Skip to main content

IAA Statement: SEC Proposal on Protection of Client Information

June 5, 2023

IAA VP of Communications & Marketing Janay Rickwalder.

Attribution to Gail Bernstein, IAA General Counsel

The Investment Adviser Association remains committed to supporting efforts by the SEC to protect investors, market participants, and the broader financial markets against information security threats. We submitted comments to the SEC today expressing support for the proposed amendments to rules governing the protection of clients’ non-public personal information.

The IAA supports requirements for advisers to have a principles-based incident response program that addresses unauthorized access to or use of client PII and notification of a breach to affected clients. We believe advisers should protect the confidentiality of client PII and inform clients of any breaches.

We therefore support the proposal, subject to several recommendations. Our recommendations would further the SEC’s objectives while more effectively protecting investors and streamlining unnecessary operational and compliance burdens on advisers. For example, we’ve asked the SEC to limit the new requirements to sensitive client information, rather than all client information. We’ve also asked the SEC to narrow the scope of the third parties that advisers would need to cover in their incident response plans. And we’ve cautioned the SEC against requiring public disclosures that would provide a roadmap to threat actors.

This proposal, like several of the other open rule proposals, would require advisers to enter into specific contractual terms with service providers. We’re again asking the SEC to recognize how challenging it is for advisers to negotiate these terms with service providers, especially when they have little leverage. This concern relates to advisers of all sizes, but especially smaller advisers.

A growing concern for the IAA relates to the SEC’s expectations around how advisers will be expected to implement the many substantial new requirements likely to get finalized within the same period. The SEC is proposing unreasonably short implementation timelines for each proposal in isolation, but it’s also not considering all these new requirements together. So, we’ve asked that the individual timelines be extended but also that a more realistic overall implementation timeline be established to allow advisers to implement and operationalize changes and prevent industry disruption.

The proposed data privacy amendments are the latest in a series of rulemaking proposals that are unprecedented in their scope and speed. The SEC has not adequately considered how these proposals interrelate or their cumulative effect on investment advisers, especially smaller advisers, despite our many calls for the SEC to do so. The IAA has asked the SEC to reopen comment periods for several other rulemakings, including the Outsourcing, Safeguarding, and Cybersecurity proposals, to consider the interrelationships and conduct a holistic cost-benefit analysis.

The IAA will continue to advocate for all advisers, and in particular for smaller advisers, to ensure that final rules recognize the extent of the burdens being placed on them and consider less burdensome ways to achieve the SEC’s goals.

The IAA is committed to working constructively with the SEC to achieve our shared goal of safeguarding clients’ PII. We will continue to engage with the SEC as it considers this proposal and the feedback it receives.

You are now leaving Investment Adviser Association

The IAA provides links to web sites of other organizations in order to provide visitors with certain information. A link does not constitute an endorsement of content, viewpoint, policies, products or services of that web site. Once you link to another web site not maintained by the IAA, you are subject to the terms and conditions of that web site, including but not limited to its privacy policy.

You will be redirected to

Click the link above to continue or CANCEL