What is nonpublic personal information?

Definition

Nonpublic personal information is a Regulation S-P term. The regulation's own definitions (17 CFR 248.3) control, but it generally covers personally identifiable financial information about a consumer that isn't publicly available: account numbers, balances, holdings, income and tax information, and the fact that someone is your client.

Our AI policy template uses the same definition and points to the regulation for detail. Amended Regulation S-P also uses "customer information" and "sensitive customer information" for its incident response and vendor requirements.

Why it matters for advisors

NPI is the data most AI tools in an advisory firm handle: notetakers hear it, CRMs store it, document tools read it. Where it goes decides which vendors you have to oversee under Regulation S-P.

Most firm AI policies draw their main line here: NPI only in approved tools on approved plans, never in personal accounts.

In practice, most of what an advisor says or writes about a client includes NPI. That's why many firms' AI policies start from the assumption that client information should only go into approved tools, rather than asking staff to judge each case.

Example

A paraplanner wants help with a spreadsheet formula for a client's cash-flow model. They use dummy numbers in a general assistant rather than pasting the real file.

Watch out for

Use the regulation's definitions, not a summary, when a question turns on whether something counts.