SEC Regulation S-P Amendments: Smaller Entities Now Face 30-Day Breach Notification Duties

A Deadline That Already Passed, and a Compliance Gap That Is Now Live

Picture a mid-sized registered investment adviser managing just under a billion dollars in client assets. The compliance officer had spent years assuming that data breach rules were built for the giants of Wall Street: the wirehouses, the mega broker-dealers, the household-name asset managers with dedicated cybersecurity teams. When a vendor supporting the firm's client portal suffered unauthorized access earlier this year, the firm's instinct was to treat it as a vendor problem, not a regulatory one. That instinct is now a liability. As of June 3, 2026, the compliance deadline for "smaller entities" under the SEC's amended Regulation S-P came and went, and it is already more than two months in the rearview mirror. Firms that have not implemented a written incident response program, and that cannot show they can notify affected individuals within 30 days of discovering a breach, are currently operating out of compliance with a rule the SEC has had on the books since it adopted the amendments in May 2024. The larger entities in the industry, generally those with more assets or higher regulatory complexity, were held to a December 3, 2025 deadline. Regulators gave smaller entities extra runway. That runway has now run out.

Who Actually Counts as a "Smaller Entity"

The term "smaller entity" is not a vague catch-all. Under the amended rule, it covers registered investment advisers with less than $1.5 billion in assets under management, smaller broker-dealers, smaller registered investment companies, funding portals, and transfer agents that fall below the SEC's size thresholds. This is a wide swath of the regulated financial services industry, including many firms that have historically operated with lean compliance and IT staff, and that may have viewed cybersecurity rulemaking as something aimed at their larger competitors. The amended Regulation S-P closes that gap deliberately. The SEC's underlying premise is that customer data does not become less sensitive, or less attractive to threat actors, simply because the entity holding it manages a smaller book of business. Smaller firms are frequently targeted precisely because they are assumed to have weaker defenses.

The Written Incident Response Program and a Broader Definition of "Customer Information"

The core obligation under amended Regulation S-P is straightforward to state and demanding to execute: covered entities must adopt, implement, and maintain a written incident response program reasonably designed to detect, respond to, and recover from unauthorized access to or use of customer information. What makes this requirement more consequential than it might first appear is the scope of "customer information" itself. The amended rule extends the definition beyond data that a firm directly holds and controls. It now explicitly reaches information handled by third-party service providers on the firm's behalf. In practical terms, a firm can no longer treat a cloud vendor's data environment, a portfolio management platform, or an outsourced back-office provider as outside the perimeter of its own compliance obligations. If a service provider processes or stores customer information for the firm, that data falls within the scope of the incident response program the firm is required to maintain.

The 30-Day Breach Notification Clock

Perhaps the single most operationally significant change is the new notification timeline. Once a covered entity becomes aware that unauthorized access to or use of customer information has occurred, or is reasonably likely to have occurred, it must notify affected individuals within 30 days. This is a materially tighter standard than the patchwork of state-level breach notification laws many firms have relied on as their baseline, and it applies regardless of whether a state law would otherwise require notice. The 30-day clock starts running at awareness, not at the conclusion of a full forensic investigation, which means firms need detection and escalation processes capable of surfacing incidents quickly, along with a pre-built notification workflow rather than one improvised under pressure.

New Oversight Duties Over Vendors and Service Providers

Because the definition of customer information now extends to data held by third parties, the amended rule imposes corresponding oversight obligations on the relationships firms have with their vendors. Contracts with service providers must require those vendors to report breaches back to the firm within a defined window, so that the firm itself has enough time to meet its own 30-day notification duty to affected individuals. This effectively pushes cybersecurity due diligence and contract renegotiation into the compliance function of every covered entity. Firms that have not reviewed vendor agreements for reporting language now have a regulatory reason to do so immediately, since a slow or silent vendor can put the firm itself in breach of its notification duty.

Recordkeeping and Practical Next Steps

Covered entities must also document and retain records evidencing compliance with the incident response program. While the precise retention period for these records benefits from direct confirmation against the final rule text, the general expectation aligns with the retention norms firms already follow under existing Advisers Act Rule 204-2 recordkeeping requirements, generally spanning several years. For firms that have not yet acted, the practical path forward starts with an honest gap assessment: does a written incident response program exist, does it name the roles responsible for detection and escalation, does it define what "customer information" means broadly enough to capture third-party-held data, and do vendor contracts contain breach-reporting deadlines that actually support a 30-day notification window. Given that the June 3, 2026 deadline has already passed, closing these gaps is no longer a forward-looking project. It is a remediation of an existing compliance shortfall, and the longer it remains open, the more exposed the firm becomes to both regulatory scrutiny and the operational chaos of responding to a real incident without a plan already in place.