A.5.1 Privacy and Confidentiality Requirements

Certified Financial Planner CFP

Track your progress as you read

Finished sections get a check mark.

1 A. Professional Conduct and Regulation

A.1 Code of Ethics and Standards of Conduct A.1.1 The Six Ethical Principles A.2 Procedural Rules and Discipline A.2.1 Fitness Standards for Candidates A.3 Financial Institutions Overview A.3.1 Broker-Dealers vs. RIAs A.4 SEC and Securities Regulation A.4.1 FINRA and Broker-Dealer Regulation A.4.2 State Securities Regulation A.5 Consumer Protection Laws A.5.1 Privacy and Confidentiality Requirements A.6 Fiduciary Duty and Application

2 B. General Principles of Financial Planning

B.7 The Financial Planning Process B.7.1 Establishing the Client Relationship B.7.2 Gathering Client Data and Goals B.8 Personal Financial Statements B.8.1 Key Financial Ratios B.9 Cash Flow Management B.9.1 Emergency Fund Planning B.10 Debt Management Strategies B.10.1 Mortgage and Home Financing B.11 Economic Concepts B.11.1 Planning for Inflation B.12 Time Value of Money Concepts B.12.1 TVM Calculations and Applications B.12.2 Loan Amortization B.13 Education Needs Analysis B.14 Education Savings Vehicles B.14.1 529 Plans In-Depth B.15 Education Funding Strategies B.16 Gift/Income Tax Strategies

3 C. Risk Management and Insurance Planning

C.17 Principles of Risk and Insurance C.17.1 Risk Management Process C.18 Analysis of Risk Exposures C.19 Health Insurance Fundamentals C.19.1 Types of Health Insurance Plans C.20 Disability Income Insurance C.20.1 Disability Policy Features C.21 Long-Term Care Insurance C.22 Annuities Overview C.22.1 Fixed vs. Variable Annuities C.23 Life Insurance Fundamentals C.23.1 Types of Life Insurance C.24 Business Owner Insurance Solutions C.25 Insurance Needs Analysis C.26 Insurance Policy and Company Selection

4 D. Investment Planning

D.27 Equity Securities D.27.1 Fixed Income Securities D.27.2 Mutual Funds and ETFs D.27.3 Taxation of Investment Vehicles D.28 Systematic Risk D.28.1 Unsystematic Risk D.29 Economic and Market Cycles D.30 Measures of Risk and Return D.30.1 Investment Performance Measures D.31 Asset Allocation Strategies D.31.1 Portfolio Diversification D.32 Bond and Stock Valuation D.32.1 Stock Valuation Models D.33 Investment Policy Statement D.33.1 Modern Portfolio Theory D.34 Active vs. Passive Investing D.34.1 Common Investment Strategies D.35 Alternative Investments D.35.1 Options and Derivatives

5 E. Tax Planning

E.36 Income Tax Fundamentals E.36.1 Filing Status and Tax Brackets E.37 Types of Income E.37.1 Deductions and Credits E.37.2 Capital Gains and Losses E.38 Business Entity Taxation E.38.1 Self-Employment Tax E.39 Taxation of Trusts and Estates E.40 Tax Reduction Strategies E.40.1 Retirement Account Tax Strategies E.41 Property Transactions E.41.1 Basis Rules for Acquired Property E.42 AMT and NIIT E.42.1 Special Tax Situations E.43 Charitable Giving Strategies

6 F. Retirement Savings and Income Planning

F.44 Retirement Needs Analysis F.44.1 Sources of Retirement Income F.45 Social Security Benefits F.45.1 Social Security Claiming Strategies F.45.2 Medicare Planning F.46 Eldercare and Special Needs Planning F.47 Qualified Plan Overview F.47.1 Defined Benefit Pension Plans F.47.2 Defined Contribution Plans F.48 Eligibility and Vesting F.48.1 Coverage and Discrimination Testing F.48.2 Contribution and Benefit Limits F.48.3 401(k) Plan Features F.49 Non-Qualified Deferred Compensation F.49.1 Executive Compensation Plans F.50 Retirement Plan Selection for Businesses F.50.1 Individual Retirement Accounts F.51 Distribution Rules F.51.1 Required Minimum Distributions F.52 Retirement Income Strategies F.52.1 Tax-Efficient Withdrawal Strategies F.53 Business Succession Planning

7 G. Estate Planning

G.54 Property Titling and Beneficiary Designations G.54.1 Beneficiary Designations G.55 Strategies to Transfer Property G.55.1 Lifetime Gifting Strategies G.56 Wills and Estate Documents G.56.1 Powers of Attorney G.56.2 Advance Directives and Healthcare Documents G.57 Federal Gift Tax G.57.1 Federal Estate Tax G.57.2 Generation-Skipping Transfer Tax G.58 Sources for Estate Liquidity G.58.1 Life Insurance for Estate Liquidity G.59 Trust Fundamentals G.59.1 Revocable Living Trusts G.59.2 Irrevocable Trusts G.59.3 Trust Income Taxation G.60 Marital Deduction Planning G.60.1 QTIP Trusts G.60.2 Portability of Estate Tax Exemption G.61 Intra-family and Business Transfer Techniques G.61.1 Family Limited Partnerships G.61.2 GRATs and IDGTs G.62 Postmortem Estate Planning Techniques G.62.1 Disclaimer Planning G.62.2 Estate Tax Elections G.63 Planning for Divorce and Unmarried Couples G.63.1 Estate Planning for Unmarried Couples G.63.2 Planning for Blended Families G.64 Planning for Special Needs and Circumstances G.64.1 Special Needs Trusts G.64.2 ABLE Accounts

8 H. Psychology of Financial Planning

H.65 Client and Planner Attitudes, Values, Biases H.65.1 Money Scripts and Money Attitudes H.65.2 Planner Self-Awareness H.66 Behavioral Finance H.66.1 Cognitive Biases H.66.2 Emotional Biases H.66.3 Heuristics and Mental Accounting H.67 Sources of Money Conflict H.67.1 Couples and Money Conflict H.67.2 Family and Intergenerational Money Conflict H.68 Principles of Counseling H.68.1 Therapeutic Techniques in Financial Planning H.68.2 Professional Boundaries and Referrals H.69 General Principles of Effective Communication H.69.1 Listening and Questioning Skills H.69.2 Managing Difficult Conversations H.69.3 Non-Verbal Communication H.70 Crisis Events with Severe Consequences H.70.1 Death and Divorce H.70.2 Job Loss and Health Crisis H.70.3 Sudden Wealth and Sudden Loss H.70.4 Natural Disasters and Traumatic Events

A.5.1 Privacy and Confidentiality Requirements

Key Takeaways Explain This Topic AI

Regulation S-P requires SEC-registered entities to deliver initial privacy notices at account opening and annual notices thereafter

The Safeguards Rule mandates written information security programs with administrative, technical, and physical safeguards

SEC's 2024 amendments to Regulation S-P require incident response programs and customer notification within 30 days of a breach

The Red Flags Rule requires identity theft prevention programs to detect warning signs in account activity
Last updated: January 2026

Privacy and Confidentiality Requirements

For CFP professionals working with SEC-registered entities, Regulation S-P provides the specific rules implementing GLBA's privacy requirements. Major amendments adopted in May 2024 significantly strengthened safeguarding and breach notification obligations, with compliance deadlines in December 2025 (large entities) and June 2026 (smaller entities). Understanding these requirements is essential for both exam success and professional practice.

Regulation S-P: The SEC's Privacy Rule

The SEC adopted Regulation S-P in 2000 to implement GLBA's privacy requirements for entities under its jurisdiction. The regulation applies to:

SEC-registered broker-dealers
SEC-registered investment advisers
Registered investment companies (mutual funds)
Transfer agents registered with the SEC

Core Requirements of Regulation S-P:

Requirement Description
Privacy Notices Initial and annual notices describing information practices
Opt-Out Rights Opportunity to limit sharing with nonaffiliated third parties
Safeguards Rule Policies and procedures to protect customer information
Disposal Rule Proper disposal of consumer report information
Privacy Notice Requirements Under Regulation S-P

Initial Privacy Notice:

Covered institutions must provide an initial privacy notice to each customer not later than the time the customer relationship is established. For investment advisers, this typically means before or at the time of entering into an advisory contract.

The initial notice must clearly and conspicuously disclose:

Categories of nonpublic personal information collected
Categories of information disclosed to affiliates and nonaffiliates
Categories of third parties receiving information
Disclosure policies for former customers
How customer information is protected
Opt-out rights and methods

Annual Privacy Notice:

Unless qualifying for the FAST Act exception, covered institutions must provide an annual privacy notice to customers with whom they have a continuing relationship. The annual notice must be delivered:

At least once during any 12-month period
In a form the customer can reasonably be expected to receive

Clear and Conspicuous Standard:

Privacy notices must be written in a manner that is clear and conspicuous , meaning:

Reasonably understandable (plain language, logical organization)
Designed to call attention to the nature and significance of the information
The Safeguards Rule: Protecting Customer Information

Regulation S-P requires covered institutions to adopt written policies and procedures that address administrative, technical, and physical safeguards for customer information. The goal is to protect against:

Unauthorized access to customer records
Anticipated threats to the security or integrity of records
Potential hazards that could result in substantial harm or inconvenience

Required Safeguards Program Elements:

Safeguard Type Examples
Administrative Employee training, access controls, vendor oversight
Technical Encryption, firewalls, intrusion detection
Physical Locked file cabinets, secure data centers, building access controls
2024 Amendments to Regulation S-P: Major Changes

In May 2024, the SEC adopted significant amendments to Regulation S-P, representing the most substantial changes since the regulation's adoption. These amendments took effect in stages, with the first compliance deadline having passed:

Compliance Deadlines:

Entity Size Compliance Deadline Status (as of Jan 2026)

Large entities (RIAs with $1.5B+ AUM, investment companies with $1B+ net assets, all broker-dealers except small entities) December 3, 2025 Now in effect

Smaller entities June 3, 2026 Upcoming

Key New Requirements:

1. Written Incident Response Program:

Covered institutions must develop and maintain a written incident response program designed to:

Detect unauthorized access to or use of customer information
Respond to and recover from security incidents
Assess the nature and scope of incidents
Contain and control incidents to prevent further harm

2. Customer Notification Requirement:

When an institution becomes aware that unauthorized access to customer information has occurred or is reasonably likely to have occurred, it must provide written notice to affected customers:

Timing : As soon as practicable, but not later than 30 days after becoming aware

Content : Must describe the incident, types of information involved, and contact information for the institution

Exceptions : Notification may be delayed if a law enforcement agency determines it would impede an investigation

3. Service Provider Oversight:

Institutions must require service providers to:

Implement and maintain appropriate safeguards
Notify the covered institution of security incidents involving customer information
Provide notification within 72 hours of becoming aware of a breach

4. Expanded Scope:

The amendments extended safeguards and disposal requirements to transfer agents for the first time.

Exam Tip : The 30-day customer notification deadline and 72-hour service provider notification requirement are key testable concepts from the 2024 Regulation S-P amendments.

Definition of Sensitive Customer Information

The 2024 amendments introduced a definition of "sensitive customer information" for determining when notification is required:

Information is considered sensitive if unauthorized access could "create a reasonably likely risk of substantial harm or inconvenience to an individual identified with the information."

Examples of Sensitive Information:

Social Security numbers (substantial risk by itself)
Account numbers combined with access credentials
Financial account information that could enable unauthorized transactions
Username/password combinations
FTC Safeguards Rule for Non-SEC Entities

Financial institutions not registered with the SEC (such as state-registered investment advisers, tax preparers, and other non-bank financial institutions) are subject to the FTC's Safeguards Rule rather than Regulation S-P.

FTC Safeguards Rule Requirements:

Requirement Details
Designated Qualified Individual Appoint someone responsible for the security program
Written Risk Assessment Identify and assess risks to customer information
Safeguards Implementation Implement safeguards based on risk assessment
Service Provider Oversight Assess service provider security practices
Continuous Monitoring Regularly test and adjust safeguards
Employee Training Train personnel on security awareness
Incident Response Plan Maintain a plan to respond to security events

2024 FTC Amendment - Breach Notification:

Effective May 13, 2024, the FTC requires financial institutions under its jurisdiction to notify the FTC of security breaches affecting 500 or more consumers . Notification must occur:

As soon as possible, but no later than 30 days after discovery
Only for breaches involving unencrypted customer information
The Red Flags Rule: Identity Theft Prevention

The Red Flags Rule requires financial institutions and creditors to develop and implement a written Identity Theft Prevention Program. While primarily enforced by the FTC and banking regulators, CFP professionals should understand its requirements.

Program Requirements:

Component Description
Identify Red Flags Recognize patterns, practices, or activities indicating identity theft
Detect Red Flags Incorporate procedures to detect red flags in operations
Respond to Red Flags Take appropriate actions when red flags are detected
Update the Program Periodically review and update the program

Examples of Red Flags:

Alerts from consumer reporting agencies (fraud alerts, credit freezes)
Suspicious documents (altered IDs, inconsistent information)
Suspicious personal identifying information (addresses that don't match, inconsistent birth dates)
Unusual account activity (sudden changes in patterns, mail returned as undeliverable)
Notices from customers, law enforcement, or other sources indicating identity theft
Disposal Rule

Both the SEC (Regulation S-P) and FTC require proper disposal of consumer report information derived from credit reports. Covered institutions must take reasonable measures to protect against unauthorized access during disposal, such as:

Shredding physical documents
Erasing or destroying electronic media
Contracting with disposal companies that use appropriate methods
For CFP Professionals

Understanding privacy and confidentiality requirements helps CFP professionals:

Deliver required disclosures at appropriate times (initial and annual notices)
Implement appropriate safeguards to protect client information
Respond to security incidents within required timeframes
Oversee service providers who have access to client information
Detect and respond to identity theft warning signs
Maintain compliance with evolving regulatory requirements