Written and reviewed by Angel Montilla · Updated
Regulation S-P
Regulation S-P notification timelines address different responsibilities
The 2024 amendments to Regulation S-P include notification provisions for service providers and affected individuals. They involve different triggers and responsibilities; treating them as a single incident deadline can confuse response planning.
Provider notification to the institution
The oversight procedures must be reasonably designed to ensure a provider notifies the covered institution promptly, and within 72 hours of awareness of a security breach causing unauthorized access to a customer information system it maintains. This is not a general 72-hour deadline for an RIA to report an incident to the SEC.
Notification to affected individuals
Customer notice is generally due as soon as practicable, with a 30-day outer limit tied to awareness of actual or reasonably likely unauthorized access to or use of customer information. The rule includes conditions and exceptions, including a determination after reasonable investigation concerning the likelihood of substantial harm or inconvenience. Counsel should assess the facts and applicable provisions.
Plan the handoff before you need it
For a readiness discussion, identify who receives provider notices, who records the information and who brings together technology, compliance, management and counsel. Consider how the team would obtain missing facts and preserve its decision record.
Rehearsing that coordination can identify practical gaps. It does not replace legal analysis during an actual incident.
Regulatory information reviewed September 29, 2026. This article provides general information, not legal advice.
Sources: SEC final rule, incident response and service-provider provisions · SEC small entity compliance guide