SEC Amends Regulation S-P to Require 30-Day Data Breach Notices

Regulation S-P, adopted in 2000, governs how certain financial institutions treat nonpublic personal information about consumers. The SEC fact sheet explains that the amendments establish a federal minimum standard for data breach notification, because the protection available to customers has varied from state to state.

What the rules require

Covered institutions must adopt written policies and procedures for an incident response programme reasonably designed to detect, respond to and recover from unauthorised access to or use of customer information. The programme must include procedures to assess the nature and scope of an incident and to contain and control it, and policies requiring oversight of service providers through due diligence and monitoring.

Affected individuals must be notified as soon as practicable, and no later than 30 days after the institution becomes aware that unauthorised access or use has occurred or is reasonably likely to have occurred, the SEC announcement states. Notices must describe the incident, the data involved and how individuals can protect themselves. Notice is not required if the institution determines that the sensitive information has not been, and is not reasonably likely to be, used in a way that would result in substantial harm or inconvenience.

Wider changes

The amendments extend the safeguards and disposal rules to cover both information about an institution's own customers and information received from other financial institutions about their customers. They require covered institutions other than funding portals to keep written records of compliance, conform the annual privacy notice requirements to an exception added by the FAST Act, and bring transfer agents within the safeguards and disposal rules.

Compliance dates

The amendments take effect 60 days after publication in the Federal Register. Larger entities will have 18 months after publication to comply, and smaller entities 24 months. Firms will need to review vendor contracts, incident playbooks and customer communication templates against the amended Regulation S-P well before those dates.

Sources

• U.S. Securities and Exchange Commission: SEC adopts amendments to Regulation S-P to enhance protection of customer information
• U.S. Securities and Exchange Commission: Fact sheet, enhancements to Regulation S-P