2023-05774: Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information

Summary

The Securities and Exchange Commission ("Commission" or "SEC") is proposing rule amendments that would require brokers and dealers (or "broker-dealers"), investment companies, and investment advisers registered with the Commission ("registered investment advisers") to adopt written policies and procedures for incident response programs to address unauthorized access to or use of customer information, including procedures for providing timely notification to individuals affected by an incident involving sensitive customer information with details about the incident and information designed to help affected individuals respond appropriately. The Commission also is proposing to broaden the scope of information covered by amending requirements for safeguarding customer records and information, and for properly disposing of consumer report information. In addition, the proposed amendments would extend the application of the safeguards provisions to transfer agents. The proposed amendments would also include requirements to maintain written records documenting compliance with the proposed amended rules. Finally, the proposed amendments would conform annual privacy notice delivery provisions to the terms of an exception provided by a statutory amendment to the Gramm-Leach-Bliley Act ("GLBA").

The agency’s own summary, as published.

What this changes

Amends 4 parts of the Code of Federal Regulations — the standing rules this notice rewrites.

• 17 CFR 240 General Rules and Regulations, Securities Exchange Act of 1934
• 17 CFR 248 Regulations S-P, S-AM, and S-ID
• 17 CFR 270 Rules and Regulations, Investment Company Act of 1940
• 17 CFR 275 Rules and Regulations, Investment Advisers Act of 1940