Regulation S-P Privacy Policy Template for RIAs

What the rule requires

Regulation S-P requires written policies to safeguard customer records and information. The 2024 amendments, which every SEC-registered adviser has had to comply with since June 2026 at the latest, add an incident response program, notice to affected individuals generally within 30 days of learning of unauthorized access to sensitive customer information, oversight of service providers, and new recordkeeping.

Regulation S-ID requires an identity theft program for advisers that maintain covered accounts. State breach notification and privacy laws apply alongside federal law.

What the policy covers

The sections of Luna's model Privacy and Identity Theft policy. Your draft includes only the clauses that apply to your firm.

1. 1Scope and framework
2. 2Safeguards
3. 3Disclosure of nonpublic personal information
4. 4Incident response
5. 5Disposal
6. 6Privacy notices
7. 7Affiliate information sharing
8. 8Identity theft red flags (Regulation S-ID)
9. 9State and non-U.S. privacy laws
10. 10Training, records and review

What Luna asks you

A few of the questions that shape the draft:

• Who leads the response to a security incident
• Which state and non-U.S. privacy laws apply to the firm
• How personnel access firm systems remotely
• Whether the firm shares information with affiliates

How drafting works

1. 01
   Answer questions about your firm

   Plain questions about how you operate. Where there is a common answer, Luna suggests it; where you are not sure, say so and it is flagged rather than assumed.

2. 02
   Luna drafts the policy

   Only the clauses that apply to your firm, in your firm's name, each traced to the rule or choice it comes from.

3. 03
   Review what is left

   Anything unanswered is marked in the text and listed for you, and the policy cannot be approved until each is settled.

4. 04
   Edit, approve and roll out

   It is your policy: edit it like any other, approve it, and have employees acknowledge it in the same place.

Read the source

• Safeguards and Disposal Rule
• Reg S-P 2024 amendments
• Reg S-P small entity guide
• Identity Theft Red Flags Rule

Other policies

• Compliance Program
• Code of Ethics
• Books and Records
• Marketing and Advertising