The SEC adopted amendments to Regulation S-P, the regulation governing the protection and safeguarding of nonpublic information about consumers by financial institutions. The amendments are designed to modernize and enhance protection of consumer financial information by establishing new requirements for incident response plans and data breach notifications, among other changes. The final rule is effective August 2, 2024, and applies to registered investment advisers (RIAs), but not exempt reporting advisers. RIAs with $1.5 billion or more in assets, investment companies with $1 billion or more in net assets, as well as certain broker-dealers and transfer agents considered “larger entities” will have an 18-month compliance period (February 2, 2026), while smaller entities will have a 24-month compliance period (August 2, 2026).