Safeguards and Disposal Rule
Regulation S-P, Rule 30 · 17 CFR 248.30
Procedures to safeguard customer information, including response programs for unauthorized access to customer information and customer notice; disposal of customer information and consumer information
Read the current text at the source ↗Guide: Solo Adviser Compliance from A to Z
Guide: Regulation S-P Compliance Checklist for Investment Advisers
Guide: AI Compliance for Investment Advisers: AI Washing, Marketing Claims, Records and Vendors
Guide: Books and Records Requirements for Investment Advisers (Rule 204-2)
Guide: Cybersecurity for RIAs: What the SEC Expects of Investment Advisers
- Applies to
- SEC-registered investment adviser
- Last amended
- August 2, 2024
What the rule says
A description of the source text.
Requires written policies and procedures addressing administrative, technical and physical safeguards for customer information, and written policies for the proper disposal of customer information and consumer information. The Commission amended the rule in May 2024 (89 FR 47688, effective 2 August 2024) to add an incident response programme, service provider oversight and notice to affected individuals. Compliance was required from 3 December 2025 for larger entities and 3 June 2026 for smaller ones, so the amended rule now applies to every adviser.
What it requires
Luna's plain-English reading, not the Commission's words.
- 01A written incident response programme, not only a safeguards policy.
- 02Service provider oversight is inside the rule, so vendor diligence is a regulatory obligation and not merely good practice.
- 03Notice to affected individuals as soon as practicable, but not later than 30 days, after becoming aware that unauthorised access to or use of customer information has occurred or is reasonably likely to have occurred, subject to the no-harm determination and Attorney General delays. Service providers must notify the firm within 72 hours.
What examiners find
Luna's observations, not a Commission publication.
- A privacy notice on file with no safeguards programme behind it.
- No incident response plan, or one that has never been exercised.
- Vendors handling customer information with no diligence record.
Topics
Source last checked against the regulator's copy on October 14, 2026. That date is written by an automated check, not by hand.
Luna Compliance is software, not a law firm. This page is not legal advice and reading it creates no attorney-client relationship. Where this page and the regulator's copy differ, the regulator's governs.