Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

Even during times of change regarding regulatory priorities, regulators remain focused on cybersecurity, information governance and data privacy across the financial services sector. But in recent times, two priorities have emerged to stand at the forefront within those considerations: service provider oversight and breach notification.

core/paragraph

These developments reflect persistent incident trends where service providers continue to account for a significant share of reported security incidents and routinely drive longer notification timelines. Unlike single‑entity events, vendor incidents often involve multiple downstream organizations, can include incomplete forensic information and may result in delayed determinations about whose data was involved. Regulators responded with tightened reporting frameworks to help minimize delays.

core/heading

At the federal level, the Securities and Exchange Commission (SEC) amended Regulation S‑P, which implements the Gramm‑Leach‑Bliley Act (GLBA) safeguard requirements for SEC‑registered firms. The amendments align with long‑standing GLBA safeguard requirements for other financial institutions while imposing clearer operational requirements including:

Written incident response and service provider oversight programs

core/list-item

Notification to involved customers within 30 days of determining a reportable incident occurred

Notification by service providers to the registered firm within 72 hours of discovering an incident involving the firm’s customer data

core/list

Regulators are backing these requirements with enforcement. In recent years, the SEC took action against regulated entities that maintained inadequate cybersecurity and identity theft prevention programs, imposing civil penalties ranging from hundreds of thousands to tens of millions of dollars, along with cease‑and‑desist orders and requirements to remediate deficiencies in safeguarding customer information and related compliance controls under Regulation S‑P and Regulation S‑ID.

The Consumer Financial Protection Bureau has also weighed in on these issues through its Open Banking Rule, which (assuming it survives ongoing legal challenges and regulatory reconsideration) may soon impose new data access, use limitation and deletion obligations.

The New York State Department of Financial Services (NYDFS) continues to set the tone at the state level for financial services firms. NYDFS emphasizes third‑party risk management through guidance and aggressive enforcement, securing significant penalties for cybersecurity failures. Its actions increasingly signal where other state regulators may follow.

Regulators are no longer tolerant of vendor‑driven delays. In 2026, firms are expected to contract for speed, aggressively oversee service providers and execute incident response plans without hesitation. Timeliness is now a core compliance obligation.

For additional analysis of regulatory enforcement trends and incident response insights, see the <em>2026 Data Security Incident Response Report</em>, available for download <a href="https://bh.bakerlaw.com/49/1329/landing-pages/dsir.asp" target="_blank" rel="noreferrer noopener">here</a>.

The New Era of Regulation S‑P: When Vendors Breach, the Clock Starts Ticking