How to Comply With SEC Regulation S-P (as Amended) After a Data Breach at a Registered Investment Adviser in 2026
After a data breach, a registered investment adviser must deliver Regulation S‑P notices to affected individuals “as soon as practicable, but not later than 30 days” after becoming aware of unauthorized access or use of customer information. The SEC’s 2024 amendments—effective in 2026 for most RIAs—also require written incident response policies, vendor oversight, and documentation. […]