Editorial note: This article is for general educational purposes and is not legal advice. Financial firms should work with qualified legal, privacy, cybersecurity, and compliance professionals to apply Regulation S-P to their specific operations.
The Securities and Exchange Commission has given Regulation S-P a much-needed modernization makeover. Think less “dusty filing cabinet with a tiny lock” and more “serious cyber-resilience program with receipts.” The SEC adopted amendments to Regulation S-P on May 16, 2024, strengthening privacy and customer-information safeguards for many securities-industry firms.
The updated rule matters because financial data breaches are no longer rare, distant events that happen only to giant companies with dramatic news helicopters circling overhead. A small registered investment adviser, broker-dealer, transfer agent, or fund complex can hold enough sensitive information to create real harm when systems, vendors, email accounts, or cloud platforms are compromised.
At its core, the amended Regulation S-P requires covered institutions to build stronger written safeguards, respond to security incidents in a structured way, oversee service providers more carefully, and notify affected individuals when sensitive customer information may have been accessed or used without authorization. In other words, firms cannot simply discover a breach, open a group chat, and hope the problem develops a conscience.
What Is Regulation S-P?
Regulation S-P is the SEC’s privacy rule for certain financial institutions. It was originally adopted in 2000 under the Gramm-Leach-Bliley Act, commonly called GLBA. The rule has long focused on how covered firms protect nonpublic personal information, provide privacy notices, and safeguard customer records.
The 2024 amendments represent the first major overhaul of the regulation in more than two decades. That timing is important. The old rule was created before cloud software became standard, before remote work became widespread, before ransomware became a billion-dollar headache, and before nearly every business vendor had a login portal, mobile app, API connection, and a cheerful promise to “take security seriously.”
The SEC’s updated approach recognizes that customer information can move through a complicated web of internal systems, custodians, portfolio-management platforms, customer relationship management tools, payroll providers, email services, cloud storage accounts, and outsourced technology providers. Regulation S-P now expects firms to manage that reality instead of pretending that sensitive information lives peacefully in one locked office drawer.
Which Firms Must Follow the Updated Regulation S-P Rules?
The amended Regulation S-P applies broadly to SEC-regulated covered institutions. These generally include broker-dealers, funding portals, registered investment advisers, registered investment companies, business development companies, and transfer agents.
Transfer agents are especially notable because the amendments extend safeguard requirements to them more directly. Since transfer agents often handle securityholder information, their role in protecting sensitive data is no longer a side note in the compliance manual. It is a full chapter, preferably one that everyone has actually read.
The exact responsibilities can vary depending on the type of institution, the data it maintains, and its existing obligations under other SEC, state, federal, contractual, or industry requirements. Still, the central message applies across the board: customer information must be protected before, during, and after a cybersecurity incident.
The Biggest Changes in the SEC’s Regulation S-P Amendments
1. A Required Incident Response Program
The headline change is the requirement for a written incident response program. Covered institutions must develop, implement, and maintain policies and procedures reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information.
A viable incident response program should do more than list the chief compliance officer’s phone number and a vague instruction to “contact IT.” It should help the firm assess the nature and scope of an incident, identify which systems and information may be involved, contain the incident, control further damage, and recover operations safely.
For example, if an employee’s email account is compromised, the firm should have a process for preserving evidence, disabling access, reviewing mailbox activity, determining whether customer information was exposed, coordinating with outside experts when needed, and documenting decisions. The goal is disciplined action, not frantic improvisation.
2. Customer Breach Notifications Within a Defined Timeframe
The amendments require covered institutions to notify affected individuals when their sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization. Notice must be provided as soon as practicable and no later than 30 days after the firm becomes aware that an incident occurred or is reasonably likely to have occurred.
The notice must be clear and conspicuous. It generally needs to explain the incident, describe the sensitive information involved, tell affected individuals how they can contact the firm, and provide practical steps for protecting themselves. Those steps may include obtaining free credit reports, considering fraud alerts, and reviewing federal identity-theft resources.
There is an important exception. A firm may decide not to notify individuals if, after a reasonable investigation, it determines that the sensitive customer information has not been, and is not reasonably likely to be, used in a way that would result in substantial harm or inconvenience. That is not a loophole for optimism. It requires a supportable investigation and written reasoning.
3. A Broader Definition of Customer Information
The amended rule expands the information protected by the safeguards and disposal requirements. The key term is now customer information, which generally covers records containing nonpublic personal information in any form that are in the possession of a covered institution.
This broader definition matters because firms may hold information about people who are not directly their own current customers. An adviser may receive client information from a custodian. A fund administrator may process information for another entity. A service provider may host information belonging to multiple financial institutions. Data does not become harmless simply because it arrived through someone else’s system.
The practical takeaway is simple: map your data based on where it is stored, who can access it, and why it exists. “We thought that was the custodian’s responsibility” is not a satisfying compliance strategy, even if it is delivered with excellent PowerPoint animation.
4. Stronger Oversight of Service Providers
The SEC amendments make third-party oversight a central part of the incident response program. Covered institutions must establish, maintain, and enforce written policies and procedures reasonably designed to oversee service providers through due diligence and monitoring.
Service providers that handle customer information should be required to take reasonable measures to protect it from unauthorized access or use. They also must notify the covered institution as soon as possible, and no later than 72 hours after becoming aware of a breach involving customer information they process.
This requirement is a major operational issue for firms that rely on cloud platforms, managed service providers, customer relationship management software, cybersecurity vendors, portfolio-management systems, and outsourced administrative providers. Vendor contracts may need updates, especially where current language says a provider will notify the firm “promptly” or “within a commercially reasonable period.” Those phrases can be charming, but they are not always clock-friendly.
5. Expanded Disposal Requirements
The updated disposal rule requires covered institutions to adopt written policies and procedures for properly disposing of customer information and consumer information. Firms must take reasonable measures to protect against unauthorized access to or use of that information during disposal.
That means retirement of old devices, deleted databases, archived client files, decommissioned cloud storage, paper records, backup media, and employee laptops should receive attention. A company cannot call data “deleted” just because it vanished from the desktop. Data has a remarkable ability to survive in old backup folders, forgotten spreadsheets, and the digital equivalent of a junk drawer.
6. More Documentation and Recordkeeping
The SEC also expects firms to document compliance. Covered institutions should retain written policies and procedures, records of detected incidents, documentation of investigations, notification decisions, copies of notices, and service-provider oversight materials under applicable SEC recordkeeping requirements.
Documentation is not merely an administrative chore. During an examination, a regulator will likely want to understand what happened, who made decisions, what evidence was reviewed, why notifications were or were not sent, and how the firm improved after the event. A well-kept incident file can demonstrate thoughtful governance. A pile of disconnected emails can demonstrate that everyone had a very busy Tuesday.
Compliance Dates: Why Regulation S-P Is Already a Live Issue
The amendments became effective on August 2, 2024. Larger covered institutions had to comply by December 3, 2025. Smaller covered institutions had to comply by June 3, 2026.
As of June 25, 2026, the phased compliance period has ended. That means smaller advisers, smaller broker-dealers, smaller funds, and other covered institutions should treat Regulation S-P as an active compliance obligation rather than a future project sitting politely at the bottom of a to-do list.
A Simple Example of How the New Rule Works
Imagine a registered investment adviser uses a third-party cloud provider to store account-opening documents, tax records, identification documents, and beneficiary information. The provider discovers that an attacker accessed a system containing customer information.
Under the amended Regulation S-P framework, the provider should notify the adviser quickly and no later than 72 hours after becoming aware of the breach. The adviser should activate its incident response program, investigate the incident, assess what information may have been accessed, contain further exposure, and determine whether sensitive customer information was affected.
If sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, the adviser generally must notify affected individuals as soon as practicable and no later than 30 days after becoming aware of the incident. The adviser may use the vendor to help send notices, but the adviser remains responsible for meeting the regulatory requirement.
This example shows why vendor management, contract language, data mapping, legal review, cybersecurity response, and customer communications must work together. Regulation S-P is not just a legal rule. It is a team sport, and nobody wants to discover the playbook during the fourth quarter.
How Firms Can Build a Practical Regulation S-P Compliance Program
A strong compliance response begins with a clear inventory of customer information. Firms should identify what data they hold, where it lives, which vendors process it, who can access it, how long it is retained, and how it is disposed of. This exercise often reveals more risk than expected, particularly in shared drives, email archives, legacy systems, and unsanctioned collaboration tools.
Next, firms should update their written policies and procedures. The policies should address detection, investigation, containment, recovery, customer notices, vendor escalation, documentation, and post-incident improvement. A firm should also identify decision-makers before an incident occurs. Waiting until a breach to decide who can approve notifications is like buying a fire extinguisher after the kitchen has become a barbecue.
Third, firms should review vendor contracts. Look for data-security requirements, notice obligations, cooperation duties, forensic support, audit rights, subcontractor controls, and clear responsibility for customer communications. Contracts should match the firm’s regulatory obligations rather than merely reflect the vendor’s preferred template.
Finally, firms should test the program. Tabletop exercises can reveal whether the compliance team, information technology staff, executive management, outside counsel, insurance contacts, and vendors know their roles. A response plan that has never been tested may look excellent in a PDF and become surprisingly shy when a real incident arrives.
Why the Regulation S-P Amendments Matter for Customers
For customers, the amended rule is fundamentally about trust. Investors may not understand every cybersecurity control behind the scenes, but they reasonably expect financial firms to protect personal information and communicate honestly when something goes wrong.
Timely notice helps customers take protective action. Better vendor oversight reduces the chance that critical security failures remain hidden. Stronger disposal practices reduce the risk that old information becomes tomorrow’s fraud problem. And better documentation pushes firms to make decisions based on evidence instead of wishful thinking.
The SEC’s message is not that every incident can be prevented. That would be a lovely world, but it would also be one where passwords are never reused and every printer works on the first attempt. The message is that regulated firms must be prepared, transparent, and accountable when customer information is at risk.
Practical Experiences and Lessons From Regulation S-P Readiness
Real-world Regulation S-P readiness efforts tend to teach the same lesson: the hardest part is rarely writing the policy. The hard part is making sure the policy matches reality. A firm may have a polished incident response document, but the document is only useful if it reflects the actual technology environment, vendor relationships, staffing structure, and decision-making process.
One common experience is discovering that the firm’s customer data is spread across more systems than anyone expected. Compliance may know about the portfolio-management platform. Operations may know about the account-opening portal. Marketing may have a customer relationship management system. Finance may keep tax documents in a separate cloud drive. Individual employees may have old files saved locally “just in case.” That phrase should make every information-security professional take a slow, meaningful breath.
Another frequent challenge involves vendors. Many firms initially assume that a large technology provider has all security issues under control. Large providers may have strong programs, but that does not eliminate the covered institution’s responsibility. Regulation S-P requires firms to perform due diligence and ongoing monitoring, not simply admire a vendor’s logo and hope for the best. Reviewing contracts, security questionnaires, audit reports, incident-notification terms, and subcontractor arrangements becomes essential.
Teams also learn that the 30-day notification deadline can move quickly. Thirty days may sound generous until a firm needs to confirm what happened, preserve evidence, engage forensic experts, identify affected individuals, coordinate with vendors, obtain legal advice, prepare notices, and answer worried customer questions. The best preparation is to create notice templates, decision trees, escalation contacts, and communication workflows before a breach occurs.
Tabletop exercises often expose the awkward but valuable questions. Who has authority to declare an incident? Who decides whether information is sensitive? Who contacts the cyber insurer? Who speaks with law enforcement? Who approves customer notices? Who handles the website, call center, and social media response if customers start asking questions at once? A tabletop session can feel like a rehearsal for a disaster movie, but it is far less expensive than starring in one.
Documentation is another area where experience matters. A firm does not need to create a novel for every security alert. It does need to create a coherent record of what was discovered, what evidence was reviewed, what conclusions were reached, and why particular actions were taken. A clear incident log helps management learn from the event and helps the firm explain its response to regulators, customers, insurers, and business partners.
Finally, strong compliance programs treat Regulation S-P as an ongoing operational discipline rather than a one-time project. Technology changes. Vendors change. Employees change. Attack methods change. Customer information accumulates in new places. The smartest approach is to revisit the data map, vendor inventory, incident response plan, training program, and disposal process regularly. A cybersecurity program is not a decorative plant; it needs attention, testing, and occasional pruning before it takes over the office.
Conclusion
The SEC’s amendments to Regulation S-P significantly raise expectations for protecting customer information in the securities industry. Covered institutions now need stronger incident response programs, clearer customer-notification procedures, more disciplined vendor oversight, broader data safeguards, improved disposal controls, and reliable documentation.
For firms that have already met the deadlines, the next challenge is maintaining a program that works in practice. For firms still catching up, the priority is clear: understand the data, strengthen the response plan, fix vendor contracts, test the process, and document the work. Regulation S-P compliance is no longer a future concern. It is part of the everyday business of earning and keeping customer trust.