Resources / Privacy Program Guides / Financial Services
Privacy Program GuidesFinancial ServicesCredit Unions and Lenders
Privacy Program Guide for Credit Unions
The privacy laws, notices, data map, and member rights a credit union privacy program needs to cover, including AI tools.
Aligned withNIST Privacy Framework
The short answer
A credit union privacy program is built on the Gramm-Leach-Bliley Act: privacy notices and opt-outs under Regulation P, and the information security program required by NCUA Part 748. Many state privacy laws exempt GLBA-covered institutions or data, but not all exemptions are complete, so a credit union should confirm how each state where it has members treats it. AI tools must fit inside the same program.
Core requirements
| Requirement | What it means for your credit union |
|---|---|
| Privacy notice (Regulation P) | Give members a clear notice of how you collect and share their information when the relationship begins, and annually unless you qualify for the annual notice exception. |
| Opt-out rights | Let members opt out before you share their information with nonaffiliated third parties, except where an exception applies. |
| Information security program (NCUA Part 748) | Maintain a written, board-approved program to protect member information, including oversight of service providers. |
| Member notice for security incidents | Have a response program for unauthorized access to member information, including member notice where required. |
| State privacy laws | Confirm whether each state’s law exempts your credit union entirely or only GLBA-covered data, especially for website, marketing, and analytics data. |
How member data flows
Collected through
Stored in
Shared with
Build a data map
| Data category | Where it lives | Who can access it | AI tools that use it | Risk tier |
|---|---|---|---|---|
| Account and transaction data | Core system | Operations, member service | Fraud detection, chatbot | High |
| Credit and application data | Loan origination system | Lending | Underwriting model | High |
| Contact center recordings | Telephony platform | Member service, quality assurance | Call summarization | Medium |
| Website and app analytics | Marketing platforms | Marketing | Personalization, ad targeting | Medium |
| Employee data | HR system | HR | None | Medium |
Five steps to strengthen the program
Map
Document what member data you hold, where, and who uses it, including AI tools.
Check notices
Make sure your privacy notice matches how data is actually shared, including with AI vendors.
Review vendors
Confirm vendor contracts limit how member data is used and protect it.
Check state laws
Confirm your exemption status in each state where you have members.
Report
Give the board an annual summary of the privacy program and any incidents.
Frequently asked questions
Does using AI vendors change our privacy notice?
Possibly. If a vendor uses member data beyond servicing your credit union, such as training its own models, review whether that sharing is described in your notice and whether an opt-out applies.
Are credit unions exempt from state privacy laws?
Often, but not always completely. Some laws exempt GLBA-covered institutions entirely, while others exempt only GLBA-covered data, leaving data such as website analytics in scope.
More Guides for Credit Unions and Lenders
- AI Regulation Map for Credit Unions
- AI Use Policy Guide for Credit Unions
- AI Risk Register for Credit Unions
- AI Vendor Assessment Checklist for Credit Unions
- AI Governance Blueprint for Credit Unions
- AI Training Guide for Credit Unions
- AI Impact Assessment Example for Credit Unions
- AI Incident Response Playbook for Credit Unions
- AI Board Oversight Guide for Credit Unions
- AI Contract Clause Library for Credit Unions
- State AI Law Tracker for Credit Unions
- AI Use Case Catalog for Credit Unions
- Data Protection Assessment Template for Credit Unions
- AI Tabletop Exercise Scenario for Credit Unions
Sources
- Gramm-Leach-Bliley Act, 15 U.S.C. 6801
- Regulation P, 12 CFR Part 1016
- NCUA security program rule, 12 CFR Part 748, including Appendices A and B
How this guide is built
Built from primary sources: statutes, regulations, standards, and agency guidance. Our team reviews each industry’s legal summary every quarter and updates guides when requirements change.
Cite this guide
Cogent Assurance. (2026). Privacy Program Guide for Credit Unions. Cogent Assurance Resource Center. https://cogentassurance.com/resources/privacy-program-guide-credit-unions
Report an issue
See something out of date or incorrect? Tell us and we’ll review it.
Report an issue with this guideThis guide is general information for planning purposes. Laws and guidance change, so confirm current requirements before acting. It is not legal advice. For legal advice about your organization, consult a licensed attorney.
Services that help
Fractional Chief AI or Privacy Officer
A named senior executive who owns your AI governance or privacy program and reports to your leadership.
AI Governance Essentials
Monthly AI governance support from our team: tool reviews, policy updates, and register upkeep.
AI Acceptable Use Policy
A clear, written policy that tells your people which AI tools they can use, for what work, and with what data.
Talk through your AI and privacy questions
Tell us what you're working on, and we'll reply within one business day.