Regulation S-P: privacy notices and safeguards

The notice duty comes first. A firm gives an initial privacy notice when the customer relationship is established and, in general, a notice each year the relationship continues. The notice explains what information is collected, what is shared, with whom, and how the customer can limit the sharing. It is a disclosure the customer receives rather than something they have to ask for.

The choice duty applies to sharing with non-affiliated third parties. Before a firm discloses nonpublic personal information to an unrelated company, it must give the customer a reasonable opportunity to opt out and must honor that election. Certain sharing is outside the opt-out entirely, including disclosures needed to service or process a transaction the customer asked for, and sharing with affiliates is treated differently again.

The safeguards duty is about protection rather than disclosure. A firm must adopt written policies and procedures reasonably designed to protect customer records and information, covering both electronic systems and paper files, and including how records are disposed of. A lost laptop full of client data engages Regulation S-P, through the safeguards duty and possibly customer notice, even if the firm never meant to share anything with anyone.

The fourth duty is new. Amendments adopted in 2024 now apply to broker-dealers: larger firms had to comply by December 3, 2025, and smaller firms by June 3, 2026. The written policies must include an incident response program to detect, respond to and recover from unauthorized access to or use of customer information. If sensitive customer information was, or is reasonably likely to have been, accessed or used without authorization, the firm must notify the affected individuals as soon as practicable, and no later than 30 days after it becomes aware of it. The one way out is a reasonable investigation showing the information has not been, and is not reasonably likely to be, used in a way that would cause substantial harm or inconvenience. The firm must also oversee the service providers that handle its customer information. If the breach happens at one of those providers that is not itself covered by the regulation, the duty is still the firm’s: it must give the notice to affected customers or make sure it is given.

The initial notice has two different triggers, and which one applies depends on which word the question uses. For a customer — someone with a continuing relationship — the clear and conspicuous notice is due not later than when that relationship is established. For a consumer, who has no continuing relationship, there is no notice duty at all unless and until the firm is about to disclose nonpublic personal information about them to a nonaffiliated third party, in which case the notice must come first. Delivery may be delayed in a few narrow situations: where the relationship was not established at the customer’s election, where notice at that moment would substantially delay the customer’s transaction, and where a nonaffiliated broker or adviser established the relationship without the firm knowing.