Smaller Financial Firms Must Comply with New SEC Data Privacy Rules

As of June 3, 2026, smaller financial entities, including investment advisers and broker-dealers, must adhere to the SEC's updated Regulation S-P. The revised rule mandates a written incident response plan, 30-day data breach notification to individuals, and 72-hour breach reporting requirements for service providers. Non-compliance could lead to regulatory findings and enforcement actions.