SEC Proposal For Better Safeguarding Personal Information: Easier Said Than Done?

In response to the growing number of data breaches in recent years, the Securities and Exchange Commission (Commission or SEC) has recently proposed to improve the safeguarding of information by amending Regulation S-P.¹ Initially adopted in 2000, Regulation S-P currently applies privacy, information safeguarding, and disposal obligations to financial institutions, including broker-dealers.²

The Release contains four primary amendments to Regulation S-P: (i) an obligation to create specific and tailored standards for compliance with safeguarding rules; (ii) a change in the type of information covered under safeguards and disposal rules and a broader scope of institutions and persons covered by the rule; (iii) an obligation for subject institutions to document their safeguards and disposal policies and procedures and their compliance with such policies and procedures; and (iv) an exception from Regulation