What Counts as Nonpublic Personal Information in a Title File

What is nonpublic personal information?

Nonpublic personal information is personally identifiable financial information that a consumer gives you, that comes out of a transaction with them, or that you otherwise get while serving them. That’s the definition Congress wrote into the Gramm-Leach-Bliley Act at 15 U.S.C. 6809(4). The regulation that carries it out, 12 CFR 1016.3, adds one more piece: any list or grouping of consumers built using that information is NPI too.

The only thing that’s carved out is publicly available information. That means stuff you have a reasonable basis to believe is lawfully public, like government real estate records.

Title agencies are in scope. The FTC’s guide to the Privacy Rule lists real estate settlement services as a financial activity. If your firm is significantly engaged in it, you’re a financial institution under GLBA. That’s the reason I treat title companies as a regulated vertical and not just an office with a lot of PDFs.

What counts as NPI in a title file?

Almost everything in the file that isn’t recorded at the courthouse. The federal rule’s examples include application information, account balances, payment history, information from a consumer report, and a line most people skip: “the fact that an individual is or has been one of your customers.” Your buyer list is NPI. A spreadsheet of this month’s closings is NPI.

ALTA’s own definition, in the Best Practices Framework 4.2, gets specific. NPI includes a name combined with a Social Security number, driver’s license number, state ID number, credit or debit card number, or other financial account number. And it says NPI can exist on paper and in electronic form.

In a title office, that’s:

• Copies of driver’s licenses and state IDs from signers
• Social Security numbers on payoff requests and tax forms
• Bank account and routing numbers for incoming and outgoing wires
• Payoff letters with loan numbers and balances
• Settlement statements and closing disclosures
• Lender packages and anything pulled from a consumer report

Here’s the line that matters. A recorded deed or mortgage is public. The closing file behind it is not. Don’t let “it’s all public record anyway” become the office’s excuse.

Where does NPI leak in a title office?

Usually not from the closing software. It leaks from the copies of the file that pile up around it.

Email. Payoff letters, ID scans, and wire instructions go back and forth with lenders, agents, and consumers all day. Every attachment sits in a sent folder and an inbox, often for years. One compromised mailbox exposes all of it. That’s exactly what happened in our BEC wire fraud case: the attacker sat in a closer’s inbox and could see the deals.

Scanners. Scan-to-email and scan-to-folder are convenient, so the copier ends up mailing IDs to personal addresses or dropping them in a share nobody cleans out.

Shared drives and desktops. Someone saves a payoff to their desktop to fill out a form. Someone exports a closing list to Excel. Those copies don’t follow the closing software’s permissions or retention. It’s the same pattern we found hunting plaintext passwords on endpoints: the system of record is fine, the side copies aren’t.

Closing software and other vendors. Your closing platform, e-signing, remote notary, and document storage vendors all hold NPI. ALTA calls these out by name, down to API integrations, plug-ins, and AI tools.

Paper. Files on desks, in unlocked cabinets, in the recycling bin.

What do the GLBA and ALTA Best Practices expect you to do with it?

They expect a written plan and controls that actually match it. I won’t re-explain the whole rule here. Our GLBA Safeguards Rule guide for small firms covers that. The parts that land hardest on NPI in a title office are these.

The FTC’s Safeguards Rule requires you to:

• Know where the data is. The FTC’s plain-English summary says to inventory where data is “collected, stored, or transmitted.”
• Encrypt customer information at rest and in transit over external networks.
• Use multi-factor authentication for anyone accessing your information systems.
• Oversee your service providers, by contract and by periodic review.

ALTA’s Pillar 3 says to adopt a written information security plan (WISP) and a written privacy plan to protect NPI. Its procedures include multi-factor authentication on systems containing NPI, unique logins, timely software updates, prohibiting or controlling removable media, physically restricting NPI to authorized people, a tested incident response plan, staff training, and vetting vendors that touch NPI.

None of this is exotic. Most of it is enforced MFA, encrypted laptops, a cleaned-up inbox, and knowing which vendors have your files.

How long do you keep it, and how do you get rid of it?

Under the Safeguards Rule, you need procedures to securely dispose of customer information, in any format, no later than two years after you last used it to serve that customer (16 CFR 314.4(c)(6)). There are exceptions: you can keep it if you need it for business operations or another legitimate purpose, if a law or regulation requires you to keep it, or if targeted disposal isn’t reasonably feasible. You’re also required to review your retention policy periodically to cut down on what you keep.

Title files often have a legitimate reason to stick around. ALTA’s Pillar 3 says the same thing: retain records for the periods the law prescribes, and dispose of paper and electronic records in a way that protects the NPI. So write down how long each kind of record is kept and why. Then actually purge the stray copies: the email attachments, the scan folder, the desktop exports. The closing software’s copy is the one you meant to keep. The rest are just exposure.

Disposal means shredding paper and wiping drives on retired PCs, copiers, and scanners. It doesn’t mean dragging a folder to the recycle bin.

Key takeaways

What this looks like when we do it

For a title agency, we start by finding the NPI. We scan endpoints and shares for the side copies, the same filename-sweep approach from the password file audit, and we look at what the scanners and mailboxes are actually doing. Then we close the obvious doors. That means MFA enforced across the tenant, not just enrolled. In my experience, that gap is one of the most common findings in title company email systems. We add full-disk encryption with escrowed keys, email authentication and filtering, and monitoring for the forwarding rules and odd sign-ins that showed up in our BEC case.

Then we write it down. You get the WISP, the retention schedule, and a vendor list that an underwriter or lender review can read. That’s the same baseline behind our managed IT for title companies, and the same GLBA work we do for mortgage brokers. It’s month-to-month, with a 3-user minimum and no multi-year contract.

If you’re not sure where your NPI lives today, get in touch. We’ll walk through it on a call.