Privacy Requirements (Regulation S-P)

What this video covers

• What nonpublic personal information (NPI) includes, and why publicly available court records or government filings do not count as NPI
• When the initial privacy notice must be delivered (at the start of the customer relationship, not after the first trade) and when the annual notice can be skipped
• How the opt-out right works: default is sharing on with non-affiliated third parties, and the customer must actively opt out to stop it
• Why an opt-out election lasts indefinitely and never expires or requires renewal, regardless of annual privacy notices
• The four exceptions that let firms share NPI without opt-out: transaction processing, fraud protection, service providers with confidentiality agreements, and legal requirements
• Why account numbers and access codes can never be shared for marketing purposes under any circumstances, even if the customer never opted out
• The 30-day hard deadline to notify customers after a data breach, and the written safeguard, disposal, and incident-response obligations firms must maintain