The SEC’s amendments to Regulation S-P represent one of the most meaningful shifts in data protection expectations for registered investment advisers in years. What was once largely viewed as a disclosure-based rule centered on privacy notices has evolved into a framework requiring operational readiness, governance, and ongoing oversight.
With a compliance date of June 3, 2026 for smaller advisers, and a December 3, 2025 deadline that has already passed for larger entities, firms should already be evaluating whether their current practices meet the new standard. At its core, the amended rule makes one thing clear:
Safeguarding client information is no longer just a policy requirement, it is an operational compliance function.
From Policy to Practice
Historically, many firms approached Regulation S-P as a privacy notice exercise. The amendments move well beyond that.
Advisers are now expected to:
This aligns Regulation S-P with how the SEC has been conducting examinations in recent years, focusing on what firms actually do, not just what they disclose.
The Incident Response Program: Now a Requirement
The most immediate operational impact of the amended rule is the requirement to implement a written incident response program.
At a minimum, firms must have procedures designed to address the full lifecycle of an incident, including:
In practice, an effective program should include:
Clear Escalation Protocols
Defined Roles and Responsibilities
Decision-Making Frameworks
Many firms are not starting from zero, but they are often lacking the structure, coordination, and documentation needed to make these programs defensible in an examination.
The 30-Day Notification Clock
One of the most significant changes under the amended rule is the introduction of a defined notification timeline.
Firms are required to provide notice to affected individuals as soon as practicable, but no later than 30 days after becoming aware of an incident involving unauthorized access to sensitive customer information, unless a delay is requested by law enforcement.
Importantly:
There is a limited exception:
If, after a reasonable investigation, the firm determines that the incident is not reasonably likely to result in substantial harm or inconvenience, notification may not be required.
This places significant pressure on firms to:
In practice, this is where many advisers will struggle. Without a clearly defined process, delays in internal escalation or vendor communication can quickly consume a significant portion of the 30-day window.
Service Provider Oversight: Responsibility Cannot Be Outsourced
The amended rule makes explicit what regulators have been signaling for years:
Outsourcing a function does not outsource responsibility.
Advisers must implement policies and procedures designed to oversee service providers, including:
Critically, firms should require service providers to notify them within 72 hours of becoming aware of a breach.
This is not just a best practice, it is becoming a practical necessity. Without timely notification from vendors, firms may lose valuable time needed to assess the incident and meet their own regulatory obligations.
Documentation and Recordkeeping: If It’s Not Documented, It Didn’t Happen
The amended rule reinforces the importance of comprehensive documentation.
Firms should maintain records of:
In examinations, regulators are often less focused on whether an incident occurred, and more focused on how the firm responded and whether that response was documented and defensible.
Testing and Execution: Where Programs Break Down
A written policy alone is not sufficient.
Firms should:
Common pitfalls include:
The firms that manage incidents effectively are not necessarily those with the most sophisticated systems—but those with clear processes and defined accountability.
What This Means for RIAs
The amendments to Regulation S-P reflect a broader regulatory trend:
Compliance is becoming increasingly operational.
Cybersecurity, vendor management, and incident response are no longer siloed functions, they are central to an adviser’s fiduciary and regulatory obligations.
Firms that take a proactive, structured approach now, well ahead of the compliance deadlines will not only be better positioned for examinations, but will also build more resilient and trusted businesses.