Does GLBA cover business customers' data, and what can a lender license?

Does the GLBA Privacy Rule protect business customers?

Generally no. The Gramm-Leach-Bliley Act's privacy provisions are built around consumers, meaning individuals who obtain financial products or services for personal, family or household purposes. A company borrowing for working capital, factoring invoices or paying suppliers through a B2B payments platform is not that kind of consumer. That does not make a lender's or payments firm's data free to license, because other rules, contracts and individuals inside business accounts still matter.

The FTC's GLBA business guidance describes the Privacy Rule (notices about information-sharing practices and opt-out rights before sharing with certain nonaffiliated third parties) and the Safeguards Rule (a written information security program). Which agency's rules apply depends on the type of financial institution, so counsel should confirm the exact regulator and text.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

What counts as a "consumer" and what does not?

The table lists questions to ask, not conclusions. Edge cases are common in small-business lending, where owners put up personal credit.

Does the Safeguards Rule change the answer?

It changes the security obligations, not the consumer definition, and the rule protects "customer information", which is itself framed around individuals, so counsel should confirm whether business-account data falls inside it. The FTC's Safeguards Rule guide says covered financial institutions must develop, implement and maintain an information security program with administrative, technical and physical safeguards, and the definition of financial institution includes many non-bank businesses. The regulation, 16 CFR Part 314, requires elements such as a designated Qualified Individual, encryption of customer information in transit over external networks and at rest, and a written incident response plan.

For a licensing project, a covered company should be able to show that preparing and moving a dataset fits inside its security program. Our sibling guide on the FTC Safeguards Rule for CPA firms walks through that in practice for professional-services records.

What could a commercial lender or B2B payments firm license?

The categories below are what AI buyers tend to ask about; each needs the company's own rights and privacy review.

• Underwriting workflow records. Credit memos, approval chains, exceptions and outcomes, with applicant details masked.
• Operations records. Servicing tickets, collections notes, document checklists and escalation paths.
• Process documentation. Policies, SOPs, training material and QA reviews.
• Aggregated performance data. Portfolio-level summaries with no borrower linkage.

What is usually off the table without careful clearance is raw loan files, bank statements, tax returns and anything personal to a guarantor.

Other limits that apply even if GLBA does not

1. State privacy laws. Some state laws regulate personal information of individuals in business contexts and have their own GLBA-related exemptions. The does the CCPA apply to my business page explains one example. Exemption scope is narrow and varies, so counsel must read it.
2. Customer contracts. Loan agreements, platform terms and NDAs often restrict use of customer information. Read them before assuming rights.
3. Customer-owned data. Documents a client uploaded may belong to the client. See how to distinguish company data from data owned by its customers.
4. Privacy-policy promises. The FTC has said that promises not to use customer data for undisclosed purposes are enforceable, as in its staff post on confidentiality commitments. That post is staff guidance, not a rule.
5. Residual knowledge. Contract terms such as a residuals clause govern what a buyer may retain mentally or in models, which matters when data includes customer information.

What should a referral partner say?

Partners make introductions and give basic fit information only. They never see loan files or customer records, and they do not tell an owner that GLBA "does not apply".

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward is paid only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed. Licensed professionals should check their own rules on referral fees and disclosure.

Next step

Check whether the lender or payments firm meets the baseline with the company fit checker, then register as a partner to introduce it. The company can also apply at sourcex.si/apply.