Privacy and Information Security

What this video covers

• What counts as nonpublic personal information (NPI), including the public-information exclusion that removes NPI protection instantly
• The two regulatory regimes (SEC Regulation S-P versus NASAA's state-level rule) and which firms each regime covers
• The three required notices (initial, annual, and opt-out) and when each must be delivered during the customer relationship
• The critical exam distinction that state-registered investment advisers have zero exceptions for the annual privacy notice, unlike federally covered firms with the narrow SEC exception
• The four categories where sharing NPI with nonaffiliated third parties requires no opt-out: service providers, required by law, fraud prevention, and affiliates
• The written safeguards requirement, designated responsible person, and incident response program including timely customer notification
• The five mandatory NASAA cybersecurity functions in exact order: Identify, Protect, Detect, Respond, Recover, plus the backup-copy and annual-review duties