SEC Regulation S-P Amendments (Customer Data Incident Response)

Requires broker-dealers, investment companies, advisers and transfer agents to maintain a written incident response program and notify affected individuals within 30 days of a breach of sensitive customer information. Larger entities comply from 3 December 2025, smaller entities from 3 June 2026.

JurisdictionUnited States
CategoryFinancial Services
StatusActive
Effective date
Latest development

Recent developments

  • — A post-deadline industry article said the June 3, 2026 deadline marked the end of the transition period for smaller entities, forcing institutions to implement enhanced safeguards for client nonpublic information. It described the rule as driving stronger controls, vendor oversight, and incident-response planning. (source)
  • — An industry post said firms should expect increased SEC scrutiny around cybersecurity and data-protection programs as the amended Regulation S-P deadline approached. The reaction reflects concern about examination readiness and governance documentation. (source)
  • — An industry commentary piece said the June 3, 2026 compliance deadline for smaller firms had passed, and firms must now maintain documented incident-response programs and customer-notification processes. It also stated the rule does not create a separate obligation to notify the SEC. (source)
  • — The June 3, 2026 compliance deadline for smaller entities under the SEC’s Regulation S-P amendments was approaching, and the SEC indicated compliance would be a priority in later-2026 examinations. The article also notes that the amendments expanded coverage and introduced a new “customer information” definition. (source)
  • — Sidley reported that the amended Regulation S-P became effective on August 2, 2024, with smaller entities required to comply by June 3, 2026. The update reinforces that larger entities had already reached their December 3, 2025 deadline. (source)
  • — An industry report summarized the amended rule’s operational requirements, including a written incident-response program, 72-hour service-provider notice, and 30-day customer notice after a qualifying incident. It also stated that the compliance deadlines were December 3, 2025 for larger entities and June 3, 2026 for smaller entities. (source)
  • — The SEC listed a compliance outreach event focused on small firms and the upcoming June 3 compliance date. The event signals continued regulator emphasis on implementation readiness. (source)
  • — The SEC announced a hybrid outreach event for small firms to help them prepare for compliance with the Regulation S-P amendments. This was part of the Commission’s compliance-assistance effort ahead of the June 3, 2026 deadline. (source)
  • — A legal update said the SEC would begin examining covered advisers, investment companies, and broker-dealers for compliance with the amended Regulation S-P in FY 2026. It highlights the rule’s 30-day customer notification requirement and 72-hour service-provider notification expectation. (source)
  • — SIFMA and other trade groups requested a six-month extension of the Regulation S-P compliance deadlines for both larger and smaller entities. The request shows industry concern about the implementation burden and timing, even though the deadlines ultimately remained in place. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates