source:
  type: regulation
  id: reg-p-1016.6
  authority: 12 CFR §1016.6 — Information to be included in privacy notices (Regulation
    P)
  description: 12 CFR §1016.6 — Information to be included in privacy notices.
  coverage_tier: operative
obligations:
- id: reg-p-1016.6-full
  canonical_id: reg-p-1016.6-full
  section: 12 CFR §1016.6 — Information to be included in privacy notices
  type: do
  tags:
  - regulator-direct
  - glba-privacy
  - corpus-expansion
  - tier-operative
  primary_source:
    tier: 1
    authority: 12 CFR §1016.6 — Information to be included in privacy notices (Regulation
      P)
    source_class: cfpb-regulation
    source_url: https://www.law.cornell.edu/cfr/text/12/1016.6
    snapshot_id: 6f633638c0596ac5
    fetched_at: '2026-06-17T20:38:42Z'
    content_hash: sha256:a76266d298d207f6203f03e6cbb0f3c886fa93c447549fb1466e22323b1e8de0
    paragraph_quote: '§ 1016.6 Information to be included in privacy notices. (a)
      General rule. The initial, annual, and revised privacy notices that you provide
      under §§ 1016.4 , 1016.5 , and 1016.8 of this part must include each of the
      following items of information, in addition to any other information you wish
      to provide, that applies to you and to the consumers to whom you send your privacy
      notice: (1) The categories of nonpublic personal information that you collect
      ; (2) The categories of nonpublic personal information that you disclose; (3)
      The categories of affiliates and non affiliated third parties to whom you disclose
      nonpublic personal information , other than those parties to whom you disclose
      information under §§ 1016.14 and 1016.15 of this part; (4) The categories of
      nonpublic personal information about your former customers that you disclose
      and the categories of affiliates and non affiliated third parties to whom you
      disclose nonpublic personal information about your former customers, other than
      those parties to whom you disclose information under §§ 1016.14 and 1016.15;
      (5) If you disclose nonpublic personal information to a nonaffiliated third
      party under § 1016.13 (and no other exception in § 1016.14 or § 1016.15 applies
      to that disclosure), a separate statement of the categories of information you
      disclose and the categories of third parties with whom you have contracted;
      (6) An explanation of the consumer''s right under § 1016.10(a) of this part
      to opt out of the disclosure of nonpublic personal information to nonaffiliated
      third parties, including the method(s) by which the consumer may exercise that
      right at that time; (7) Any disclosures that you make under section 603(d)(2)(A)(iii)
      of the Fair Credit Reporting Act ( 15 U.S.C. 1681a(d)(2)(A)(iii) ) (that is,
      notices regarding the ability to opt out of disclosures of information among
      affiliates); (8) Your policies and practices with respect to protecting the
      confidentiality and security of nonpublic personal information ; and (9) Any
      disclosure that you make under paragraph (b) of this section. (b) Description
      of nonaffiliated third parties subject to exceptions. If you disclose nonpublic
      personal information to third parties as authorized under §§ 1016.14 and 1016.15,
      you are not required to list those exceptions in the initial or annual privacy
      notices required by §§ 1016.4 and 1016.5. When describing the categories with
      respect to those parties, it is sufficient to state that you make disclosures
      to other nonaffiliated companies: (1) For your everyday business purposes, such
      as [ include all that apply ] to process transactions, maintain account(s),
      respond to court orders and legal investigations, or report to credit bureaus;
      or (2) As permitted by law. (c) Examples —(1) Categories of nonpublic personal
      information that you collect. You satisfy the requirement to categorize the
      nonpublic personal information that you collect if you list the following categories,
      as applicable: (i) Information from the consumer; (ii) Information about the
      consumer''s transactions with you or your affiliates; (iii) Information about
      the consumer''s transactions with nonaffiliated third parties; and (iv) Information
      from a consumer reporting agency . (2) Categories of nonpublic personal information
      you disclose. (i) You satisfy the requirement to categorize the nonpublic personal
      information that you disclose if you list the categories described in paragraph
      (c)(1) of this section, as applicable, and a few examples to illustrate the
      types of information in each category. (ii) If you reserve the right to disclose
      all of the nonpublic personal information about consumers that you collect ,
      you may simply state that fact without describing the categories or examples
      of the nonpublic personal information you disclose. (3) Categories of affiliates
      and nonaffiliated third parties to whom you disclose. You satisfy the requirement
      to categorize the affiliates and non affiliated third parties to whom you disclose
      nonpublic personal information if you list the following categories, as applicable,
      and a few examples to illustrate the types of third parties in each category.
      (i) Financial service providers, followed by illustrative examples such as mortgage
      bankers, securities broker-dealers, and insurance agents; (ii) Non-financial
      companies, followed by illustrative examples such as retailers, magazine publishers,
      airlines, and direct marketers; and (iii) Others, followed by examples such
      as nonprofit organizations. (4) Disclosures under exception for service providers
      and joint marketers. If you disclose nonpublic personal information under the
      exception in § 1016.13 of this part to a nonaffiliated third party to market
      products or services that you offer alone or jointly with another financial
      institution , you satisfy the disclosure requirement of paragraph (a)(5) of
      this section if you: (i) List the categories of nonpublic personal information
      you disclose, using the same categories and examples you used to meet the requirements
      of paragraph (a)(2) of this section, as applicable; and (ii) State whether the
      third party is: (A) A service provider that performs marketing services on your
      behalf or on behalf of you and another financial institution ; or (B) A financial
      institution with whom you have a joint marketing agreement. (5) Simplified notices.
      If you do not disclose, and do not wish to reserve the right to disclose, nonpublic
      personal information about customers or former customers to affiliates or non
      affiliated third parties except as authorized under §§ 1016.14 and 1016.15,
      you may simply state that fact, in addition to the information you must provide
      under paragraphs (a)(1), (a)(8), (a)(9), and (b) of this section. (6) Confidentiality
      and security. You describe your policies and practices with respect to protecting
      the confidentiality and security of nonpublic personal information if you do
      both of the following: (i) Describe in general terms who is authorized to have
      access to the information; and (ii) State whether you have security practices
      and procedures in place to ensure the confidentiality of the information in
      accordance with your policy. You are not required to describe technical information
      about the safeguards you use. (d) Short-form initial notice with opt out notice
      for non-customers. (1) You may satisfy the initial notice requirements in §§
      1016.4(a)(2) , 1016.7(b) , and 1016.7(c) of this part for a consumer who is
      not a customer by providing a short-form initial notice at the same time as
      you deliver an opt out notice as required in § 1016.7. (2) A short-form initial
      notice must: (i) Be clear and conspicuous; (ii) State that your privacy notice
      is available upon request; and (iii) Explain a reasonable means by which the
      consumer may obtain that notice. (3) You must deliver your short-form initial
      notice according to § 1016.9 . You are not required to deliver your privacy
      notice with your short-form initial notice. You instead may simply provide the
      consumer a reasonable means to obtain your privacy notice. If a consumer who
      receives your short-form notice requests your privacy notice, you must deliver
      your privacy notice according to § 1016.9 . (4) Examples of obtaining privacy
      notice. You provide a reasonable means by which a consumer may obtain a copy
      of your privacy notice if you: (i) Provide a toll-free telephone number that
      the consumer may call to request the notice; or (ii) For a consumer who conducts
      business in person at your office, maintain copies of the notice on hand that
      you provide to the consumer immediately upon request. (e) Future disclosures.
      Your notice may include: (1) Categories of nonpublic personal information that
      you reserve the right to disclose in the future, but do not currently disclose;
      and (2) Categories of affiliates or non affiliated third parties to whom you
      reserve the right in the future to disclose, but to whom you do not currently
      disclose, nonpublic personal information . (f) Model privacy form. Pursuant
      to § 1016.2(a) of this part, a model privacy form that meets the notice content
      requirements of this section is included in the appendix to this part. Fair
      Credit Reporting Act'
  judgment: false
