Option D. GLBA is the correct answer. The Gramm-Leach-Bliley Act (GLBA) is the U.S. law enacted in
1999 that requires financial institutions to explain their information-sharing practices and protect sensitive customer data through safeguards. That description matches the scenario exactly. Within CHFI v11, legal awareness is a core competency: the blueprint includes legal issues, privacy issues and legal compliance , other laws that may influence computer forensics , and rules tied to the admissibility and handling of digital evidence.
The other options do not fit the facts. GDPR is a European data protection regulation, not a 1999 U.S.
financial law. HIPAA governs protected health information in the healthcare sector. PCI DSS is an industry security standard for payment card data, not a law enacted in 1999 requiring disclosure of information-sharing practices. Because the company is a financial institution and the question highlights both privacy notice and safeguarding customer information , GLBA is the only answer that fully matches the scenario.
From a CHFI perspective, recognizing applicable legal frameworks is important because investigators and compliance personnel must understand which laws govern digital evidence, privacy obligations, and organizational handling of sensitive information.