RIA Glossary / Cybersecurity & Data Compliance

Regulation S-P

Quick Answer
Regulation S-P is the SEC rule requiring registered investment advisers to adopt written policies protecting the privacy and security of clients’ nonpublic personal information, and to provide clients with privacy notices explaining how their information is collected, used, and shared.
Reviewed by Sam Carter, Director of Registration Services
Last reviewed September 18, 2026

What Is Regulation S-P?

Regulation S-P requires two main things: a privacy notice given to clients at the start of the relationship (and periodically afterward, depending on firm practices) explaining what personal information the firm collects and how it’s shared, and a written information security program describing the administrative, technical, and physical safeguards the firm uses to protect that data. A 2024 amendment to the rule also added an incident response program requirement, including client notification obligations within a specific timeframe if sensitive information is compromised.

Firms need documentation showing not just that a privacy policy exists, but that it’s actually distributed to clients and followed operationally.

Why it Matters

Regulation S-P sits at the intersection of privacy and cybersecurity compliance, and the 2024 amendments significantly raised the bar — particularly the new breach notification timeline — making this an area firms should revisit even if their existing privacy policy hasn’t changed in years.

Frequently Asked Questions

Do I need to give clients a new privacy notice every year?

Advisers who don’t share nonpublic information in ways that trigger opt-out rights may qualify for an annual notice exception, but this depends on the firm’s specific practices.

What changed with the 2024 amendment?

It added a formal incident response program requirement, including a 30-day client notification deadline following discovery of unauthorized access to sensitive customer information.
Related Service

Get hands-on help with this

Our registration and compliance team has guided independent RIAs for two decades. See how we can help your firm.

Learn More
Related Terms

Cybersecurity Policy

What Is a Cybersecurity Policy for RIAs? While cybersecurity isn’t governed by a single standalone SEC

Need help putting this into practice?

Our registration and compliance team has guided independent RIAs for two decades. Talk to us about how this applies to your firm.

Talk To An Expert