16 CFR §314.5 — Effective date (FTC GLBA Safeguards Rule)

glba-safeguards-16cfr-314-5

16 CFR §314.5 makes the FTC notification-event reporting obligation at §314.4(j) effective as of May 13, 2024.

Get this register: .xlsx .csv More bundles →

source:
  type: regulation
  id: glba-safeguards-16cfr-314.5
  authority: 16 CFR §314.5 — Effective date (FTC GLBA Safeguards Rule)
  description: |
    16 CFR §314.5 makes the FTC notification-event reporting obligation
    at §314.4(j) effective as of May 13, 2024.
obligations:
  - id: glba-safeguards-16cfr-314.5-ftc-notification-effective-2024-05-13
    canonical_id: glba-safeguards-16cfr-314.5-ftc-notification-effective-2024-05-13
    section: 16 CFR §314.5 — §314.4(j) FTC notification-event reporting effective May 13, 2024
    description: |
      The §314.4(j) FTC notification-event reporting requirement is in
      effect as of May 13, 2024. [LENDER] is therefore obligated to
      notify the Federal Trade Commission of any notification event
      involving the information of at least 500 consumers, as soon as
      possible and no later than 30 days after discovery, in accordance
      with §314.4(j).
    type: do
    audit_question: Has [LENDER] confirmed that, on and after May 13, 2024, its incident-response procedures include the §314.4(j) requirement to electronically notify the Federal Trade Commission within 30 days of discovering any notification event involving 500 or more consumers?
    program_review: Does the program account for the §314.4(j) requirement (in effect since May 13, 2024) — incident-response procedures that electronically notify the FTC as soon as possible and no later than 30 days after discovering any notification event involving at least 500 consumers?
    file_review: Review incident-response procedures for the §314.4(j) FTC-notification step; for any qualifying notification event, confirm FTC notice within 30 days of discovery.
    judgment: false
    feeds: []
    workflow_phase: governance
    owner_role: compliance_officer
    secondary_owner_role: information_security_officer
    cadence: per-incident
    consequence: ''
    tags:
      - round-b
      - regulator-direct
      - glba
      - safeguards-rule
      - ftc-notification
      - effective-date
      - promoted
    primary_source:
      tier: 1
      authority: 16 CFR §314.5
      source_class: ftc-safeguards-rule
      source_url: https://www.law.cornell.edu/cfr/text/16/314.5
      snapshot_id: 2489f1a1c5f13d5d
      fetched_at: '2026-05-24T00:44:13Z'
      content_hash: sha256:c0bf7b48c4e1d04b08fd60c1b610292966879550ac55788d3093133d2eb6f380
      paragraph_quote: Section 314.4(j) is effective as of May 13, 2024.
      drafter_attestation: |
        Copied verbatim from snapshot 2489f1a1c5f13d5d (content.txt) at
        2026-05-23T01:32Z. Substring is the full §314.5 operative
        effective-date statement.
    promoted_at: '2026-05-24T01:27:04+00:00'
    promoted_from: glba-safeguards-16cfr-314.5-roundb-v1.yaml
_promotion_history:
  - promoted_at: '2026-05-24T01:27:04+00:00'
    candidate_path: obligations\_remediation\_round_b_drafts\glba-safeguards-16cfr-314.5-roundb-v1.yaml
    candidates_promoted: 1
    candidates_skipped_existing: 0

Verbatim regulatory text (1)

Verbatim provisions from 16 CFR §314.5 — Effective date (FTC GLBA Safeguards Rule) — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.

16 CFR §314.5 — §314.4(j) FTC notification-event reporting effective May 13, 2024

Section 314.4(j) is effective as of May 13, 2024.

Source: 16 CFR §314.5 · source URL · snapshot 2489f1a1c5f13d5d