Private-independent schools typically do not think of themselves as financial institutions. But their engagement in certain financial activities may subject them to obligations under the federal Financial Services Modernization Act of 1999, commonly known as the Gramm-Leach-Bliley Act (GLBA). Additionally, every school that hires any third-party vendor with access to the “nonpublic personal information” (NPI) of employees or students should be concerned about the terms and conditions of the contract relating to data protection and response to data breaches. To the extent that those vendors perform financial activities and are covered by GLBA, then contract provisions relating to GLBA compliance are important and the school should ensure that they are adequate.