GLBA for insurance agencies: does the NAIC Insurance Data Security Model Law apply?

Who enforces GLBA security rules for an insurance agency?

Your state insurance regulator does, under state insurance law. The Gramm-Leach-Bliley Act requires every financial institution to protect customer information, and 15 U.S.C. 6805(a)(6) assigns enforcement for "any person engaged in providing insurance" to the applicable state insurance authority. Section 6805(b)(2) then directs those state authorities to implement GLBA's safeguards standards themselves.

That split is why insurance agencies hear about the NAIC Insurance Data Security Model Law far more often than the FTC Safeguards Rule. The FTC's GLBA authority reaches financial institutions that no other listed regulator covers, and insurance is already assigned to the states. An agency's security obligations come from the insurance code and regulations of each state where it is licensed, plus California's general privacy and breach laws.

GLBA also works as a floor. Under 15 U.S.C. 6807(b), a state law is not preempted when it gives consumers greater protection than GLBA does. That is the opening states have used to layer their own insurance data security laws on top.

What is the NAIC Insurance Data Security Model Law?

The NAIC Insurance Data Security Model Law is the template most states have used to write insurance-specific cybersecurity rules for insurers and agencies. The National Association of Insurance Commissioners adopted it as Model Law #668 in October 2017. The NAIC's government affairs brief on the model (October 2026 update) counts 28 adopting jurisdictions: 27 states plus Puerto Rico. California is not on that list.

The model applies to any "Licensee," defined as any person licensed, authorized or registered under the state's insurance laws. That definition reaches producers and agencies as well as carriers. Where a state has adopted it, the core requirements are:

• A comprehensive written information security program based on a risk assessment (Section 4A and 4C).
• Board oversight and an annual written report from management, if the licensee has a board of directors (Section 4E).
• Due diligence in selecting third-party service providers, and a requirement that those providers implement appropriate administrative, technical and physical safeguards (Section 4F).
• Notice to the insurance commissioner no later than 72 hours after determining that a cybersecurity event has occurred, when the event meets the model's criteria (Section 6A).

The annual compliance certification due February 15 under Section 4I applies to insurers domiciled in the state. An agency does not file it under the model text.

Does the NAIC model law apply to a California insurance agency?

Only where the agency holds a license in a state that adopted it, because California has not adopted the model. A Los Angeles or Orange County agency licensed only in California is outside Model #668 today. Many agencies hold nonresident licenses in other states to serve clients who move or own property elsewhere, and each license is a potential trigger.

Two details in the model matter most for smaller agencies.

First, the small-licensee exception is narrow. Section 9A(1) exempts a licensee "with fewer than ten employees, including any independent contractors," from Section 4, the information security program. It does not exempt the licensee from Section 6, so the 72-hour commissioner notice can still apply.

Second, the notice trigger follows the consumers. For a licensee that is not an insurer domiciled in the state, Section 6A requires notice when the licensee reasonably believes the information involved concerns 250 or more consumers residing in that state, and either another law requires notice or there is a reasonable likelihood of material harm. An agency with a book of business in Hawaii, Illinois or another adopting state should know its consumer count per state before an incident, since the clock starts at determination.

Section 9A(3) adds a separate exemption: an agent who is also a licensee is exempt from Section 4 to the extent the agent is covered by another licensee's information security program. Captive agents should confirm in writing whether that coverage applies to them.

Does 23 NYCRR 500 apply to out-of-state insurance agencies?

Yes, if the agency or its producers hold a New York insurance license. Part 500 covers any person operating under a license issued under New York's insurance law, and New York did not adopt Model #668. A drafting note in the NAIC model says a licensee that complies with Part 500 is also in compliance with the model.

Smaller agencies usually qualify for the limited exemption in Section 500.19(a): fewer than 20 employees and independent contractors (with affiliates), or less than $7.5 million in gross annual revenue in each of the last three fiscal years, or less than $15 million in year-end total assets. The exemption is partial. An exempt entity still must maintain a cybersecurity program and policy, manage access privileges, perform a risk assessment, keep a third-party service provider security policy, use multi-factor authentication, maintain asset inventory and data retention practices, train staff, and file notices with the superintendent, including a Notice of Exemption and an annual compliance notification.

What does California require of insurance agencies right now?

In California, the main insurance-specific privacy statute today is the Insurance Information and Privacy Protection Act (IIPPA). Cal. Ins. Code § 791.13 bars an insurance institution, agent or insurance-support organization from disclosing personal or privileged information collected in connection with an insurance transaction unless an exception applies, such as written authorization or a disclosure needed for another party to perform a function for the agent. That rule governs what an agency can share with vendors, including AI tools. Our piece on AI for insurance agents covers that use case.

Two general California laws apply alongside it:

• The CCPA. Its GLBA exemption applies at the data level: it covers personal information collected under GLBA. Employee records, website visitor data and marketing lists can still fall under the CCPA if the agency meets its thresholds. We explain the line in Does the CCPA GLBA exemption cover your whole firm?
• The breach notification statute. Cal. Civ. Code § 1798.82 requires notice to affected California residents after a breach of defined personal information, and notice to the Attorney General when more than 500 residents are affected.

What changes when California's new insurance privacy law takes effect?

On July 1, 2028, a broader California Insurance Information and Privacy Protection Act replaces the current IIPPA and expressly covers producers. SB 354, which enacts it, was signed and chaptered on September 27, 2026 as Chapter 481, Statutes of 2026. The current IIPPA becomes inoperative on the same July 1, 2028 date.

The law includes a partial carve-out for some obligations when a producer handles personal information to solicit, obtain or place coverage for a consumer. It directs the Insurance Commissioner to adopt regulations applying key provisions to producers no later than January 1, 2029. Agencies should expect the details of their obligations to come from that rulemaking, so the next two years are the window to get data inventories and vendor contracts in order.

What cybersecurity steps should an insurance agency take this quarter?

An insurance agency should start by mapping where it and its producers are licensed and where its customers live, because most of the obligations above turn on those two facts.

• List every state where the agency and each producer holds a license, resident or nonresident, and note which have adopted Model #668 and whether New York is on the list.
• Count consumers by state of residence in your agency management system, so you can tell quickly whether an incident crosses the 250-consumer notice threshold in any adopting state.
• Write down the agency's information security program, even if you fall under the ten-employee exception. A written risk assessment, access controls, MFA and an incident response plan are the common core of Model #668 and Part 500.
• Build a 72-hour notice path: who decides an event has occurred, who has the regulator contact list for each state, and who drafts the notice.
• Review vendor contracts for security and incident reporting terms, starting with your agency management system, email, file sharing and any AI tools. Our piece on vendor oversight under GLBA covers what to monitor after the contract is signed.
• If you hold a New York license, confirm whether you have filed a Notice of Exemption and calendar the annual compliance notification.

This article describes what these rules say. It is not legal advice, and an agency's specific obligations depend on its licenses and facts, so confirm them with counsel.

How does s90 help insurance agencies?

s90 runs the technical side of an agency's security program: risk assessments, MFA and access reviews, vendor documentation and incident response planning, mapped to the state laws on your license list. Our agreements commit to 72-hour breach notification and 24-hour evidence production, which supports an agency working against a 72-hour commissioner deadline in adopting states. If you want a second look at your license map and program, we are happy to talk it through.