SEC Regulation S-P & FINRA Safeguards

Regulation S-P’s privacy-notice and opt-out provisions apply to brokers, dealers, investment companies, and investment advisers registered with the Commission (17 CFR § 248.1(b)). The safeguards and disposal provisions reach further: § 248.30(d)(3) defines a “covered institution” as any broker or dealer, any investment company, and any investment adviser or transfer agent registered with the Commission or another appropriate regulatory agency. Transfer agents are therefore in scope for § 248.30 even though the subpart’s privacy-notice provisions do not list them.

The safeguards rule

Every covered institution must develop, implement, and maintain written policies and procedures addressing administrative, technical, and physical safeguards for customer information. Under § 248.30(a)(2) those policies must be reasonably designed to ensure the security and confidentiality of the information, protect against anticipated threats or hazards, and protect against unauthorized access or use that could result in substantial harm or inconvenience to any customer.

The disposal rule

Covered institutions other than notice-registered broker-dealers must properly dispose of consumer information and customer information by taking reasonable measures to protect against unauthorized access or use in connection with disposal, and must adopt written policies and procedures addressing that standard (§ 248.30(b)(1)–(2)). “Disposal” covers discarding or abandoning records and also selling, donating, or transferring any medium — including computer equipment — on which the information is stored (§ 248.30(d)(7)).

Incident-response program (2024 amendments)

The amendments the SEC adopted in May 2024 require the written policies to include a program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information (§ 248.30(a)(3)). It must provide procedures to assess the nature and scope of an incident, identify the customer information systems and types of information involved, contain and control the incident, and notify affected individuals.

Customer notification within 30 days

A covered institution must provide clear and conspicuous written notice to each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization — “as soon as practicable, but not later than 30 days” after becoming aware of the incident (§ 248.30(a)(4)(iii)). Notice is not required if a reasonable investigation shows the information is not reasonably likely to be used to cause substantial harm or inconvenience.

Service-provider oversight

The response program must include written policies and procedures reasonably designed to require oversight — through due diligence and monitoring — of service providers, including to ensure they take appropriate measures to protect against unauthorized access to customer information and to notify the institution no later than 72 hours after becoming aware of a breach. The duty to ensure affected individuals are notified stays with the covered institution (§ 248.30(a)(5)).

FINRA supervision & continuity

FINRA member broker-dealers carry supervisory obligations on top of Reg S-P. Rule 3110 requires a supervisory system and written supervisory procedures reasonably designed to achieve compliance with applicable securities laws and regulations, together with internal inspections of offices. Rule 4370 requires a written business continuity plan whose enumerated elements begin with data back-up and recovery, reviewed at least annually by senior management.

When customer records stay on infrastructure you control, there is no third party handling that data to diligence or supervise under Reg S-P.

Full, current text is maintained at the official source: 17 CFR Part 248 (Reg S-P); FINRA rules.