← Global Privacy Laws Research Library
17 CFR Part 248
SEC Regulations S-P, S-AM and S-ID
Prepared by Shubhank Suman · Last reviewed
Status not verified beyond supplied text
- Legal character
- Federal regulation
- Region
- North America
What it covers
Regulation S-P addresses nonpublic personal financial information, privacy notices, nonaffiliate disclosure/opt-out, safeguards, response and disposal. S-AM controls certain affiliate marketing solicitations. S-ID requires covered-account identity-theft programmes and card-issuer address-change checks.
Why it matters
The three subparts serve different functions and have different scope tests. A service-provider breach notice to a covered institution is not the same as reporting a breach to the SEC.
Refer to it when
Research a securities firm’s financial privacy notices, security incident response, affiliate marketing or identity-theft programme.
AI, privacy and cybersecurity relevance
- AI: Low
- Privacy: Very High
- Cyber: Very High
AI
LOW RELEVANCE
Financial data used by AI tools remains subject to the relevant data restrictions; no general AI framework.
Privacy
VERY HIGH RELEVANCE
Financial privacy, sharing choices and affiliate marketing.
Cybersecurity
VERY HIGH RELEVANCE
Safeguards, incident response, disposal and identity-theft prevention.
Applicability
S-P’s ordinary privacy provisions cover listed brokers, dealers, investment companies and SEC-registered advisers; safeguards/disposal definitions differ. S-ID applies to covered financial institutions or creditors with covered accounts, not automatically every registrant.
Read first
§ 248.1 → .3-.15 → .30 including definitions → .101 and .120-.128 → .201-.202 and Subpart C Appendix A.
Provisions / sections covered
§§ 248.1-.15 - S-P privacy rules
Scope and definitions, initial/annual/revised notices, delivery, opt-out, reuse and account-number restrictions; annual-notice and sharing exceptions apply.
§ 248.30(a) - Safeguards and incident response
The supplied text requires written safeguards/response procedures. Affected-individual notification is generally as soon as practicable and within 30 days of awareness, subject to the specified investigation exception and delay mechanisms.
§ 248.30(a)(5), (b)-(d) - Providers, disposal and records
Providers notify the covered institution as soon as possible and within 72 hours of the specified breach; this is not a universal SEC reporting deadline. Covered institutions retain notification responsibility. Disposal, documentation and specific scope definitions also apply.
§§ 248.101-.128 - S-AM
Affiliate solicitation notices and opt-outs, exceptions, renewal and delivery rules. An opt-out lasts at least five years; it is not a blanket ban on affiliate information sharing.
§§ 248.201-.202 and Subpart C Appendix A - S-ID
Periodic covered-account assessment, a written red-flags programme, administration and address-change validation. Read the full appendix, included on the PDF’s final pages.
Subject-matter tags
- Data breach
- Retention
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Related instruments in this library
- Gramm-Leach-Bliley Act – Privacy (15 U.S.C. Chapter 94)Law · Current (amended)Enabling financial-privacy statute for S-P.
- FTC Privacy of Consumer Financial Information RuleRegulation · Status not verifiedParallel FTC notice/sharing regime with a different institutional scope, not an additional universal SEC rule.
- FTC Safeguards RuleRegulation · Status not verifiedParallel FTC security regime; determine the responsible regulator before applying either.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.