Regulation S-P: Disclosure Limitations, Exceptions, and Safeguarding

What this video covers

• The four mandatory conditions for disclosing nonpublic personal information (NPI) to a nonaffiliated third party: initial privacy notice, opt-out notice, reasonable opt-out opportunity, and the consumer not having opted out
• Why missing any one of the four conditions blocks the disclosure entirely, absent an exception
• The service-provider and joint-marketing exception and its strict contractual purpose limit on how the third party may use the data
• The processing and servicing transactions exception and why it lets a firm skip the four-step gauntlet to execute a client-authorized trade
• Why "other exceptions" is a closed list of exactly seven enumerated items (consumer consent, fraud protection, legal compliance, consumer reporting, business sale or merger, and others), not a broad catch-all
• The written incident-response program's required components: assess, contain, notify, plus mandatory service-provider oversight through due diligence and monitoring
• The 72-hour service-provider notification clock to the firm versus the 30-day firm notification clock to affected customers, starting from the firm's awareness of the breach, and when each duty can be waived or delayed