SEC Data Protection Act

Legislative Summary: HR 6161 - SEC Data Protection Act

Overview

The SEC Data Protection Act is a targeted legislative proposal designed to strengthen the safeguards surrounding sensitive information collected by the Securities and Exchange Commission (SEC) from investment advisers. The bill focuses on preventing the unlawful use or disclosure of nonpublic proprietary information provided to the agency during regulatory processes.

Purpose and Intent

The primary objective of this bill is to ensure that investment advisers can provide necessary data to the SEC without risking the exposure of trade secrets or proprietary business information. By mandating the creation of formal data protection policies, the bill aims to increase transparency and security in how the SEC handles sensitive private-sector data.

Key Provisions

The bill amends Section 204 of the Investment Advisers Act of 1940 to require the SEC to establish a formal framework for data protection. Specifically, the Commission must adopt policies and procedures that:

• Regulate Requests: Establish clear guidelines for the circumstances under which the SEC requests proprietary information.
• Implement Safeguards: Create security measures tailored to the specific level of sensitivity of the information received.
• Restrict Access: Limit the ability to view or handle this data to only the "appropriate staff" as determined by the Commission.
• Prevent Misuse: Establish protocols to protect the information from any unlawful disclosure or unauthorized use.

Who is Affected?

• The Securities and Exchange Commission (SEC): The agency would be legally mandated to overhaul or formalize its internal data handling procedures.
• Investment Advisers: Registered investment advisers who submit data to the SEC would gain additional legal protections regarding their nonpublic proprietary information.
• Regulatory Staff: SEC employees would be subject to stricter access controls and guidelines when handling sensitive adviser data.

Timeline and Procedural Details

• Implementation Deadline: The SEC must adopt these policies and procedures not later than one year after the date the act is enacted.
• Regulatory Process: The policies must be adopted following a "notice and comment" period, allowing for public input and industry feedback before the rules are finalized.
• Current Status: The bill was introduced on November 19, 2025, and has been referred to the House Committee on Financial Services.