Federal law, not Virginia’s consumer privacy act, does most of the work of protecting your mortgage file. Your application bundles your Social Security number, pay history, bank balances, and credit data in one place. The mortgage data privacy protection laws that govern it are mainly the Gramm-Leach-Bliley Act, the FTC Safeguards Rule, and the Fair Credit Reporting Act. Virginia’s Consumer Data Protection Act largely steps aside for financial institutions. Duane Buziak explains which law does what, which rights you can use, and how Stafford buyers, from Quantico commuters to Garrisonville families, can keep their files safe. Rules change, so this guide is current as of 2026.
What a Mortgage Application Actually Collects
A full application file is one of the most complete personal profiles that exists outside a government agency. Expect to provide:
- Your Social Security number and date of birth
- W-2s, pay stubs, and two years of tax returns, or business returns if you are self-employed
- Two or more months of bank and retirement statements
- Employer name, address, and employment history
- A credit report pulled with your authorization
- Property details, the purchase contract, and the insurance policy
Consider two illustrative files. A Marine stationed at MCB Quantico buying in Embrey Mill submits a Leave and Earnings Statement (LES), possibly a DD-214 for a prior service period, and a VA Certificate of Eligibility. A dual-income family in Garrisonville submits four W-2s, joint tax returns, and several accounts’ worth of statements. The documents differ, but both files hold everything a thief needs.
A note for military buyers
For VA loans, the Certificate of Eligibility can usually be pulled electronically using your SSN and date of birth. That means fewer documents travel by email, which reduces exposure. You may still need to supply an LES or DD-214 to confirm status, so how those files are uploaded matters. If you are choosing a lender, see our guide to choosing a mortgage broker for military families.
This is why mortgage files attract fraud. Name, SSN, birth date, income, and account numbers together are enough to open credit in your name or to impersonate you to your own closing agent.
The Federal Laws Behind Mortgage Data Privacy Protection
Four federal frameworks touch your file. Only the first three are really about privacy.
Gramm-Leach-Bliley Act (GLBA)
GLBA treats the information you give a financial company as nonpublic personal information. Covered companies, including mortgage brokers and lenders, must give you a privacy notice explaining what they collect and with whom they share it. Where the law gives you a choice, the notice must explain how to opt out. The FTC’s GLBA guidance summarizes the requirements.
FTC Safeguards Rule
Under GLBA, the FTC’s Safeguards Rule requires non-bank financial companies, mortgage brokers among them, to maintain a written information security program covering access controls, encryption, staff training, and oversight of vendors. Amendments added a requirement to notify the FTC after certain breaches affecting a large number of consumers. Confirm the current text on the FTC’s Safeguards Rule page.
Fair Credit Reporting Act (FCRA)
FCRA allows your credit report to be pulled only for a “permissible purpose,” such as a credit application you initiated. It also gives you the right to see your reports and dispute errors. The Consumer Financial Protection Bureau publishes plain-language guides to these rights. Related fairness rules are covered in our explainer on fair lending practices every mortgage lender must follow.
RESPA and TRID
The Real Estate Settlement Procedures Act and the TILA-RESPA Integrated Disclosure rules govern cost and loan-term disclosures, such as the Loan Estimate and Closing Disclosure. They protect you from surprise fees. They are not privacy laws, so do not count on them to secure your documents. To see what those fee disclosures typically contain, review the average mortgage closing costs breakdown.
Side by side
- GLBA. Covers financial institutions, including brokers and lenders. Gives you a privacy notice and limited opt-out rights. Applies to everything you hand over in the application.
- FTC Safeguards Rule. Covers non-bank financial companies such as mortgage brokers. Requires a written security program on their side. Applies to how your file is stored, accessed, and transmitted.
- FCRA. Covers credit bureaus and anyone who uses credit reports. Limits who may pull credit and gives you dispute rights. Applies to your credit report and inquiries.
- RESPA/TRID. Covers lenders, brokers, and settlement providers. Gives you disclosures about costs and terms. Applies to the Loan Estimate and Closing Disclosure, not data security.
- Virginia CDPA. Covers businesses handling Virginia residents’ data, with exemptions. Gives access, correction, deletion, and opt-out rights. Applies only where the data is not GLBA-covered.
Virginia’s Consumer Data Protection Act and Its Mortgage Exemptions
Virginia’s Consumer Data Protection Act (CDPA) took effect January 1, 2023. It lets residents ask a business to confirm what personal data it holds, correct it, delete it, and opt out of targeted advertising, sales of personal data, and certain profiling. The Virginia Attorney General enforces it. The statute is in Title 59.1, Chapter 53 of the Code of Virginia.
Here is the misconception to correct. The CDPA exempts financial institutions and data subject to GLBA. As of 2026, that means most of what you hand a mortgage broker or lender falls under the federal rules, not the CDPA. Confirm the exemption wording in the Code, because amendments are possible.
What that means for a Stafford borrower
Your strongest mortgage-specific rights usually come from GLBA (the privacy notice and sharing opt-outs) and FCRA (access to your credit file and error disputes). The CDPA may still reach data outside GLBA’s scope, such as browsing activity on a company’s website or marketing data that is not part of your loan file. If you want to use a CDPA right, you can send a request, but expect the answer to depend on whether the data is exempt.
Deleting a loan file
A common mistake is assuming a state privacy law lets you erase your loan file after you apply or close. It does not. Brokers, lenders, and investors must retain loan records for legal, audit, and investor reasons, often for years. What you can do is ask how long records are kept, how they are secured, and who has access. Anyone handling your file should be able to answer that plainly.
Your Rights When a Lender Shares or Sells Your Data
Reading the privacy notice
The GLBA notice lists the categories of information collected, the kinds of companies it is shared with, and whether you can opt out. Sharing needed to process your loan, such as sending your file to an underwriter, appraiser, or title company, is allowed by law and cannot be opted out of. That hand-off is part of the mortgage underwriting process. Sharing with unaffiliated companies for their own marketing generally comes with an opt-out right. Read that section first.
Trigger leads and prescreen offers
After a credit inquiry, many borrowers get calls and texts from lenders they never contacted. These come from “trigger leads,” where the credit bureau tells other companies you applied for a mortgage. Federal legislation passed in 2025 restricts the sale of trigger leads, with exceptions, but do not assume your phone will stay quiet. Check the current rules at consumerfinance.gov. You can also opt out of prescreened credit and insurance offers through the industry’s service at optoutprescreen.com.
Credit freeze, fraud alert, and soft-pull pre-approval
A credit freeze blocks new creditors from viewing your report, and federal law makes it free at all three bureaus. A fraud alert only asks creditors to verify your identity. Active-duty service members can place an active duty alert, which is relevant for Quantico-based buyers who deploy. The FTC explains the differences. If you freeze your credit, lift it temporarily before the lender pulls your report. A soft-pull pre-approval review lets you gauge eligibility without a hard inquiry first.
Shopping without wrecking your score
Suppose a Garrisonville buyer asks three mortgage companies for quotes within two weeks. Scoring models generally treat multiple mortgage inquiries in a short window as one. The window length varies by scoring version, with common figures ranging from 14 to 45 days. Verify the current rules before relying on a specific number. Shopping within a tight window is the safest practice, and our step-by-step guide on how to shop for mortgage rates walks through it.
How to Check That Your Mortgage Professional Protects Your Data
Ask three questions before you send a single document. How will documents be collected: a secure portal or email attachments? Can I see your privacy notice? Who will have access to my file? A good answer is specific, not vague. If you are weighing options, this walkthrough on how to compare mortgage lenders can help you build a checklist.
Then verify licensing. NMLS Consumer Access lets you look up any mortgage professional by name or number. Duane Buziak is NMLS #1110647. The lookup shows license status by state and any public regulatory actions.
Wire fraud at closing
Closing is where criminals strike hardest. They hack or spoof an email account and send “updated” wiring instructions. The FBI’s Internet Crime Complaint Center, ic3.gov, publishes an annual report on losses from business email compromise and real estate fraud. Check its latest edition for current figures.
Consider an illustration. Suppose you buy a $475,000 home in Embrey Mill with 5% down, which is $23,750. Add roughly $9,500 in closing costs, and you may wire about $33,250 to the title company. If a fake email redirects that wire, the entire amount can disappear in hours. Always call the title company at a number you already know, not one in the email, and confirm the account details before sending anything.
Red flags
- A request to text your SSN or bank login
- An unsolicited call claiming to be your lender and asking you to “verify” details
- Pressure to wire funds quickly or to change instructions at the last minute
- Any email with new payment instructions that you did not expect
Duane Buziak, who has worked in mortgage since 2014, walks Stafford clients through secure document upload and explains each step, so you always know what is being requested and why.
What to Do If Your Mortgage Data Is Exposed
Act in this order:
- Contact your broker or lender at a number you have verified independently, not one from a suspicious message.
- Place a fraud alert or credit freeze with the bureaus. A freeze is stronger; an alert is easier to maintain during an active loan.
- Review your credit reports at AnnualCreditReport.com for accounts or inquiries you do not recognize.
- Report identity theft at IdentityTheft.gov, which generates a recovery plan and an official report.
For mortgage-related complaints, file with the Consumer Financial Protection Bureau and with the consumer protection office of the Virginia Attorney General.
Stay alert for follow-on scams. After a breach, criminals sometimes call or email with your real loan details to sound legitimate. Treat any change to closing or payment instructions as suspect until you confirm it by phone.
Keep a log with dates, names, call durations, and reference numbers. If a dispute arises with a bureau, a creditor, or a company, that record saves time and strengthens your case. If an error on your credit report has already hurt your application, see what to do after a denied mortgage application.
Eight Questions Stafford Borrowers Ask About Mortgage Privacy
Which law protects my mortgage application data?
Mainly the Gramm-Leach-Bliley Act and the FTC Safeguards Rule, with the Fair Credit Reporting Act covering your credit report. Together they govern sharing, security, and credit access.
Does Virginia’s CDPA cover my mortgage file?
Usually not. The CDPA exempts financial institutions and data covered by GLBA, so most loan file data falls under federal rules. Confirm the current text in the Code of Virginia.
Is a mortgage broker covered by the FTC Safeguards Rule?
Yes. Non-bank financial companies, including mortgage brokers, are covered and must keep a written information security program.
Can I opt out of my information being shared?
You can opt out of certain sharing with unaffiliated companies for marketing. You cannot opt out of sharing needed to process your loan, such as sending files to underwriting or title.
Can I make a lender delete my loan file?
No. Lenders and brokers must keep records for legal and investor purposes. You can ask how long they retain them and how they are secured.
Is a credit freeze free, and will it block my mortgage?
Freezes are free under federal law. They block lender pulls until you lift them, so thaw the freeze temporarily before your lender pulls credit.
Why do I get calls from other lenders after applying?
Credit bureaus may sell trigger leads. New federal limits apply as of 2026, and you can opt out of prescreened offers at optoutprescreen.com.
How do I avoid wire fraud at closing?
Verify wiring instructions by phone using a number you already know, never one from the email, and be suspicious of any last-minute changes.
Ask How Your Documents Will Be Handled Before You Apply
The takeaway is simple. GLBA, the Safeguards Rule, and FCRA carry the weight of protecting your mortgage file, while Virginia’s CDPA mostly applies to data outside it. That makes the practical questions yours to ask: how are documents collected, who sees them, and how are wiring instructions verified. Call Duane Buziak at Stafford Mortgage by Duane Buziak at 540-870-5594 and ask before you submit anything.
Your dream home in Stafford County is closer than you think, with personalized mortgage solutions and local expertise that puts your family’s needs first. Connect with Duane Buziak today to explore flexible home loan options, discover competitive rates, and get the trusted guidance that’s earned recognition as one of Virginia’s top mortgage professionals.