The Gramm-Leach-Bliley (GLB) rules are particular about what your Privacy Notice says. Using the correct model form will avoid confusion.
More importantly, you MUST DELIVER THE FORM BEFORE YOU SHARE ANY INFORMATION ABOUT A CUSTOMER WITH AN AFFILIATE OR PARTNER. So before you register your loan with a wholesaler, submit for pre-approval, order an appraisal, etc.
If you have a written privacy policy, it should outline how you protect customer data, what information you collect, and how you share that information. The GLB rules are precise about what you must say and how a customer agrees to share information.
First, there is a difference between your "Privacy Policy" and your "Privacy Notice." A privacy policy explains how you manage private information. The privacy notice describes what you do with that information, safeguards it and how it gets shared, and how a consumer can opt out of information sharing.
https://www.mortgagenewsdigest.com/2022/01/wheres-my-privacy-policy.html
We see many companies using older, cribbed, or outdated privacy notices. While it is possible to create a form that says the same things as the model notice, do yourself a favor and use the Model Form. Most LOSs' have the form built in. If they don't, you can create yours right here on the Federal Reserve Form Builder Tool:
Privacy Notice Form Builder Tool
Some states have particular language requirements in the privacy notice, such as Vermont:
