SEC to hold hybrid outreach event for small firms on Regulation S‑P amendments

Regulation S‑P is the SEC’s main privacy and data‑security rule for brokers, investment advisers, investment companies, and some other registered entities. It requires covered firms to:

• Give customers initial and annual privacy notices describing how they collect, use, and share “nonpublic personal information,” and how customers can opt out of certain sharing (Privacy Rule).
• Adopt written policies and procedures to safeguard customer records and information against unauthorized access, use, or disposal (Safeguards Rule and Disposal Rule).
• Under the 2024 amendments, maintain a written incident‑response program for data breaches and notify affected individuals of certain security incidents involving their sensitive personal information.

Sources:

The outreach events were prompted by the SEC’s May 16, 2024 amendments to Regulation S‑P, which significantly expand firms’ privacy and security obligations. Key changes include:

• Mandatory, written incident‑response programs for unauthorized access to or use of customer information, including procedures to assess, contain, and remediate incidents.
• A new requirement to provide clear and timely breach notifications to affected individuals when their “sensitive customer information” is, or is reasonably likely to have been, accessed or used without authorization.
• Extension of the Safeguards Rule and Disposal Rule to certain transfer agents.
• More detailed requirements for oversight of service providers that handle customer information.

Sources:

For this event, “small firms” is a practical description rather than a newly defined legal category. The SEC’s notice states only that the third outreach event is “for small firms” and follows earlier sessions for large firms and transfer agents, without giving a specific asset, revenue, or headcount threshold. Until the SEC publishes a more precise event description, there is no formal, event‑specific definition beyond ordinary‑language use (smaller registered firms, such as small broker‑dealers or advisers).

Sources:

According to the SEC’s press‑release summary carried by third‑party distributors, the event is scheduled for:

• Date/time: January 22, 2026, from 11:00 a.m. to 12:30 p.m. Eastern Time.
• Format: Hybrid – open to both in‑person and virtual attendance.

Registration details: the SEC release indicates that information on how to attend (including any registration or webcast link) will be provided on SEC.gov with the press release and the Regulation S‑P outreach webpage. However, the exact registration URL or physical venue is not fully visible in the accessible copies of the release.

Sources:

Yes. The 2024 amendments set new, phased compliance dates and the usual SEC enforcement tools (exams, deficiency letters, and enforcement actions) apply if firms fail to comply.

Key dates (per the final rule):

• Larger entities: must comply with the amendments by December 3, 2025.
• Smaller entities (including small firms): must comply by June 3, 2026.

The rule does not introduce a special new penalty scheme; instead, non‑compliance can lead to SEC enforcement under the Securities Exchange Act, Investment Advisers Act, or Investment Company Act, including fines, censures, or other sanctions.

Sources:

Based on the SEC’s description of the Regulation S‑P outreach series and prior events, the SEC intends to post supporting materials and event information on its Regulation S‑P outreach webpage, and typically makes at least the agenda and slides publicly available. For earlier sessions, the SEC provided an online viewing link on SEC.gov and indicated that additional information (including agenda and speakers) would be posted there. However, the small‑firms event press release, as currently accessible, does not explicitly state that a recording will be posted afterward.

Sources:

The outreach series is organized primarily by the SEC’s Division of Examinations, with participation from other relevant divisions.

For the prior Regulation S‑P outreach event (for transfer agents), the SEC stated that “Staff from the Divisions of Examinations and Trading and Markets will cover the new Regulation S‑P compliance obligations, discuss what to expect when interacting with an exam team during an examination, and answer any remaining compliance questions.” The small‑firms hybrid event is described as the third and final event in this same series, so it is expected to feature staff from the Division of Examinations and likely other program divisions, though specific speakers for the January 22, 2026 event have not yet been publicly listed in accessible materials.

Sources: