--- title: "12 CFR 1016.11 GLBA: Limits on redisclosure and reuse of information" canonical: "https://dposchool.com/glba/section/1016.11" source: "https://www.ecfr.gov/current/title-12/section-1016.11" source_note: "Source: United States Code, title 15, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 12, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 12 CFR 1016.11 GLBA · Part 1016: PRIVACY OF CONSUMER FINANCIAL INFORMATION (REGULATION P) · Subpart B: Limits on Disclosures # 12 CFR 1016.11 GLBA: Limits on redisclosure and reuse of information eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text **(a)(1)** Information you receive under an exception. If you receive nonpublic personal information from a nonaffiliated financial institution under an exception in § 1016.14 or § 1016.15 of this part, your disclosure and use of that information is limited as follows: **(i)** You may disclose the information to the affiliates of the financial institution from which you received the information; **(ii)** You may disclose the information to your affiliates, but your affiliates may, in turn, disclose and use the information only to the extent that you may disclose and use the information; and **(iii)** You may disclose and use the information pursuant to an exception in § 1016.14 or § 1016.15 in the ordinary course of business to carry out the activity covered by the exception under which you received the information. #### 12 CFR 1016.11(2) **(2)** Example. If you receive a customer list from a nonaffiliated financial institution in order to provide account processing services under the exception in § 1016.14(a), you may disclose that information under any exception in § 1016.14 or § 1016.15 in the ordinary course of business in order to provide those services. For example, you could disclose the information in response to a properly authorized subpoena or, in the case of financial institutions other than those described in § 1016.3(l)(3), to your attorneys, accountants, and auditors. You could not disclose that information to a third party for marketing purposes or use that information for your own marketing purposes. **(b)(1)** Information you receive outside of an exception. If you receive nonpublic personal information from a nonaffiliated financial institution other than under an exception in § 1016.14 or § 1016.15 of this part, you may disclose the information only: **(i)** To the affiliates of the financial institution from which you received the information; **(ii)** To your affiliates, but your affiliates may, in turn, disclose the information only to the extent that you can disclose the information; and **(iii)** To any other person, if the disclosure would be lawful if made directly to that person by the financial institution from which you received the information. #### 12 CFR 1016.11(2) **(2)** Example. If you obtain a customer list from a nonaffiliated financial institution outside of the exceptions in §§ 1016.14 and 1016.15: ##### 12 CFR 1016.11(2)(i) **(i)** You may use that list for your own purposes; and ##### 12 CFR 1016.11(2)(ii) **(ii)** You may disclose that list to another nonaffiliated third party only if the financial institution from which you purchased the list could have lawfully disclosed the list to that third party. That is, you may disclose the list in accordance with the privacy policy of the financial institution from which you received the list, as limited by the opt out direction of each consumer whose nonpublic personal information you intend to disclose, and you may disclose the list in accordance with an exception in § 1016.14 or § 1016.15, such as to your attorneys or accountants. ### 12 CFR 1016.11(c) **(c)** Information you disclose under an exception. If you disclose nonpublic personal information to a nonaffiliated third party under an exception in § 1016.14 or § 1016.15 of this part, the third party may disclose and use that information only as follows: #### 12 CFR 1016.11(c)(1) **(1)** The third party may disclose the information to your affiliates; #### 12 CFR 1016.11(c)(2) **(2)** The third party may disclose the information to its affiliates, but its affiliates may, in turn, disclose and use the information only to the extent that the third party may disclose and use the information; and #### 12 CFR 1016.11(c)(3) **(3)** The third party may disclose and use the information pursuant to an exception in § 1016.14 or § 1016.15 in the ordinary course of business to carry out the activity covered by the exception under which it received the information. ### 12 CFR 1016.11(d) **(d)** Information you disclose outside of an exception. If you disclose nonpublic personal information to a nonaffiliated third party other than under an exception in § 1016.14 or § 1016.15 of this part, the third party may disclose the information only: #### 12 CFR 1016.11(d)(1) **(1)** To your affiliates; #### 12 CFR 1016.11(d)(2) **(2)** To its affiliates, but its affiliates, in turn, may disclose the information only to the extent the third party can disclose the information; and #### 12 CFR 1016.11(d)(3) **(3)** To any other person, if the disclosure would be lawful if you made it directly to that person. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 12, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [12 CFR 1016.11 on eCFR](https://www.ecfr.gov/current/title-12/section-1016.11) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [GLBA Navigator](https://dposchool.com/glba) / 12 CFR 1016.11 Previous: [12 CFR 1016.10 GLBA: Limits on disclosure of nonpublic personal information to nonaffiliated third parties](https://dposchool.com/glba/section/1016.10) Next: [12 CFR 1016.12 GLBA: Limits on sharing account number information for marketing purposes](https://dposchool.com/glba/section/1016.12) ## For AI agents - Machine-readable index: https://dposchool.com/glba/llms.txt - JSON API: https://dposchool.com/glba/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents