The Graham-Leach-Bailey Act (GLBA) is a 1999 law that allowed financial services companies to offer both commercial and investment banking, something that had been banned since the Great Depression. While many of these rules represent best IT practices, the legal stakes of noncompliance are high, with big fines and even potential jail time looming for those who fall short. The law applies to any business that is “significantly engaged” in providing financial products or services to consumers. The list of businesses that fall under this heading is broad and includes debt collectors, real estate appraisers, automobile dealers, and higher education institutions.”]