Privacy Requirements (Regulation S-P)

Broker-dealers collect sensitive personal and financial information from their customers. Regulation S-P establishes the privacy framework that governs how this data is handled in the securities industry.

What You'll Learn

• What nonpublic personal information (NPI) is and what it includes
• The key privacy notices firms must provide
• How the opt-out right works (and its default)
• Exceptions that allow sharing without opt-out
• What firms can never share, regardless of opt-out status

What Is Regulation S-P?

Regulation S-P is the SEC's privacy framework implementing the privacy provisions of the Gramm-Leach-Bliley Act (GLBA). It applies to broker-dealers, registered investment advisers, and investment companies.

The regulation governs how firms collect, use, share, and protect nonpublic personal information (NPI) about their customers.

Regulation S-P does not cover banks, thrifts, or credit unions. Those depository institutions have their own federal banking regulator (the OCC, the Federal Reserve, the FDIC, or the NCUA), which writes a parallel GLBA privacy rule for that institution instead. Regulation S-P reaches only the entities the SEC itself regulates: broker-dealers, registered investment advisers, and investment companies.

Nonpublic Personal Information (NPI)

NPI includes any personally identifiable financial information provided by or collected about a customer:

• Social Security number
• Account numbers
• Transaction history
• Income and net worth
• Account balances
• Information obtained from transactions with the customer

Note: Publicly available information (such as court records or government filings) is generally not considered NPI.

Key Requirements

Exam Tip: Gotchas

• The initial privacy notice is delivered at the start of the customer relationship, not after the first transaction.
• A firm may skip the annual privacy notice if it shares NPI only in ways that do not require opt-out and has not changed its privacy policies since the last notice.
• If a firm starts sharing NPI with a new category of non-affiliated third party, it must send a revised notice and a new opt-out opportunity before the new sharing starts, not at the next annual cycle.

Breach response: Regulation S-P also requires firms to maintain a written incident-response program and to notify affected customers of a breach involving their sensitive information as soon as practicable, and no later than 30 days after the firm becomes aware of it. This adds a reactive breach-response duty on top of the proactive safeguarding obligation above.

What the Privacy Notice Must Say

The initial, annual, and revised privacy notices must describe, among other items that apply to the firm:

• The categories of NPI the firm collects and the categories it discloses
• The categories of affiliates and non-affiliated third parties that receive NPI
• The customer's right to opt out of sharing with non-affiliated third parties, and the method for doing it
• The firm's policies and practices for protecting the confidentiality and security of NPI

The opt-out notice must say that the firm discloses (or reserves the right to disclose) NPI to non-affiliated third parties, that the customer may opt out, and a reasonable means of opting out, such as a reply form, a check-off box, or a toll-free number.

Exam Tip: Gotchas

• There is no deadline to opt out. A customer may opt out at any time, and the firm must honor the request as soon as reasonably practicable. The 30-day period in Regulation S-P's opt-out examples is a reasonable time to reply that a firm may allow after mailing the notices, before it starts sharing; it is not a cutoff for the customer.
• The notice describes how the firm protects NPI. Its security policies and practices are a required item; a fee for opting out is not one of the required items.

The Opt-Out Right

The opt-out right is frequently tested on the SIE exam:

• Customers have the right to opt out of having their NPI shared with non-affiliated third parties
• If the customer does nothing (takes no action), the firm CAN share their information with non-affiliates
• Once a customer opts out, the election remains in effect indefinitely until the customer affirmatively revokes it. The opt-out does not expire and does not require annual renewal
• Sharing with affiliates (companies in the same corporate family) does NOT require opt-out

Think of it this way: The default setting is "sharing ON." Unless a customer actively flips the switch to "sharing OFF," the firm is free to share their NPI with non-affiliated third parties. Once flipped to OFF, it stays OFF until the customer flips it back on.

Exam Tip: Gotchas

• This is opt-out, NOT opt-in. The default is that firms CAN share information with non-affiliates unless the customer specifically says no.
• The opt-out does not expire. Once a customer opts out, the firm cannot share their NPI with non-affiliated third parties until the customer revokes the opt-out. There is no 2-year, 3-year, 6-year, or annual reset for the opt-out itself. The annual privacy notice is a separate firm obligation, not a re-opt-out trigger.
• Sharing with affiliates does not trigger opt-out rights. Only non-affiliated third parties require opt-out.

Exceptions: When Opt-Out Is Not Required

Firms may share NPI without providing an opt-out opportunity in certain situations:

• To process or service transactions requested by the customer
• To protect against fraud
• With service providers who have confidentiality agreements
• As required by law or regulatory request

What Firms Cannot Share

Even when the customer has not opted out, firms may NOT give a non-affiliated third party, for use in telemarketing, direct mail, or email marketing to the customer:

• Account numbers
• Access codes (PINs, passwords)

This ban applies regardless of the customer's opt-out status. The main exception: a firm may give these numbers to its own agent or service provider that markets the firm's own products, as long as that provider cannot directly initiate charges to the account. A number sent in encrypted form, with no means to decode it, does not count.

Exam Tip: Gotchas

• Account numbers cannot go to a non-affiliated third party for its marketing, even if the customer has not opted out. This ban sits outside the opt-out framework. Its main exception is the firm's own marketing agent, which markets only the firm's products and cannot initiate charges.

What Should You Check on Exam Day?

• Do you know which firms Regulation S-P does NOT cover, and why?
• Can you explain what nonpublic personal information includes under Regulation S-P?
• Do you know when a firm must send the initial privacy notice, and what a privacy notice must describe?
• Can you state the default outcome if a customer takes no action on sharing, how long an opt-out lasts once made, and whether there is a deadline to opt out?
• Can you explain what firms can never share, even without an opt-out?