What is GLBA?
Gramm-Leach-Bliley Act
Short answer
GLBA is the 1999 federal law that requires financial institutions, tax preparers included, to protect client information and explain how it is shared.
What it is
GLBA has two parts that reach a tax firm. The Privacy Rule requires a privacy notice telling clients what information is collected and shared, and an opt-out for sharing with nonaffiliated third parties outside the exceptions. The Safeguards Rule requires a written security program to protect that information. For non-bank preparers both are enforced by the Federal Trade Commission.
Because GLBA covers tax preparers, most state consumer privacy laws exempt the data that GLBA already governs. That exemption usually covers the client file but not everything a firm collects, such as website analytics.
Why it matters for a tax firm
GLBA is why a tax office has privacy and security duties even when no state law names it. It is also why some firms over-count their state-law exposure: GLBA data is exempt from most state privacy laws, other data is not.
Related terms
Read more on XyloDocs
Sources
Questions about GLBA
Does a tax firm have to send a GLBA privacy notice?
Tax preparers are financial institutions under GLBA and the FTC Privacy Rule applies. Whether an annual notice is required depends on the firm's sharing practices; many firms give one at the start of each engagement.
Are state privacy laws on top of GLBA?
Most state laws exempt data already regulated by GLBA, so the client tax file is usually outside them. Data that is not GLBA data, like marketing lists or web analytics, can still fall under state law.
Last reviewed: October 16, 2026. This glossary explains terms; it is not legal or tax advice. Check the cited source for the current rule.
Stop chasing documents and status calls
XyloDocs is the AI client communication platform for tax firms: bilingual calls and texts, document intake over WhatsApp and email, and status updates clients read before they phone.