An amended Regulation S-P notice must be clear and conspicuous, in writing, and sent as soon as practicable but within 30 days after the firm becomes aware of the incident, subject to limited Attorney General delays. It must describe the incident and data type, give contact details and explain protective steps such as fraud alerts and credit reports.
This is general information, not legal advice.
The timing rule
Paragraph (a)(4)(iii) sets the outer limit at 30 days after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred. The rule allows delay only where the Attorney General determines notice poses a substantial risk to national security or public safety and tells the Commission in writing, in stages the text describes.
Required contents
The notice has to:
- Describe in general terms the incident and the type of sensitive customer information involved.
- Include, if reasonably possible to determine, the date, estimated date or date range of the incident.
- Provide contact information: a telephone number, an email address or equivalent, a postal address, and the name of a specific office.
- If the person has an account, recommend reviewing statements and reporting suspicious activity.
- Explain what a fraud alert is and how to place one on credit reports.
- Recommend periodically obtaining credit reports from each nationwide credit reporting company and having fraudulent transaction information deleted.
- Explain how to obtain a credit report free of charge.
- Point to online guidance from the Federal Trade Commission and usa.gov on protecting against identity theft, and encourage reporting identity theft to the FTC.
What engineering supplies
| Notice element | Technical input |
|---|---|
| Incident description | Verified timeline and root cause summary |
| Data type | Field level list of what was exposed |
| Dates | First and last evidence of unauthorized access |
| Affected individuals | A query that returns accounts touched, with confidence level |
| Mailing | Clean contact data and a log that notices were sent |
The rule says that if individuals cannot be identified, notice goes to everyone whose sensitive information sits in the affected system, unless the firm reasonably determines a specific person's data was not accessed. Accurate access logs are the way to narrow that group.
Do not wait for certainty
The clock runs from awareness that access occurred or is reasonably likely to have occurred. Starting the investigation early and recording each finding with a time stamp helps the firm decide and show when it became aware.
Mistakes to avoid
Draft notices commonly omit the protective steps the rule lists, give a generic mailbox instead of the named office, or state dates with more confidence than the evidence supports. Another problem is a mailing list built from stale contact data. Prepare a template that carries every required element, keep contact data current, and phrase dates as a range when the logs cannot pin them down.
Quick check
Can a firm skip notice entirely?
The rule excuses notice if, after a reasonable investigation, the firm determines the sensitive customer information has not been and is not reasonably likely to be used in a way that would cause substantial harm or inconvenience. The investigation and basis must be documented.
Does the notice have to be on paper?
The notice must be in writing and sent by a means designed to ensure each affected individual can reasonably be expected to receive actual notice.
Sources
- SEC adopting release 34-100155, rule text for paragraph (a)(4)
- SEC fact sheet, Final Rules: Enhancements to Regulation S-P
Last reviewed: 19 October 2026.
