What Is a Privacy Policy Under Regulation S-P?

The privacy policy must be delivered to clients at the start of the advisory relationship and, depending on the firm’s information-sharing practices, may need to be redelivered periodically. It typically covers the categories of information collected (financial data, account information, personal identifiers), the categories of third parties information may be shared with, and the client’s right to opt out of certain types of sharing. Firms that don’t share information in ways triggering opt-out rights may qualify for a reduced, annual-notice exemption, but this depends on the specific practices involved.

The 2024 amendments to Regulation S-P also tie the privacy policy framework more closely to the firm’s incident response obligations, since a breach of the information described in the policy is what triggers the notification requirements.