IAA Calls on SEC for More Time on Reg S-P
July 31, 2025
The amendments to the data breach notification rule, Regulation S-P, go live on December 3, 2025, for larger advisers ($1.5 B in AUM or more) and June 3, 2026, for smaller advisers. IAA members are facing significant operational and interpretive challenges in meeting this timeline. The IAA submitted a letter to the SEC on July 30, 2025, reiterating our earlier request for a 12-month extension of the amendments. We also asked for specific clarifications or refinements to the amendments that would make the rule more workable for advisers, including changes to certain definitions, confirming that advisers will be able to conduct a reasonable forensic investigation of a potential breach, providing more flexibility for advisers to work with their service providers, and expanding the exception for postponing notification when requested by law enforcement.
The IAA Has Your Back
We will continue to engage with the SEC on this important issue. Please contact IAA Associate General Counsel Tracy Soehle at tracy.soehle@investmentadviser.org with any questions or comments on this member alert.
Tags:
Privacy, Cybersecurity, Data Security
