Customer information: definition for WISP compliance

What does customer information mean under the FTC Safeguards Rule?

16 CFR 314.2(d) defines customer information as records containing nonpublic personal information about a customer, in paper, electronic, or other form. Customer information means nonpublic personal information about a customer, whether in paper, electronic, or other form, handled by or for a financial institution.

The rule means something specific by this. It is nonpublic personal information about a consumer of a financial institution, held by or on behalf of the firm, not the general business sense of records about a customer.

Tax records, bank feeds, payroll files, portals, and client identity documents can all fall inside the practical scope of a firm's WISP.

Worked example

A tax office's client portal exports, scanned driver licenses, bank-feed files, e-file acknowledgments, and retained workpapers are all treated as customer-information locations in the WISP inventory.

The example belongs in the policy packet only if it matches the firm's actual systems, vendors, and evidence records. Otherwise, it should become a remediation or counsel-review note.

What small firms get wrong

Small firms often count only tax software or a core system and miss email attachments, paper files, backup exports, and vendor support access.

The fix is to tie the term to a concrete record: a system inventory, access list, vendor list, incident log, training record, or dated control screenshot.

Related policy decisions

This term should connect to neighboring definitions and to the verticals where the risk actually appears.

Related terms: Written Information Security Program, Service Provider, Breach Notification. Related verticals: tax preparers, auto dealers. Linking the term this way keeps the glossary from becoming a dictionary page; it becomes a small implementation map for the WISP, incident response plan, acceptable use policy, and access control policy.

A small firm can use that map during annual review: confirm the definition still matches the firm's data inventory, vendors, systems, proof records, customer count assumptions, and any vendor access, then update the packet when the real workflow changes.

That review should leave a dated note showing what changed, what stayed the same, and which person accepted any remaining control gap.

FAQ