The Gramm-Leach-Bliley Act has governed financial-services data protection since 1999, but the operational text most ITAD programs cite, the Safeguards Rule, looked very different in 2003 than it does in 2026. The FTC’s 2021 amendments (effective June 9, 2023) overhauled the prescriptive requirements. A 2023 supplemental amendment (effective May 13, 2024) added a breach-notification trigger. Federal banking regulators have aligned their examination expectations through the parallel Interagency Guidelines under 12 CFR. GLBA Safeguards Rule disposal obligations are now meaningfully different than they were when most bank ITAD program documentation was last refreshed.
This is the companion guide to our broader Financial Data Disposal Risk and Regulatory Penalties pillar. Where that piece quantifies the enforcement exposure, this article focuses on what the 2021 and 2023 amendments specifically changed for the disposal-program documentation, vendor oversight, and incident-response language that examiners now look for.
A note on scope before we begin. The amended Safeguards Rule at 16 CFR Part 314 directly applies to non-banking financial institutions under FTC jurisdiction (mortgage brokers, finance companies, auto dealers offering financing, investment advisers not registered with the SEC). Banks, credit unions, and federal savings associations are governed by the parallel Interagency Guidelines under 12 CFR (Part 30 Appendix B for OCC, Part 364 Appendix B for FDIC, Part 748 Appendix A for NCUA). The Interagency Guidelines were not amended in 2021 or 2023, but FFIEC examination expectations have evolved in parallel. Banks with affiliated non-bank entities under FTC jurisdiction are subject to both regimes simultaneously.
What Did the 2021 Amendments Actually Change?
The 2021 amendments transformed the Safeguards Rule from a flexible standard into a prescriptive program. Nine specific elements at 16 CFR §314.4 now define what a compliant information security program must contain. Five of those elements have direct implications for ITAD documentation.
Qualified Individual designation. Under §314.4(a), the institution must designate a single Qualified Individual responsible for overseeing and enforcing the information security program. The role can be held by an employee, an affiliate, or a service provider, but accountability stays with the institution. For ITAD purposes, disposal program ownership is no longer “the IT director, probably.” The Qualified Individual is the named accountable party for vendor oversight, sanitization documentation, and incident escalation.
Written risk assessment. §314.4(b) requires a written risk assessment with criteria for evaluating risks, criteria for assessing existing safeguards, and requirements for how risks will be mitigated. The disposal phase is one of the foreseeable risks. ITAD-specific entries covering vendor concentration, transit risk, sanitization-method adequacy, and chain-of-custody documentation are now expected line items, not implicit ones.
Disposal procedures and retention review. §314.4(c)(6)(i) requires institutions to develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used for the customer relationship, with limited exceptions for legitimate business purposes or legal retention requirements. §314.4(c)(6)(ii) adds a periodic data-retention-policy review to minimize unnecessary retention. The two-year disposal default is the part most institutions have not internalized; data the bank has reason to retain longer is fine, but the affirmative obligation is now a written disposal SOP that demonstrates the two-year default plus documented exceptions.
Service provider oversight. §314.4(f) requires institutions to take reasonable steps to select and retain service providers capable of maintaining appropriate safeguards, to require those safeguards by contract, and to periodically assess service providers based on the risk they present and the continued adequacy of their safeguards. Periodic assessment is the operational change. A signed master services agreement from 2018 is no longer enough; current GLBA Safeguards Rule disposal compliance expects ongoing vendor evaluation, not one-time vendor selection.
Incident response plan. §314.4(h) requires a written incident response plan with specified content. For ITAD, the plan should anticipate disposal-related incidents (lost-in-transit assets, vendor-side breaches, missing sanitization documentation surfacing in audit) and define escalation paths.
Has your disposal program been updated since the 2021 Safeguards amendments took full effect in June 2023? Take the free ITAD Readiness Assessment →
What Does the 2024 Breach Notification Amendment Add?
The October 2023 amendment, effective May 13, 2024, added 16 CFR §314.4(j): covered non-bank institutions must notify the FTC of a “notification event” within thirty days of discovery if 500 or more consumers’ unencrypted information is involved.
The mechanics matter for ITAD planning. A “notification event” is unauthorized acquisition of unencrypted customer information; acquisition is rebuttably presumed once unauthorized access has occurred, unless the institution has reliable evidence that acquisition could not reasonably have happened. The notification submitted to the FTC becomes part of a publicly available database.
For disposal programs, this means a missing-asset incident or a chain-of-custody break is no longer a private matter resolved between the institution and its vendor. If unencrypted customer information was on the asset and the 500-consumer threshold is met, the institution has thirty days to file a notification that will be public. Two GLBA Safeguards Rule disposal implications follow: encryption-at-rest on assets prior to disposal materially changes the rebuttable presumption analysis, and detailed device-level inventory becomes the documentation that lets an institution demonstrate which records sat on which asset.
Banks regulated by federal banking agencies are not subject to §314.4(j). They follow Supplement A to the Interagency Guidelines, where incidents are notified to the institution’s primary federal regulator and customer notification is required where misuse is reasonably possible. The standards differ; the underlying behavioral expectation (timely incident response with documentation) does not.
How Do State Regulators Layer On Top of GLBA Safeguards Rule Disposal Requirements?
Two state-level regimes deserve attention because they exceed the federal floor.
New York (23 NYCRR 500). The NYDFS Cybersecurity Regulation applies to entities licensed or chartered by NYDFS. Section 500.13 requires policies and procedures for the secure disposal of nonpublic information that is no longer necessary for business operations. Section 500.11 requires written third-party service provider security policies, including due diligence on disposal vendors. NYDFS issued an Industry Letter on October 21, 2025 reinforcing third-party risk management expectations.
California (CCPA / CPRA). While California’s privacy regime is consumer-focused rather than financial-services-specific, it applies to financial institutions handling California consumer information outside the GLBA exemption. Its data-minimization principle and consumer deletion rights create disposal-side documentation expectations that overlap with, but are not identical to, the GLBA framework.
The operational point: an institution operating in both New York and California, with affiliated non-bank entities under FTC jurisdiction, examined by federal banking regulators, may be navigating four distinct disposal-documentation regimes at once. The Qualified Individual concept under §314.4(a) is useful because it forces designation of a single accountable owner; the underlying complexity does not go away.
Are your disposal procedures documented to satisfy your most stringent regulator, not just your federal floor? Take the free ITAD Readiness Assessment →
What Documentation Should Examiners Expect to See?
The disposal-program documentation set that satisfies current GLBA Safeguards Rule disposal expectations, plus the parallel Interagency Guidelines, plus the 2024 breach-notification trigger, is more substantial than the post-2003 baseline. A defensible bank ITAD documentation package now includes:
- Written disposal SOP that specifies the two-year default disposal window for customer information, lists documented exceptions, and identifies the sanitization methods used per device class. The SOP should cite NIST SP 800-88 Revision 2 (September 2025) as the technical reference, given that Rev 2 deprecated multi-pass overwriting and aligned with IEEE 2883:2022. SOPs still citing Rev 1 are out of step with current guidance.
- Vendor selection and oversight file documenting the due-diligence basis for each ITAD vendor, the contractual safeguards, and the most recent periodic assessment. R2v3, e-Stewards, NAID AAA, and SOC 2 Type II reports are the typical building blocks; the file should include the certificates and the institution’s read on their adequacy, not just copies.
- Risk assessment including disposal phase. Specific entries covering vendor concentration risk, transit risk, sanitization-method adequacy across asset classes, and the disposal-related foreseeable risks the institution has identified. Updated periodically per §314.4(b)(2).
- Incident response plan with disposal scenarios. Lost-in-transit asset, vendor-side breach, missing CoD surfaced in audit, chain-of-custody gap. Each scenario maps to escalation, notification triggers, and remediation paths.
- Periodic vendor assessment record. Annual or risk-based reassessment of each ITAD vendor’s continued adequacy. A signed contract is not periodic assessment; examiners look for dated evidence that the institution has revisited the vendor’s posture.
- Certificates of Sanitization or Destruction at the device-serial level. Generic lot-level receipts have not been examination-defensible for some time; the current expectation is serialized.
Where You Stand Matters
The 2023 effective dates, the 2024 breach-notification trigger, and the steady evolution of FFIEC examination expectations together mean that bank ITAD program documentation predating mid-2023 is almost certainly out of step with current GLBA Safeguards Rule disposal expectations. The substantive technical work the program does day-to-day may be fine; what changes is what the documentation has to demonstrate.
The institutions that are best positioned for an OCC, FDIC, NCUA, FRB, NYDFS, or FTC review have done four things. The disposal SOP cites current standards (NIST 800-88 Rev 2, the amended Safeguards Rule sections, the applicable Interagency Guidelines paragraphs) and is dated within the past twelve months. The Qualified Individual or the equivalent named owner has signed off on the program in writing. The vendor file includes evidence of periodic assessment, not just initial selection. And the incident response plan anticipates the disposal-specific scenarios that the 2024 breach-notification rule made meaningfully more consequential.
For institutions whose program documentation has not been refreshed since the 2021 amendments became fully effective in June 2023, the practical first step is a baseline assessment of current state. The work to align documentation is rarely large; the cost of an examiner finding that the documentation is misaligned is meaningfully larger.
Ready to assess your bank ITAD program against current GLBA expectations? SureDispose’s free assessment evaluates your current practices across vendor oversight, disposal SOP coverage, and breach-notification readiness, then connects you with certified providers matched to your requirements. Take the Assessment →
Further reading:
- 16 CFR Part 314: FTC Standards for Safeguarding Customer Information
- FTC Safeguards Rule: What Your Business Needs to Know
- Interagency Guidelines Establishing Information Security Standards (FDIC)
- NIST SP 800-88 Revision 2: Guidelines for Media Sanitization
SureDispose is an independent advisory platform. We connect organizations with vetted ITAD service providers but do not perform disposition services directly. Providers compensate us for qualified introductions.
This article is educational and reflects SureDispose’s reading of publicly available regulations and enforcement records as of April 30, 2026. It is not legal advice. Regulatory determinations for your organization are the responsibility of your compliance counsel. Specific enforcement actions referenced are summarized from public settlement documents; characterizations are the regulator’s, not SureDispose’s.