source:
  type: regulation
  id: glba-safeguards-16cfr-314.6
  authority: 16 CFR §314.6 — Exceptions (FTC GLBA Safeguards Rule)
  description: '16 CFR §314.6 establishes a small-institution exception for the

    written-risk-assessment-contents, continuous-monitoring-or-pen-test,

    incident-response plan, and annual-board-reporting requirements

    where customer information is maintained on fewer than 5,000

    consumers.

    '
obligations:
- id: glba-safeguards-16cfr-314.6-full
  canonical_id: glba-safeguards-16cfr-314.6-full
  section: 16 CFR §314.6
  description: Section 314.4(b)(1) , (d)(2), (h), and (i) do not apply to financial institutions that
    maintain customer information concerning fewer than five thousand consumers. [ 86 FR 70308 , Dec.
    9, 2021] CFR Toolbox Law about... Articles from Wex Table of Popular Names Parallel Table of Authorities
    Accessibil…
  type: do
  tags:
  - regulator-direct
  - section-complete
  - cfpb-regulation
  primary_source:
    tier: 1
    authority: 16 CFR §314.6
    source_class: ftc-safeguards-rule
    source_url: https://www.law.cornell.edu/cfr/text/16/314.6
    snapshot_id: 606c7f5a2fe08fcd
    fetched_at: '2026-05-24T00:44:14Z'
    content_hash: sha256:0c2912762c965870518b8306526793185d1a82c5142760044d344a8cb6be29b2
    paragraph_quote: Section 314.4(b)(1) , (d)(2), (h), and (i) do not apply to financial institutions
      that maintain customer information concerning fewer than five thousand consumers. [ 86 FR 70308
      , Dec. 9, 2021] CFR Toolbox Law about... Articles from Wex Table of Popular Names Parallel Table
      of Authorities Accessibility About LII Contact us Advertise here Help Terms of use Privacy
    drafter_attestation: Verbatim subsection of 16 CFR §314.6 from Cornell LII snapshot 606c7f5a2fe08fcd;
      body isolated between nav and notes; substring-verified.
  judgment: false
