Privacy and Cybersecurity Rules for RIAs

Regulation S-P requires SEC-registered advisers to protect customer information. The 2024 amendments added a written incident response program, notice to affected individuals of a breach of sensitive information, and oversight of the service providers that hold that information.

Regulation S-ID is a separate rule that requires an identity theft prevention program for advisers with covered accounts. Both live in 17 CFR Part 248, and both appear regularly in the SEC's examination priorities.

5 documents on privacy and cybersecurity, ordered by legal weight

• Current, conditional · binding law

  Identity Theft Red Flags Rule

  Regulation S-ID, Rule 201 · 17 CFR 248.201

• Current · binding law

  Safeguards and Disposal Rule

  Regulation S-P, Rule 30 · 17 CFR 248.30

• Current · Commission position

  Reg S-P 2024 amendments

  Release Nos. 34-100155; IA-6604; IC-35193 · 89 FR 47688

• Current · not a rule

  Reg S-P small entity guide

  Small Entity Compliance Guide

• Current · observations, not law

  FY2026 examination priorities

  Examination Priorities FY2026