12 CFR Part 1016 — Privacy of Consumer Financial Information (Regulation P)
GLBA Title V privacy of consumer financial information (CFPB Regulation P), covering initial and annual privacy notices, opt-out notices, revised notices for new disclosures, and limits on disclosure/redisclosure of nonpublic personal information to nonaffiliated third parties.
Verbatim regulatory text
Verbatim provisions from 12 CFR Part 1016 — Privacy of Consumer Financial Information (Regulation P) — each quote is a verified substring of the regulator-published source snapshot, not retyped. Quoted for reference; this is not legal advice. The operational layer (P&P updates, prompts) lives in the regulation update kits.
12 CFR §1016.4(a) — Initial privacy notice to consumers required
(a) Initial notice requirement. You must provide a clear and conspicuous notice that accurately reflects your privacy policies and practices to:
12 CFR §1016.4(c)(2) — Customer relationship established at loan origination or servicing-rights acquisition
(2) Special rule for loans. You establish a customer relationship with a consumer when you originate or acquire the servicing rights to a loan to the consumer for personal, family , or household purposes. If you subsequently transfer the servicing rights to that loan to another financial institution , the customer relationship transfers with the servicing rights.
12 CFR §1016.5(a) — Annual privacy notice to customers required
(1) General rule. Except as provided by paragraph (e) of this section, you must provide a clear and conspicuous notice to customers that accurately reflects your privacy policies and practices not less than annually during the continuation of the customer relationship . Annually means at least once in any period of 12 consecutive months during which that relationship exists. You may define the 12-consecutive-month period, but you must apply it to the customer on a consistent basis.
12 CFR §1016.7(a) — Form of opt-out notice; opt-out methods
(1) Form of opt out notice. If you are required to provide an opt out notice under § 1016.10(a) , you must provide a clear and conspicuous notice to each of your consumers that accurately explains the right to opt out under that section. The notice must state:
12 CFR §1016.8(a) — Revised privacy notices required before new disclosures
(a) General rule. Except as otherwise authorized in this part, you must not, directly or through any affiliate , disclose any nonpublic personal information about a consumer to a nonaffiliated third party other than as described in the initial notice that you provided to that consumer under § 1016.4 of this part, unless:
12 CFR §1016.10(a) — Limits on disclosure to nonaffiliated third parties
(1) Conditions for disclosure. Except as otherwise authorized in this part, you may not, directly or through any affiliate , disclose any nonpublic personal information about a consumer to a nonaffiliated third party unless:
12 CFR §1016.11(a) — Limits on redisclosure and reuse of nonpublic personal information
(1) Information you receive under an exception. If you receive nonpublic personal information from a nonaffiliated financial institution under an exception in § 1016.14 or § 1016.15 of this part, your disclosure and use of that information is limited as follows:
12 CFR §1016.4(a) — Initial privacy notice to consumers required — enumerated items (chapeau recall fix)
(1) Customer. An individual who becomes your customer , not later than when you establish a customer relationship , except as provided in paragraph
12 CFR §1016.7(a) — Form of opt-out notice; opt-out methods — enumerated items (chapeau recall fix)
(i) That you disclose or reserve the right to disclose nonpublic personal information about your consumer to a nonaffiliated third party ; (ii) That the consumer has the right to opt out of that disclosure; and (iii) A reasonable means by which the consumer may exercise the opt out right.
12 CFR §1016.8(a) — Revised privacy notices required before new disclosures — enumerated items (chapeau recall fix)
(1) You have provided to the consumer a clear and conspicuous revised notice that accurately describes your policies and practices; (2) You have provided to the consumer a new opt out notice; (3) You have given the consumer a reasonable opportunity, before you disclose the information to the nonaffiliated third party , to opt out of the disclosure; and (4) The consumer does not opt out.
12 CFR §1016.10(a) — Limits on disclosure to nonaffiliated third parties — enumerated items (chapeau recall fix)
(i) You have provided to the consumer an initial notice as required under § 1016.4 of this part; (ii) You have provided to the consumer an opt out notice as required in § 1016.7 of this part; (iii) You have given the consumer a reasonable opportunity, before you disclose the information to the nonaffiliated third party , to opt out of the disclosure; and (iv) The consumer does not opt out.
12 CFR §1016.11(a) — Limits on redisclosure and reuse of nonpublic personal information — enumerated items (chapeau recall fix)
(i) You may disclose the information to the affiliates of the financial institution from which you received the information; (ii) You may disclose the information to your affiliates , but your affiliates may, in turn, disclose and use the information only to the extent that you may disclose and use the information; and (iii) You may disclose and use the information pursuant to an exception in § 1016.14 or § 1016.15 in the ordinary course of business to carry out the activity covered by the exception under which you received the information.