July 31, 2025
The amendments to the data breach notification rule, Regulation S-P, go live on December 3, 2025, for larger advisers ($1.5 B in AUM or more) and June 3, 2026, for smaller advisers. IAA members are facing significant operational and interpretive challenges in meeting this timeline. The IAA submitted a letter to the SEC on July 30, 2025, reiterating our earlier request for a 12-month extension of the amendments. We also asked for specific clarifications or refinements to the amendments that would make the rule more workable for advisers, including changes to certain definitions, confirming that advisers will be able to conduct a reasonable forensic investigation of a potential breach, providing more flexibility for advisers to work with their service providers, and expanding the exception for postponing notification when requested by law enforcement.
The IAA Has Your Back
We will continue to engage with the SEC on this important issue. Please contact IAA Associate General Counsel Tracy Soehle at tracy.soehle@investmentadviser.org with any questions or comments on this member alert.
The IAA provides links to web sites of other organizations in order to provide visitors with certain information. A link does not constitute an endorsement of content, viewpoint, policies, products or services of that web site. Once you link to another web site not maintained by the IAA, you are subject to the terms and conditions of that web site, including but not limited to its privacy policy.
Click the link above to continue or CANCEL
