut at Fairway Market, says she can pay $200 Friday." No field label marks it as financial information.

Letters and emails that reveal a customer

Referral thank-yous, appraisal orders and vendor emails often name the customer and little else: "Rosa Martinez closed on her refinance last week." The sentence is NPI because of what it says about her relationship with the lender.

Customer lists and credit notes

A spreadsheet of names and mailing addresses sent to a print vendor looks harmless, but if it was pulled from the account system, it is NPI. Information from a consumer report stays NPI when it's copied into an underwriter's note: "FICO 702, DTI 41%, two late payments in 2024".

The file itself

Document properties, comments, form fields and attachments can keep a borrower's name and loan number after the page is clean.

A checklist before a file leaves the institution

• The recipient falls under an exception, such as a contracted service provider or an auditor, or the consumer had notice and a chance to opt out.
• Names, addresses and account, loan and routing numbers are gone for every borrower and co-borrower, unless the recipient needs them.
• Nothing left in the text shows that a person is a customer.
• Balances, income, credit scores and payment history are removed, or reduced to aggregates that identify no one.
• Scanned pay stubs, tax returns and statements have been read by OCR.
• Servicing and collection notes have been read in full, not only their labeled fields.
• No account number is going to another company for marketing.
• Redacted text is removed, not covered, and document properties, comments, attachments and form fields are clean.

Where DocArmor fits

DocArmor's Financial Identifiers (PCI / GLBA) template covers account holders' names, bank, loan and mortgage numbers and routing codes, along with personal balances, income and credit scores. Context-aware detection tells a customer's balance from a published interest rate, and a plain-English instruction adds what an application carries beyond the template, such as dependents' ages. OCR reads scanned pay stubs and statements, and every finding goes to a reviewer. Redacted content is removed and checked on every page, with metadata, attachments and form values stripped, because data only counts as blind once the identifiers are really gone.

This post is general information about the Gramm-Leach-Bliley Act and its rules, not legal advice. Check which rules apply to you, state privacy laws included, with counsel and your regulator.