Rule Atlas
Regulation S: Client Privacy and Data Security Regulations
Under Regulation S (NASAA / SEC Investment Advisers Act), client Privacy and Data Security Regulations establishes the authoritative rules tested on the NASAA Series 66. This lesson covers the regulatory requirements related to client privacy and data security, including the Gramm-Leach-Bliley Act (GLBA) and its privacy rule, safeguarding client information, and breach notification obligations for investment advisers. VoraPrep verifies every threshold, worked table, and practice question below against the current NASAA Series 66 blueprint.
Core Statutory Concepts
| Feature | GLBA Privacy Rule (Regulation S-P) | GLBA Safeguards Rule | Data Breach Notification (General Principles) |
|---|---|---|---|
| Purpose | Governs disclosure of NPI to customers and third parties | Requires security program for NPI | Mandates informing affected parties of security incidents |
| Key Requirement | Annual privacy notices; opt-out for NPI sharing with non-affiliates | Comprehensive information security program | Timely notification to affected individuals and/or regulators |
| Information Covered | Non-public personal information (NPI) | Non-public personal information (NPI) | Sensitive NPI (e.g., SSN, account numbers) |
| Trigger | Establishing customer relationship; annually thereafter | Ongoing protection of NPI | Discovery of unauthorized access to NPI |
| Opt-Out | Required for sharing NPI with non-affiliated third parties | Not applicable | Not applicable |
| Enforcement | SEC, FTC, state regulators | SEC, FTC, state regulators | State Attorneys General, federal regulators |
Alpha Advisors, a state-registered investment adviser, signs an advisory contract with a new individual client, Mr. Chen, on October 1st. Mr. Chen will receive personalized investment management services. Alpha also provides a mass-market monthly newsletter via email to 1,000 subscribers, charging $40 per year, and manages assets for a registered investment company. Under governing securities regulations, which of the following determinations is correct?
Practitioner Application: Client Privacy and Data Security Regulations
An investment adviser (IA) firm experiences a data breach where an unauthorized party gains access to a server containing sensitive client information, including social security numbers and account balances. The breach is detected quickly, but the IA is unsure about the exact scope of affected clients across multiple states and whether immediate notification is required for all, or only those whose data was demonstrably compromised. The firm also needs to determine if its third-party data processor, which also suffered a breach, has its own notification obligations, and how this impacts the IA's responsibilities under the Gramm-Leach-Bliley Act (GLBA) and state laws.
- Client privacy and data security are paramount in the financial services industry, governed primarily by the Gramm-Leach-Bliley Act (GLBA) and its associated rules, along with various state regulations. The GLBA, enacted in 1999, requires financial institutions to explain their information-sharing practices to customers and to safeguard sensitive data.
- The GLBA consists of three main parts relevant to client privacy:
Common NASAA Series 66 Distractors on Regulation S
- 1GLBA (Gramm-Leach-Bliley Act) governs client privacy and data security for financial institutions.
- 2Privacy Rule (Reg S-P): Requires annual privacy notices and an opt-out for sharing NPI with non-affiliated third parties for marketing.
- 3Safeguards Rule: Mandates a comprehensive information security program to protect NPI, including administrative, technical, and physical safeguards.
- 4Non-Public Personal Information (NPI): Personally identifiable financial information not publicly available (e.g., SSN, account numbers).
- 5Opt-Out Scope: Primarily for sharing NPI with non-affiliated third parties; generally does not apply to affiliates or essential business operations.
Frequently Asked Questions: Regulation S
What is the core rule under Regulation S (Client Privacy and Data Security Regulations)?
Under Regulation S (NASAA / SEC Investment Advisers Act), client Privacy and Data Security Regulations establishes the authoritative rules tested on the NASAA Series 66. This lesson covers the regulatory requirements related to client privacy and data security, including the Gramm-Leach-Bliley Act (GLBA) and its privacy rule, safeguarding client information, and breach notification obligations for investment advisers. VoraPrep verifies every threshold, worked table, and practice question below against the current NASAA Series 66 blueprint.
How is Regulation S tested on the NASAA Series 66?
GLBA (Gramm-Leach-Bliley Act) governs client privacy and data security for financial institutions. Privacy Rule (Reg S-P): Requires annual privacy notices and an opt-out for sharing NPI with non-affiliated third parties for marketing.
Where can I practice NASAA Series 66 questions on Client Privacy and Data Security Regulations?
Test yourself instantly with the free playable NASAA Series 66 question on this page, or launch VoraPrep's full NASAA Series 66 adaptive question bank, interactive lessons, and 1:1 exam simulator at voraprep.com/series66.