Careers

Diversity

With 18 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Practices & Industries

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Data Counsel

The New Era of Regulation S‑P: When Vendors Breach, the Clock Starts Ticking

IP Intelligence Report

The ITC Looks Behind the Caption with Proposed Disclosure Rule

Consumer Redress After AMG – How Courts are Interpreting and Applying Section 19 of the FTC Act (American Bar Association)

BakerHostetler strengthens Dallas commercial litigation bench with accomplished trial attorney and general counsel Lisa Staler Gallerano

Even during times of change regarding regulatory priorities, regulators remain focused on cybersecurity, information governance and data privacy across the financial services sector. But in recent times, two priorities have emerged to stand at the forefront within those considerations: service provider oversight and breach notification.

core/paragraph

These developments reflect persistent incident trends where service providers continue to account for a significant share of reported security incidents and routinely drive longer notification timelines. Unlike single‑entity events, vendor incidents often involve multiple downstream organizations, can include incomplete forensic information and may result in delayed determinations about whose data was involved. Regulators responded with tightened reporting frameworks to help minimize delays.

core/heading

At the federal level, the Securities and Exchange Commission (SEC) amended Regulation S‑P, which implements the Gramm‑Leach‑Bliley Act (GLBA) safeguard requirements for SEC‑registered firms. The amendments align with long‑standing GLBA safeguard requirements for other financial institutions while imposing clearer operational requirements including:

Written incident response and service provider oversight programs

core/list-item

Notification to involved customers within 30 days of determining a reportable incident occurred

Notification by service providers to the registered firm within 72 hours of discovering an incident involving the firm’s customer data

core/list

Regulators are backing these requirements with enforcement. In recent years, the SEC took action against regulated entities that maintained inadequate cybersecurity and identity theft prevention programs, imposing civil penalties ranging from hundreds of thousands to tens of millions of dollars, along with cease‑and‑desist orders and requirements to remediate deficiencies in safeguarding customer information and related compliance controls under Regulation S‑P and Regulation S‑ID.

The Consumer Financial Protection Bureau has also weighed in on these issues through its Open Banking Rule, which (assuming it survives ongoing legal challenges and regulatory reconsideration) may soon impose new data access, use limitation and deletion obligations.

The New York State Department of Financial Services (NYDFS) continues to set the tone at the state level for financial services firms. NYDFS emphasizes third‑party risk management through guidance and aggressive enforcement, securing significant penalties for cybersecurity failures. Its actions increasingly signal where other state regulators may follow.

Regulators are no longer tolerant of vendor‑driven delays. In 2026, firms are expected to contract for speed, aggressively oversee service providers and execute incident response plans without hesitation. Timeliness is now a core compliance obligation.

For additional analysis of regulatory enforcement trends and incident response insights, see the <em>2026 Data Security Incident Response Report</em>, available for download <a href="https://bh.bakerlaw.com/49/1329/landing-pages/dsir.asp" target="_blank" rel="noreferrer noopener">here</a>.

Related Services

Featured Insights