--- title: "12 CFR 1016.6 GLBA: Information to be included in privacy notices" canonical: "https://dposchool.com/glba/section/1016.6" source: "https://www.ecfr.gov/current/title-12/section-1016.6" source_note: "Source: United States Code, title 15, published by the Office of the Law Revision Counsel of the U.S. House of Representatives (uscode.house.gov), release point 119-136. The editorial and statutory notes are not reproduced. Source: Electronic Code of Federal Regulations (eCFR), title 12, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. Source: Electronic Code of Federal Regulations (eCFR), title 16, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR." text_as_of: "2026-10-29" language: "en" publisher: "DPO School" --- 12 CFR 1016.6 GLBA · Part 1016: PRIVACY OF CONSUMER FINANCIAL INFORMATION (REGULATION P) · Subpart A: Privacy and Opt Out Notices # 12 CFR 1016.6 GLBA: Information to be included in privacy notices eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. ## Official text ### 12 CFR 1016.6(a) **(a)** General rule. The initial, annual, and revised privacy notices that you provide under §§ 1016.4, 1016.5, and 1016.8 of this part must include each of the following items of information, in addition to any other information you wish to provide, that applies to you and to the consumers to whom you send your privacy notice: #### 12 CFR 1016.6(a)(1) **(1)** The categories of nonpublic personal information that you collect; #### 12 CFR 1016.6(a)(2) **(2)** The categories of nonpublic personal information that you disclose; #### 12 CFR 1016.6(a)(3) **(3)** The categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information, other than those parties to whom you disclose information under §§ 1016.14 and 1016.15 of this part; #### 12 CFR 1016.6(a)(4) **(4)** The categories of nonpublic personal information about your former customers that you disclose and the categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information about your former customers, other than those parties to whom you disclose information under §§ 1016.14 and 1016.15; #### 12 CFR 1016.6(a)(5) **(5)** If you disclose nonpublic personal information to a nonaffiliated third party under § 1016.13 (and no other exception in § 1016.14 or § 1016.15 applies to that disclosure), a separate statement of the categories of information you disclose and the categories of third parties with whom you have contracted; #### 12 CFR 1016.6(a)(6) **(6)** An explanation of the consumer's right under § 1016.10(a) of this part to opt out of the disclosure of nonpublic personal information to nonaffiliated third parties, including the method(s) by which the consumer may exercise that right at that time; #### 12 CFR 1016.6(a)(7) **(7)** Any disclosures that you make under section 603(d)(2)(A)(iii) of the Fair Credit Reporting Act (15 U.S.C. 1681a(d)(2)(A)(iii)) (that is, notices regarding the ability to opt out of disclosures of information among affiliates); #### 12 CFR 1016.6(a)(8) **(8)** Your policies and practices with respect to protecting the confidentiality and security of nonpublic personal information; and #### 12 CFR 1016.6(a)(9) **(9)** Any disclosure that you make under paragraph (b) of this section. ### 12 CFR 1016.6(b) **(b)** Description of nonaffiliated third parties subject to exceptions. If you disclose nonpublic personal information to third parties as authorized under §§ 1016.14 and 1016.15, you are not required to list those exceptions in the initial or annual privacy notices required by §§ 1016.4 and 1016.5. When describing the categories with respect to those parties, it is sufficient to state that you make disclosures to other nonaffiliated companies: #### 12 CFR 1016.6(b)(1) **(1)** For your everyday business purposes, such as \[include all that apply\] to process transactions, maintain account(s), respond to court orders and legal investigations, or report to credit bureaus; or #### 12 CFR 1016.6(b)(2) **(2)** As permitted by law. ### 12 CFR 1016.6(c) **(c)** Examples—(1) Categories of nonpublic personal information that you collect. You satisfy the requirement to categorize the nonpublic personal information that you collect if you list the following categories, as applicable: ##### 12 CFR 1016.6(c)(i) **(i)** Information from the consumer; ##### 12 CFR 1016.6(c)(ii) **(ii)** Information about the consumer's transactions with you or your affiliates; ##### 12 CFR 1016.6(c)(iii) **(iii)** Information about the consumer's transactions with nonaffiliated third parties; and ##### 12 CFR 1016.6(c)(iv) **(iv)** Information from a consumer reporting agency. #### 12 CFR 1016.6(c)(2) **(2)** Categories of nonpublic personal information you disclose. (i) You satisfy the requirement to categorize the nonpublic personal information that you disclose if you list the categories described in paragraph (c)(1) of this section, as applicable, and a few examples to illustrate the types of information in each category. ##### 12 CFR 1016.6(c)(2)(ii) **(ii)** If you reserve the right to disclose all of the nonpublic personal information about consumers that you collect, you may simply state that fact without describing the categories or examples of the nonpublic personal information you disclose. #### 12 CFR 1016.6(c)(3) **(3)** Categories of affiliates and nonaffiliated third parties to whom you disclose. You satisfy the requirement to categorize the affiliates and nonaffiliated third parties to whom you disclose nonpublic personal information if you list the following categories, as applicable, and a few examples to illustrate the types of third parties in each category. ##### 12 CFR 1016.6(c)(3)(i) **(i)** Financial service providers, followed by illustrative examples such as mortgage bankers, securities broker-dealers, and insurance agents; ##### 12 CFR 1016.6(c)(3)(ii) **(ii)** Non-financial companies, followed by illustrative examples such as retailers, magazine publishers, airlines, and direct marketers; and ##### 12 CFR 1016.6(c)(3)(iii) **(iii)** Others, followed by examples such as nonprofit organizations. #### 12 CFR 1016.6(c)(4) **(4)** Disclosures under exception for service providers and joint marketers. If you disclose nonpublic personal information under the exception in § 1016.13 of this part to a nonaffiliated third party to market products or services that you offer alone or jointly with another financial institution, you satisfy the disclosure requirement of paragraph (a)(5) of this section if you: ##### 12 CFR 1016.6(c)(4)(i) **(i)** List the categories of nonpublic personal information you disclose, using the same categories and examples you used to meet the requirements of paragraph (a)(2) of this section, as applicable; and ##### 12 CFR 1016.6(c)(4)(ii) **(ii)** State whether the third party is: ###### 12 CFR 1016.6(c)(4)(ii)(A) **(A)** A service provider that performs marketing services on your behalf or on behalf of you and another financial institution; or ###### 12 CFR 1016.6(c)(4)(ii)(B) **(B)** A financial institution with whom you have a joint marketing agreement. #### 12 CFR 1016.6(c)(5) **(5)** Simplified notices. If you do not disclose, and do not wish to reserve the right to disclose, nonpublic personal information about customers or former customers to affiliates or nonaffiliated third parties except as authorized under §§ 1016.14 and 1016.15, you may simply state that fact, in addition to the information you must provide under paragraphs (a)(1), (a)(8), (a)(9), and (b) of this section. #### 12 CFR 1016.6(c)(6) **(6)** Confidentiality and security. You describe your policies and practices with respect to protecting the confidentiality and security of nonpublic personal information if you do both of the following: ##### 12 CFR 1016.6(c)(6)(i) **(i)** Describe in general terms who is authorized to have access to the information; and ##### 12 CFR 1016.6(c)(6)(ii) **(ii)** State whether you have security practices and procedures in place to ensure the confidentiality of the information in accordance with your policy. You are not required to describe technical information about the safeguards you use. ### 12 CFR 1016.6(d) **(d)** Short-form initial notice with opt out notice for non-customers. (1) You may satisfy the initial notice requirements in §§ 1016.4(a)(2), 1016.7(b), and 1016.7(c) of this part for a consumer who is not a customer by providing a short-form initial notice at the same time as you deliver an opt out notice as required in § 1016.7. #### 12 CFR 1016.6(d)(2) **(2)** A short-form initial notice must: ##### 12 CFR 1016.6(d)(2)(i) **(i)** Be clear and conspicuous; ##### 12 CFR 1016.6(d)(2)(ii) **(ii)** State that your privacy notice is available upon request; and ##### 12 CFR 1016.6(d)(2)(iii) **(iii)** Explain a reasonable means by which the consumer may obtain that notice. #### 12 CFR 1016.6(d)(3) **(3)** You must deliver your short-form initial notice according to § 1016.9. You are not required to deliver your privacy notice with your short-form initial notice. You instead may simply provide the consumer a reasonable means to obtain your privacy notice. If a consumer who receives your short-form notice requests your privacy notice, you must deliver your privacy notice according to § 1016.9. #### 12 CFR 1016.6(d)(4) **(4)** Examples of obtaining privacy notice. You provide a reasonable means by which a consumer may obtain a copy of your privacy notice if you: ##### 12 CFR 1016.6(d)(4)(i) **(i)** Provide a toll-free telephone number that the consumer may call to request the notice; or ##### 12 CFR 1016.6(d)(4)(ii) **(ii)** For a consumer who conducts business in person at your office, maintain copies of the notice on hand that you provide to the consumer immediately upon request. ### 12 CFR 1016.6(e) **(e)** Future disclosures. Your notice may include: #### 12 CFR 1016.6(e)(1) **(1)** Categories of nonpublic personal information that you reserve the right to disclose in the future, but do not currently disclose; and #### 12 CFR 1016.6(e)(2) **(2)** Categories of affiliates or nonaffiliated third parties to whom you reserve the right in the future to disclose, but to whom you do not currently disclose, nonpublic personal information. ### 12 CFR 1016.6(f) **(f)** Model privacy form. Pursuant to § 1016.2(a) of this part, a model privacy form that meets the notice content requirements of this section is included in the appendix to this part. ## Source Source: Electronic Code of Federal Regulations (eCFR), title 12, up to date as of 29 October 2026, from the eCFR API (ecfr.gov). The eCFR is an editorial compilation of the CFR and Federal Register amendments, not an official legal edition of the CFR. [12 CFR 1016.6 on eCFR](https://www.ecfr.gov/current/title-12/section-1016.6) eCFR, up to date as of 29 October 2026. Retrieved 30 October 2026. This is reference material, not legal advice. ## Navigation [GLBA Navigator](https://dposchool.com/glba) / 12 CFR 1016.6 Previous: [12 CFR 1016.5 GLBA: Annual privacy notice to customers required](https://dposchool.com/glba/section/1016.5) Next: [12 CFR 1016.7 GLBA: Form of opt out notice to consumers; opt out methods](https://dposchool.com/glba/section/1016.7) ## For AI agents - Machine-readable index: https://dposchool.com/glba/llms.txt - JSON API: https://dposchool.com/glba/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents