What is SEC Regulation S-P, and what does its 2024 safeguards update require?

Regulation S-P now requires SEC-registered broker-dealers, investment companies, registered investment advisers and transfer agents to run a written incident response program for any unauthorized access to or use of customer information, and to notify affected individuals within 30 days of discovering it. The requirement comes from amendments the SEC adopted May 16, 2024 and published in the Federal Register June 3, 2024; the compliance deadlines, staggered by entity size, have both already passed as of this writing, so the rule is now in force rather than upcoming.

What was Regulation S-P before this update?

Regulation S-P is the SEC's long-standing privacy and data-safeguarding rule under the Gramm-Leach-Bliley Act, covering brokers and dealers, investment companies, SEC-registered investment advisers, and now transfer agents. Before the 2024 amendments, its safeguards rule told covered firms to protect customer records generally, but it set no specific requirement to have an incident response plan or to tell customers when something went wrong.

What do covered institutions now have to do when customer data is compromised?

They need a written incident response program, reasonably designed to detect, respond to and recover from any unauthorized access to or use of customer information. The final rule spells out three required steps: assess the nature and scope of the incident and identify which systems and types of customer information may have been accessed; take appropriate steps to contain and control the incident to prevent further unauthorized access or use; and notify each affected individual whose sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization.

The SEC deliberately did not script out specific technical steps, leaving each firm to design procedures that fit its own systems and risk profile.

How fast does a firm have to notify customers?

As soon as practicable, and no later than 30 days after the firm becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. A firm can skip notice only if, after a reasonable investigation, it determines the sensitive customer information was not and is not reasonably likely to be used in a way that could cause substantial harm or inconvenience.

Does "customer information" mean only a firm's own customers?

No. The amendments broadened the definition so it also covers information about another financial institution's customers that has been shared with the covered institution — for example, data a broker-dealer holds about a fund's customers under a servicing arrangement. The safeguards and incident-response obligations apply to that information the same way they apply to the firm's own customer records.

Does a firm have to put the same incident-response requirements in its vendor contracts?

Not exactly. The SEC dropped a proposed rule that would have required a written contract with every service provider. Instead, a covered institution's own policies and procedures must be reasonably designed to ensure its service providers take appropriate measures to protect customer information and to notify the institution of a breach at the service provider — so the obligation runs through the firm's internal policy rather than a mandated contract clause.

When did firms actually have to start complying?

The amendments were published in the Federal Register on June 3, 2024, which started two compliance clocks: 18 months for "larger entities," landing on December 3, 2025, and 24 months for "smaller entities," landing on June 3, 2026. Both dates have already passed as of this writing, so every covered institution should now have a program in place.

"Larger entity" is defined by size, not by headline fame: a group of related investment companies with $1 billion or more in net assets, a registered investment adviser with $1.5 billion or more under management, or any broker-dealer or transfer agent that does not qualify as a small entity under the Securities Exchange Act's Regulatory Flexibility Act standard.

How is this different from Form 8-K Item 1.05?

They cover different populations and trigger on different things. Item 1.05 applies to any SEC-reporting public company, in any industry, once it determines a cybersecurity incident is material to investors, and the clock runs from that materiality decision. Regulation S-P's incident response program applies specifically to broker-dealers, funds, registered investment advisers and transfer agents, triggers on any unauthorized access to or use of customer information regardless of materiality, and is aimed at protecting the individual customer rather than informing the investing public. A single financial firm can owe both: an Item 1.05 filing to its shareholders and a Regulation S-P notice to the customers whose data was exposed.

Where does this site get these facts?

Every figure and requirement on this page is read directly from the SEC's own adopting release (Release Nos. 34-100155; IA-6604; IC-35193, File No. S7-05-23) and its Federal Register publication, not from a law firm's summary of either. This site's state breach-notification law guide covers the separate, state-level notice duties that can also apply when the exposed customer is an individual resident of one of those states.