Does GLBA require deleting customer data after two years?

What are the GLBA data retention requirements?

For firms under FTC jurisdiction, the main GLBA data retention requirement is the Safeguards Rule's disposal clock: covered financial institutions must securely dispose of customer information no later than two years after the last date it was used to provide a product or service to that customer. The requirement sits in 16 CFR 314.4(c)(6)(i), one of the safeguards the FTC added when it amended the rule in December 2021.

The rule lists three exceptions. A firm may keep the information longer if it is necessary for business operations or other legitimate business purposes, if another law or regulation requires it to be retained, or if targeted disposal is not reasonably feasible because of the way the information is maintained. Paragraph (c)(6)(ii) adds a second duty: periodically review your data retention policy to minimize the unnecessary retention of data.

"Customer information" is broad. Under 16 CFR 314.2, it means any record containing nonpublic personal information about a customer, in paper, electronic or other form, whether your firm holds it or someone holds it on your behalf. The procedures must cover information "in any format," so paper files in storage count as much as data in a CRM.

The clock starts at the last use of the information. A customer who closed an account three years ago and has not been served since is a very different case from a long-standing customer who still transacts with you.

If your firm is an SEC-registered adviser, broker-dealer or dual-registered firm, the two-year clock does not apply to you. Reg S-P governs your disposal duty instead, as the next section explains.

Which firms does the two-year rule apply to?

The two-year rule applies to financial institutions under FTC jurisdiction. The FTC's business guide to the Safeguards Rule lists examples that include mortgage lenders and brokers, finance companies, collection agencies, tax preparation firms, non-federally insured credit unions, and investment advisers that are not required to register with the SEC.

SEC-registered advisers, broker-dealers and dual-registered firms answer to Regulation S-P instead. Its disposal provision, 17 CFR 248.30(b), requires proper disposal of consumer information, and the 2024 amendments expanded it to cover customer information as well. Reg S-P does not set a fixed two-year clock. Firms with another functional regulator, such as banks, should look to that regulator's guidelines.

Size does not change the answer for FTC-covered firms. 16 CFR 314.6 exempts institutions that hold customer information on fewer than 5,000 consumers from four requirements: the written risk assessment, penetration and vulnerability testing, the written incident response plan and the annual report to the board. Disposal is not on that list.

What counts as a legitimate reason to keep data longer?

The rule does not define "legitimate business purposes," so the safest habit is to write down the reason for each category of customer information you keep beyond two years. An undocumented reason is hard to explain to a regulator after the fact.

Reasons firms commonly document include an active relationship where the information is still in use, records another regulator requires, tax and accounting records, and litigation holds. The "required by law or regulation" exception is where books-and-records rules come in, covered in the next section.

The third exception, targeted disposal that is not reasonably feasible, fits formats such as backup sets and archives where one customer's records cannot be removed without destroying everything else. It is a narrow exception. The information still has to be protected while you hold it, and a documented backup rotation lets it age out on a known schedule.

How long do financial firms have to keep records?

It depends on the firm's regulator and the record type, and the disposal duty applies only after that minimum and any other legitimate need have run out. SEC-registered advisers keep most books and records for at least five years under Rule 204-2, and the 2024 Reg S-P amendments added records documenting Reg S-P compliance to that list. We cover the details in Reg S-P recordkeeping under Rule 204-2. Broker-dealers generally keep records for three or six years, depending on the type, under Rule 17a-4, including paragraph (e)(14) for Reg S-P records.

The common mistake is applying the longest retention period to everything. Because some documents must be kept five or six years, many firms keep every client file indefinitely. A schedule organized by record type lets you hold what the rules require and, for FTC-covered firms, dispose of the rest within the two-year window.

California adds its own layer for firms with California customers. Civil Code section 1798.81 requires a business to take all reasonable steps to dispose of customer records containing personal information that it will no longer retain, by shredding, erasing or otherwise making the information unreadable. For how the CCPA treats GLBA-covered data, see our piece on the CCPA GLBA exemption.

Where does old customer data usually hide?

Old customer data usually hides outside the system of record. Core platforms and CRMs often have retention settings; the trouble is the copies made around them.

• Mailboxes and archived mail files with statements, account forms and tax documents attached.
• Shared drives, OneDrive and SharePoint folders created during onboarding.
• E-signature platforms and client portals that keep completed packets.
• Former employees' mailboxes and laptops held "just in case."
• Spreadsheets and exports pulled for a one-time project or migration.
• AI tools and meeting notetakers that keep prompts, uploads or transcripts. Broker-dealers may need to keep some of these under Rule 17a-4, as our guide to retaining AI chat histories explains.

The Safeguards Rule's data inventory requirement in 16 CFR 314.4(c)(2) is the starting point, because you cannot dispose of information you have not found. Vendors count too. Information a service provider holds for you is still customer information, so your service provider oversight should confirm each vendor can delete on request and at the end of the contract.

What should a data retention schedule include?

A workable retention schedule lists each category of customer information, where it lives, how long it is kept, why, and how it is destroyed. Most firms can build one on a single spreadsheet.

• Record category, with examples (account applications, statements, tax forms, correspondence).
• System of record and known copies, including vendors.
• Retention period and the event that starts it, such as account closure or last transaction.
• The reason for keeping it: a business purpose or the specific rule that requires it.
• Disposal method for each format, including paper and retired devices.
• The person responsible for running disposal and keeping the evidence.
• A litigation hold process that pauses disposal when needed.

For hardware, our guide to retiring laptops, copiers and phones covers the disposal steps. FTC-covered firms should also schedule the periodic policy review that 314.4(c)(6)(ii) requires. Many firms tie it to the annual risk assessment and to the annual report to the board where one is required.

What should you do this quarter?

For FTC-covered firms, start with the customers who have been inactive the longest, and build evidence as you go. SEC-registered firms are not bound by the two-year clock; Reg S-P requires proper disposal whenever information is discarded, so the logging and vendor steps below are the ones most relevant to them.

• FTC-covered firms: pull a list of customers with no activity in the last 24 months from your CRM or core system.
• Find where their information lives, including email, file shares, portals and vendors.
• For each category, record the retention reason or mark it for disposal.
• Run a disposal batch and log what was deleted, from where, by whom and when.
• Confirm your backup rotation lets deleted data age out, and document the timeframe.
• Ask key vendors to describe their deletion process and provide confirmation on request.
• Put the retention policy review on the calendar next to the annual risk assessment.

How can s90 help?

s90 helps financial firms in Los Angeles and Orange County map where customer information lives, set retention and deletion policies in Microsoft 365 and line-of-business systems, and keep a record of each disposal run for exams. If you would like a second look at your retention schedule, we are happy to talk it through.