Securities Regulation Daily Wrap Up, SEC NEWS AND SPEECHES—House bill seeks to protect investment adviser data held by SEC, (Nov 20, 2025)

By Tom Leithauser

The Securities and Exchange Commission would be required to develop a cybersecurity plan to protect information submitted by registered investment advisers under bipartisan legislation introduced in the House.

The SEC Data Protection Act (H.R. 6161, 119th Cong. (2025)) was introduced by Reps. David Scott (D-Ga.) and Barry Loudermilk (R-Ga.) and has 15 co-sponsors. It would require the SEC, within one year of the bill’s enactment, to undertake a rulemaking to develop “policies and procedures reasonably designed to protect sensitive, nonpublic proprietary information... that the Commission obtains or receives from an investment adviser,” according to its text.

Reps. Scott and Loudermilk introduced similar legislation in 2020 that failed to advance.

“The rise in cyber intrusions and data exposure incidents underscore the urgency in which the SEC must adopt strong, transparent, and uniform procedures that meet the moment,” Rep. Scott said in a news release. “For years, market participants and cyber experts have warned Congress that the Commission, like many other financial regulators, does not have the modern, consistent cybersecurity safeguards in place to protect the highly sensitive information it collects.”

“Continuing to rely on outdated data protection frameworks could significantly jeopardize the trust Americans have long placed on the U.S. financial system,” Rep. Scott added. “Our proposal does not impede regulators from seeking the information they need, but it does ensure that the SEC meets basic, modern security standards consistent with best practices across the federal government and private sector.”

“As a former small business owner and Air Force veteran with a background in IT and cybersecurity, I understand how critical it is to have hardened security infrastructure,” Rep. Loudermilk said. “Sadly, we have seen all too often that the federal government is the weakest link in the cybersecurity chain. The SEC Data Protection Act will bring the Commission’s cybersecurity infrastructure in line with industry best practices, provide vital oversight of the Commission’s cybersecurity posture going forward, and ensure that advisor-provided information is safe and secure.”

RegulatoryActivity: AccountingAuditing InvestmentAdvisers SECNewsSpeeches