GLBA Redaction: How to Protect Nonpublic Personal Information
The Gramm-Leach-Bliley Act (GLBA) is the reason your bank sends you an annual privacy notice, and the reason a loan officer's laptop is supposed to be encrypted. It also sets the closest thing U.S. law has to an official checklist for what counts as sensitive financial data. Whether you're a financial institution disposing of records or someone forwarding your own bank statement or tax return, GLBA's definition of "nonpublic personal information" is a useful, authoritative standard for deciding what to redact. This guide covers what GLBA actually requires, what counts as protected data, and how to redact financial documents so nothing recoverable is left behind.
Key takeaways
- GLBA's "financial institution" definition is broad: banks, credit unions, mortgage brokers, tax preparers, check-cashers, collection agencies, and car dealers that arrange financing are all covered, not just banks.
- Nonpublic personal information (NPI) covers anything a consumer provides on an application, anything generated by a transaction (balances, payment history), and anything else the institution collects about them — Social Security numbers, account and routing numbers, income, and credit history all qualify.
- The FTC's amended Safeguards Rule (16 CFR Part 314) requires covered institutions to dispose of customer information securely, generally no later than two years after it's last used, in a way it can't practicably be read or reconstructed.
- A black rectangle drawn over a PDF does not meet that "cannot be reconstructed" bar — the underlying text is usually still in the file and extractable with copy-paste.
- SladdPDF redacts and strips metadata locally in your browser, with no upload. Free with no page limit.
What GLBA is, and who it covers
The Gramm-Leach-Bliley Act of 1999 requires financial institutions to explain their information-sharing practices to customers and to safeguard sensitive data. Two rules do most of the work: the Privacy Rule (16 CFR Part 313), which governs when an institution can share a consumer's data and requires the privacy notices you get once a year, and the Safeguards Rule (16 CFR Part 314), which requires a written information security program.
"Financial institution" is defined far more broadly than most people assume. Under the FTC's rule it includes not just banks and credit unions, but mortgage lenders and brokers, payday lenders, check-cashing services, wire transfer services, debt collectors, tax preparation firms, career counselors who work with people in the finance industry, and auto dealers that arrange or extend financing. If an organization is "significantly engaged" in providing financial products or services to consumers, GLBA likely reaches it.
What counts as nonpublic personal information
GLBA's Privacy Rule defines nonpublic personal information (NPI) as personally identifiable financial information that falls into one of three buckets: information a consumer provides to get a financial product or service (an application, a loan form), information that results from a transaction with the institution (an account balance, a payment history), or information the institution otherwise obtains about the consumer in connection with providing a product or service. In practice that sweeps in Social Security numbers, account and routing numbers, income and assets, credit and payment history, and even the fact that someone is a customer of a particular institution at all.
That three-part definition is a useful yardstick even outside a compliance context. If a field on a bank statement, loan document, or tax record would fall under any of those three buckets, it's a reasonable candidate for redaction before you hand a copy to anyone who doesn't already have a right to it.
The Safeguards Rule's disposal requirement
The FTC significantly amended the Safeguards Rule in 2021, with most provisions taking full effect on June 9, 2023. The updated rule requires a covered institution's written security program to include specific technical controls: access controls, encryption of customer information at rest and in transit (or an equivalent compensating control), multi-factor authentication, activity logging, and a written incident-response plan.
One provision speaks directly to redaction. Under 16 CFR § 314.4(c)(6), the security program must include procedures for the secure disposal of customer information no later than two years after the last date it was used in connection with providing a product or service — unless retention is required by law or targeted disposal isn't reasonably feasible — and disposal must render the information unreadable and unable to be reconstructed. A related FTC rule, the Disposal Rule under the Fair and Accurate Credit Transactions Act (16 CFR Part 682), sets the same "cannot practicably be read or reconstructed" bar for anyone disposing of a consumer report or information derived from one.
What to redact from common financial documents
You don't have to be a bank to end up handling NPI-grade information. Loan officers assembling a file, HR staff verifying income for a mortgage reference, a landlord confirming a bank statement, or a small business owner sharing a tax record with a bookkeeper all touch documents that fall inside GLBA's three-part NPI definition. The table below applies that definition to the fields that actually show up on the documents people share most often.
| Field | Falls under NPI? | Redact before sharing? |
|---|---|---|
| Full Social Security number | Yes — provided by the consumer | Always, unless the recipient is the institution that issued the account |
| Bank account or routing number | Yes — results from the relationship | Redact all but the last four digits when identity confirmation is the only need |
| Account balance and transaction history | Yes — results from a transaction | Redact unrelated transactions; keep only what the request requires |
| Income and employment details | Yes — provided or obtained by the institution | Redact unless the recipient needs it to verify affordability or eligibility |
| Credit score or credit history | Yes — obtained about the consumer | Redact unless a lender specifically requested it |
| Institution's name and the fact of the relationship | Yes, technically | Usually fine to keep — it's rarely the sensitive part in practice |
Our guides to redacting a bank statement and redacting a tax return, W-2, or 1099 walk through these fields document by document. If the request is a formal subject-access or right-to-know request rather than an informal one, see our guides to GDPR redaction and CCPA/CPRA redaction, which cover the parallel EU and California frameworks.
A black box doesn't meet the "cannot be reconstructed" bar
Most PDF statements, loan documents, and tax forms carry a real, searchable text layer. A rectangle drawn over a field in a markup tool or an annotation app typically just sits on top of the page — the account number or SSN underneath is untouched in the file and can usually be lifted out with a simple copy-paste, or by deleting the annotation layer entirely. That is the opposite of "cannot practicably be read or reconstructed." Our explainer on why a black box is not redaction covers the mechanics of exactly what stays behind.
What actually satisfies that standard is either deleting the underlying text objects or rasterizing the page — flattening it to a fresh image with no text layer, no annotation objects, and no hidden data to recover. That's the approach covered in our guide to rasterization as the gold standard of PDF redaction, and it's what SladdPDF's Secure mode does automatically on export.
How to redact a financial document locally, step by step
Financial records are exactly the category of document that shouldn't be routed through an upload-based "free PDF redactor" — the file itself is what GLBA and the Disposal Rule are trying to protect. SladdPDF processes the file entirely on your device with JavaScript and WebAssembly; nothing is sent to a server, and it keeps working offline once the page has loaded.
- Open the document at sladdpdf.com. Load the bank statement, loan document, or tax form. The file stays on your device the entire time.
- Decide what the recipient actually needs. A balance, a date range, or proof of an account — work out the minimum before marking anything.
- Redact the SSN, full account numbers, and unrelated transactions. Leave the last four digits of an account number if the recipient needs to confirm it matches a named account.
- Check every page. Account numbers and routing numbers on multi-page statements typically repeat in a header or footer on every sheet.
- Export in Secure mode. Secure mode rasterizes each page to a flat image, destroying the text layer and any hidden objects underneath the redactions.
- Remove the metadata. Enable metadata removal on export so the author, title, and originating software are stripped from the file before you send it.
- Verify before sending. Open the exported PDF and try to select and copy text over the redacted areas. If nothing is selectable, the redaction held.
This article is general guidance, not legal advice. If you are a financial institution determining your own GLBA compliance obligations, consult your regulator's current guidance or counsel.
Redact financial documents without uploading them anywhere
SladdPDF runs 100% locally in your browser — the document never leaves your device. Free with no page limit; Pro unlocks 300 DPI export.
Redact a PDF nowFrequently asked questions
Does GLBA apply to me personally if I'm just forwarding my own bank statement?
No. GLBA's Privacy and Safeguards Rules bind financial institutions, not individual consumers sharing their own records. But the law's definition of nonpublic personal information, and its "cannot practicably be read or reconstructed" disposal standard, are useful benchmarks to hold yourself to whenever you redact a financial document before sending a copy to anyone.
What organizations count as a "financial institution" under GLBA?
The definition is broader than banks and credit unions. It also covers mortgage lenders and brokers, payday lenders, check-cashing and wire-transfer services, debt collectors, tax preparation firms, and car dealers that arrange or extend financing — essentially any business "significantly engaged" in providing financial products or services to consumers.
What does the Safeguards Rule require for disposing of financial records?
Under the FTC's amended Safeguards Rule (16 CFR § 314.4(c)(6)), a covered institution's security program must include secure disposal of customer information generally no later than two years after it was last used, in a manner that renders the information unreadable and unable to be reconstructed — unless retention is legally required or targeted disposal isn't feasible.
Is redacting a field with a black box in a PDF viewer good enough?
No. Drawing a rectangle over text in most PDF viewers or annotation tools leaves the underlying text object in the file, where it's often still selectable and extractable with copy-paste. Meeting a "cannot be reconstructed" standard requires either deleting the underlying data or rasterizing the page into a flat image with no text layer beneath the mark.
- Federal Trade Commission: Gramm-Leach-Bliley Act — ftc.gov
- Federal Trade Commission: Standards for Safeguarding Customer Information (Safeguards Rule) — ftc.gov
- Electronic Code of Federal Regulations: 16 CFR Part 314 (Safeguards Rule) — ecfr.gov
- Electronic Code of Federal Regulations: 16 CFR Part 313 (Privacy of Consumer Financial Information) — ecfr.gov
- Electronic Code of Federal Regulations: 16 CFR Part 682 (Disposal of Consumer Report Information, FACTA Disposal Rule) — ecfr.gov