SEC Regulation S-P

Why does it matter?

Regulation S-P is the SEC's GLBA rule and, since the 2024 amendments, its data breach rule for the securities industry: examiners test the privacy notice, the opt-out mechanics, the written safeguards and now the incident response program, the 30-day individual notice, the 72-hour service provider notice and the records that prove each step. The amendments also widened what must be protected: customer information now includes records about other financial institutions' customers that the firm holds or that are handled on its behalf, sensitive customer information is defined with examples from Social Security numbers to account credentials, and transfer agents registered with the SEC or another appropriate regulatory agency are covered institutions for the first time.

Key benefits include:

• One rule for notices and safeguards

Privacy notices, opt-outs and the safeguards program sit in the same Subpart, so the customer-facing promise in the §248.6 notice and the security program behind it are examined together.

• A defined response program

§248.30(a)(3) requires procedures to assess the nature and scope of an incident, identify the systems and types of customer information involved, contain and control the incident, and notify affected individuals.

• A fixed notice deadline

Notice as soon as practicable and no later than 30 days after becoming aware of unauthorized access or use, unless the firm determines after a reasonable investigation that the sensitive customer information is not reasonably likely to be used to cause substantial harm or inconvenience (§248.30(a)(4)).

• Service providers on a 72-hour clock

§248.30(a)(5) requires written policies for due diligence and monitoring of service providers and for their notice to the firm no later than 72 hours after becoming aware of a breach of a customer information system they maintain.

• Annual notice relief

§248.5(e) removes the annual privacy notice for firms that share nonpublic personal information only under the §248.13 to §248.15 exceptions and have not changed the practices disclosed in their last notice.

How does it work?

Scope and definitions come first. §248.1 limits the privacy provisions to nonpublic personal information about individuals who obtain financial products or services primarily for personal, family or household purposes from brokers, dealers, investment companies and SEC-registered investment advisers; §248.3 defines consumer, customer, nonpublic personal information and nonaffiliated third party, and §248.2 makes the model privacy form in Appendix A a safe harbor for notice content. §248.4 requires a clear and conspicuous initial notice, §248.5 an annual notice during the customer relationship, §248.6 the content (categories collected and disclosed, categories of recipients, the opt-out right and the firm's confidentiality and security policies) and §248.9 the delivery rules.

The limits and exceptions follow. §248.10 bars disclosure to a nonaffiliated third party unless the initial notice, an opt-out notice and a reasonable opportunity to opt out have been given and the consumer has not opted out; §248.11 limits what a recipient may do with information received under an exception; §248.12 prohibits sharing account numbers for marketing. §248.13 allows disclosure to service providers and joint marketers under a contract that limits their use, §248.14 for processing and servicing transactions the consumer requests, and §248.15 with consent, to protect against fraud, to auditors, regulators and law enforcement, in a sale or merger and to comply with law. §248.16 and §248.17 preserve the Fair Credit Reporting Act and stricter state laws.

§248.30 is the safeguards rule as amended in 2024. Paragraphs (a)(1) and (2) require written policies and procedures reasonably designed to ensure the security and confidentiality of customer information, protect against anticipated threats or hazards and protect against unauthorized access or use that could result in substantial harm or inconvenience. Paragraph (a)(3) adds the response program, (a)(4) the individual notice with its 30-day deadline, the Attorney General delay (30 days, 30 more, then 60 in extraordinary circumstances) and prescribed contents, and (a)(5) the service provider oversight and 72-hour notice. Paragraph (b) requires proper disposal of consumer and customer information, (c) the records unregistered investment companies must keep, and (d) the definitions of covered institution, customer information and sensitive customer information.

Key Elements

• Covered institutions (§248.30(d)(3))

Any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency.

• Privacy and opt-out notices (§248.4 to §248.9)

Initial and annual notices with the §248.6 content, the opt-out notice and methods, revised notices and delivery rules; the Appendix A model form satisfies the content requirements.

• Limits and exceptions (§248.10 to §248.15)

Opt-out before sharing with nonaffiliated third parties, limits on redisclosure and account-number sharing, and the service provider, transaction-processing and other exceptions.

• Safeguards program (§248.30(a)(1) and (2))

Written administrative, technical and physical safeguards for customer information, which includes records about other financial institutions' customers in the firm's possession.

• Incident response and notice (§248.30(a)(3) and (4))

Assess, contain and notify; individual notice within 30 days of becoming aware, with contents from the incident description to fraud-alert and credit-report guidance; notice to all individuals in an affected system when the specific ones cannot be identified.

• Service providers, disposal and records (§248.30(a)(5), (b) and (c))

Due diligence and monitoring, 72-hour breach notice to the firm, delegation of customer notice by written agreement, disposal policies, and documentation of incidents, determinations, delays and agreements.

What does it cover?

The privacy provisions apply to brokers, dealers, investment companies and investment advisers registered with the SEC, including foreign ones registered with the Commission, for nonpublic personal information about individuals who obtain products or services for personal, family or household purposes (§248.1(b)); futures commission merchants and introducing brokers that comply with the CFTC's privacy rules are deemed compliant (§248.2(c)). §248.30 reaches the same firms plus transfer agents registered with the SEC or another appropriate regulatory agency, and its customer information definition covers records about other financial institutions' customers that the firm holds or that are handled on its behalf. Banks, thrifts and credit unions follow their own GLBA regulators, and firms under FTC jurisdiction follow the FTC Safeguards Rule.

What are its objectives?

§248.1(a) and §248.30(a)(2) state what the subpart is for.

Give customers notice of the institution's privacy policies and practices.

Set the conditions under which nonpublic personal information may be disclosed to nonaffiliated third parties.

Let consumers opt out of most disclosures to nonaffiliated third parties.

Ensure the security and confidentiality of customer information and protect it against anticipated threats or hazards.

Protect against unauthorized access or use that could result in substantial harm or inconvenience, and tell affected individuals when it happens.

Framework in Context

Regulation S-P is the SEC's implementation of Title V of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 to 6809); the FTC Safeguards Rule (16 CFR Part 314) and the banking agencies' interagency guidelines are the parallel rules for other financial institutions, and the 2024 release says the 72-hour service provider deadline was informed by the deadline in the Cyber Incident Reporting for Critical Infrastructure Act of 2022. The rule sits beside Regulation S-AM (affiliate marketing) and Regulation S-ID (identity theft red flags) in the same Part, and beside state breach notification laws, which the §248.30(a)(4) notice does not displace. The safeguards program is where a firm's ISO/IEC 27001 or NIST CSF controls and the SOC 2 reports it obtains from service providers become examination evidence.

Common Framework Mappings

Covered institutions map Regulation S-P's notice, safeguard and response duties to the privacy and security frameworks they already operate.

Mapped frameworks include:

CCPA/CPRA

GDPR

GLBA Safeguards Rule (16 CFR Part 314)

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

NIST 800-53 Rev.5

SOC 2