Credit unions can now ignore federal guidance on data breaches without breaking a rule

The US credit union regulator is changing how it publishes rules about data breaches. It is moving specific guidance on how credit unions should respond to data breaches out of the official rulebook and into a separate guidance document.

This means credit unions no longer have to follow the specific steps in the guidance to be in compliance with the law. They still need a data breach response plan, but they can now create one that doesn't match the federal guidance without technically breaking a rule. This gives credit unions more flexibility, but it also means less clear expectations for how they should protect customer data.