Information Security and Privacy Regulations

What this video covers

• The difference between a consumer and a customer under Regulation S-P, and which one receives the initial and annual privacy notices
• The two strict conditions that must both be met for a firm to waive the annual privacy notice requirement
• When the opt-out right applies: specifically to nonaffiliated third parties, not to affiliated entities under Regulation S-AM
• The four exceptions that permit sharing nonpublic personal information (NPI) without an opt-out, and why the service provider exception requires a written contractual agreement
• What "clear and conspicuous" means for the opt-out notice, and why fine print buried in a contract fails the standard
• The written policies and procedures requirement under the safeguards rule, and what the firm must protect against
• The 30-day outer deadline for customer breach notification, and why "as soon as practicable" does not mean deliberate delay