What it requires
- Keep written policies and procedures for responding to unauthorised access to customer information.
- Tell affected customers within 30 days of learning of the access.
- Make service providers report a breach to the firm within 72 hours.
Who it applies to
Financial services.
The project that meets it
Sources
SEC Regulation S-P is in force.
David from SBK replies within one working day.