The amended Regulation S-P extends data protection responsibility to your service providers. Firms must document due diligence, contractual breach notification within 72 hours, and ongoing monitoring for every vendor with access to customer information. Here is how to get the documentation in place before June 3, 2026.

The SEC's amended Regulation S-P requires smaller RIAs, broker-dealers, and investment companies to implement written incident response programs, breach notification procedures, vendor oversight documentation, and compliance recordkeeping by June 3, 2026. No extension has been granted. This guide covers what each requirement demands and how to get the documentation in place before the deadline.