Protecting Prospective Investor Information: Why Private Fund Sponsors and Advisers Need Written Privacy and Information-Security Policies

For private fund sponsors, registered investment advisers, and exempt reporting advisers soliciting investments in private funds, the investor onboarding process can create risk for each entity involved in the fundraising process. Sponsors, advisers, funds and their service providers may receive sensitive personally identifiable information (PII) from prospective investors, including names, addresses, dates of birth, Social Security or tax identification numbers, financial statements, source-of-funds information, accreditation materials, beneficial ownership information, and copies of identification documents. For convenience, this alert refers collectively to these categories as “personal information,” although the precise terminology and scope differ under applicable laws. Such personal information can trigger privacy, cybersecurity, recordkeeping, and reputational obligations long before an investor is formally admitted to the fund.

Why this matters

Private fund sponsors and advisers routinely collect personal information to evaluate investor eligibility, conduct anti-money laundering and sanctions screening, and respond to due diligence requests. These activities involve the collection, possession, use and retention of nonpublic PII, which is subject to higher privacy standards and expectations. Accordingly, sponsors and advisers should not treat privacy controls as a back-office issue that begins only after closing but rather as an integral part of the overall private fund offering process. A prospective investor whose information is mishandled may suffer identity theft or financial fraud, and the entities involved may face legal and regulatory scrutiny, investor complaints, contractual claims, reputational harm, and damage to fundraising efforts.

The need for written privacy and information-security procedures has become more important as private fund fundraising has become more digital. Data rooms, electronic subscription portals, cloud storage, email, outsourced administrators, placement agents, compliance consultants, and identity and accreditation verification vendors all increase the number of systems and service providers that may touch investor data. A practical policy or set of procedures can establish how information is collected, where it is stored, who may access it, how long it should be retained, when it should be deleted, and what happens if it is compromised.

Regulatory considerations for private fund sponsors and advisers

SEC-registered investment advisers are subject to Regulation S-P, which requires covered institutions to adopt written policies and procedures reasonably designed to safeguard customer records and information. In May 2024, the SEC adopted amendments requiring covered institutions, including registered investment advisers, to maintain written incident response programs designed to detect, respond to, and recover from unauthorized access to or use of customer information, including procedures for notifying affected individuals in specified circumstances. Those amendments also emphasize service provider oversight, disposal practices, and written records documenting compliance.

While Regulation S-P does not apply directly to every entity involved in a private fund offering, exempt reporting advisers, private funds, general partners and other sponsor entities may be subject to other federal or state privacy, cybersecurity, consumer protection, contractual, or common-law obligations, including the Federal Trade Commission’s’ Safeguards Rule where applicable. Further, an SEC-registered adviser may receive customer information that was originally collected by a fund, general partner, administrator or another financial institution, and the amended Regulation S-P safeguards may apply to that information once it is provided to or maintained on behalf of the adviser.

Sophisticated investors, fund counsel, administrators, and diligence teams also increasingly expect all entities involved in fundraising to be able to explain how personal information is protected.

For all entities involved in the fundraising process, the key point is practical rather than merely technical: if a sponsor, adviser, fund or service provider asks a prospective investor to provide sensitive personal information, the responsible entities should be prepared to protect this personal information in a controlled, documented, and repeatable way.

Private fund sponsors and advisers also should evaluate state privacy, cybersecurity, consumer protection, and breach notification laws. These laws may apply based on where an entity conducts business, where prospective investors or other individuals reside, where employees or representatives are located, where data is collected, or where service providers process information. State-law obligations can differ materially from federal requirements, including with respect to privacy notices, individual rights requests, data retention disclosures, reasonable security standards, contractual requirements for vendors, and breach notification timing.

CCPA Requirements for Fund Managers

California provides a useful example. A private fund sponsor, adviser, fund, general partner or affiliate that meets the California Consumer Privacy Act’s (CCPA) definition of a covered business may be subject to the CCPA, as amended by the California Privacy Rights Act, with respect to personal information of California residents. The CCPA provides rights relating to notice, access, deletion, correction, opt-out of certain sales or sharing, non-discrimination, and imposes limits on certain uses and disclosures of sensitive personal information. The CCPA generally does not apply to personal information collected, processed, sold, or disclosed, which is subject to the Gramm-Leach-Bliley Act (GLBA) and its implementing regulations, including Regulation S-P. This CCPA-exemption is information-specific rather than an entity-wide exemption, however, and it does not apply to the CCPA’s private right of action for certain data-security breaches. As a result, an entity may maintain both GLBA-covered investor information and other personal information that remains subject to the CCPA. Such other personal information may include certain website, marketing, employment, or business-contact information, depending on the context in which the information is collected and used.

In addition to the CCPA’s core requirements, covered businesses also should evaluate California regulations that took effect January 1, 2026, concerning cybersecurity audits, risk assessments, and the use of automated decision-making technology. The regulations impose phased compliance obligations depending on the nature of the business and its processing activities. Among other requirements, businesses engaged in processing that presents a significant risk to consumers’ privacy may be required to conduct risk assessments, and businesses whose processing presents a significant risk to consumers’ security may be required to complete annual cybersecurity audits. Requirements governing certain uses of automated decision-making technology begin January 1, 2027.

Private fund sponsors and advisers subject to the CCPA should assess whether their investor-screening, identity-verification, accreditation, marketing, employment, or other data-processing activities trigger these obligations.

California also maintains a separate data breach notification statute. Businesses that conduct business in California and own or license computerized data containing personal information generally must notify affected California residents when certain unencrypted personal information is acquired, or reasonably believed to have been acquired, by an unauthorized person. Notice may also be required for encrypted information where the encryption key or security credential was compromised and could render the information readable or usable. If a breach requires notice to more than 500 California residents, a sample notice generally must be submitted to the California Attorney General. Entities that collect California resident information during fundraising should therefore ensure that their incident response procedures address both applicable federal requirements and California-specific breach notification obligations.

What prospective-investor PII procedures should address

A policy does not need to be overly long to be effective, and the relevant procedures may be integrated into a broader compliance or information-security program. At a minimum, private fund sponsors and advisers should consider adopting procedures that address the following areas:

• Collection limits. Collect only information that is reasonably necessary for investor qualification, regulatory compliance, tax reporting, fund administration, or other legitimate business purposes. Consider whether the sponsor or adviser needs to receive and retain the underlying document or whether an administrator or verification provider can retain it and provide only the necessary confirmation.
• Approved channels. Require sensitive information to be submitted through secure portals or approved encrypted channels rather than ordinary email whenever practicable.
• Access controls. Limit access to personnel and service providers with a need to know, and periodically review access rights during and after fundraising.
• Vendor oversight. Conduct appropriate due diligence and monitoring of administrators, placement agents, compliance vendors, subscription platforms, and data room providers. Require appropriate confidentiality and security obligations and prompt notice of security incidents, including procedures designed to satisfy Regulation S-P’s service-provider notification requirement where applicable.
• Retention and disposal. Establish how long information about prospective investors will be retained if they do not invest, taking into account applicable securities, advisory, tax, contractual, litigation-hold, and other recordkeeping requirements. Disclose retention practices where required and require secure deletion or destruction when information is no longer required by law or otherwise supported by a legitimate business purpose.
• Individual rights requests. Establish a process for receiving, verifying, tracking, and responding to privacy rights requests where applicable, including rights of access, deletion, correction, opt-out, or limitation of sensitive information use.
• State-law compliance. Identify the states whose privacy, cybersecurity, data retention, consumer protection, and breach notification laws may apply, including whether any information falls outside an applicable GLBA exemption.
• Incident response. Identify escalation contacts, investigation steps, containment measures, investor notification procedures, law enforcement considerations, regulator notification obligations, and documentation requirements. Procedures should account for the specific federal and state notice periods that apply to the relevant entity and information, including Regulation S-P’s outside notice period where applicable.
• Training and accountability. Train investor relations, fundraising, legal, compliance, finance, and operations personnel on the applicable procedures, and document completion of that training.

Practical steps before the next fundraise

Before launching a private fund solicitation, sponsors and advisers should map the flow of prospective investor personal information from first contact through closing or rejection. That map should identify the legal entities that collect or control the personal information, the systems used, the categories of information collected, the internal personnel with access, the outside service providers involved, and the points at which information is transferred, duplicated, archived, or deleted. Sponsors and advisers should then compare existing privacy, cybersecurity, compliance, vendor management, and document retention policies against that workflow.

In many cases, the best approach is not to create a standalone policy that sits apart from the entity’s’ broader compliance program. Instead, sponsors and advisers may integrate prospective-investor PII procedures into existing compliance manuals, cybersecurity policies, Regulation S-P or FTC Safeguards Rule procedures where applicable, vendor management protocols, subscription procedures, privacy notice processes, state-law compliance procedures, and retention schedules. The important point is that the relevant’ written materials should clearly address prospective investors and the fundraising process, not just admitted limited partners or existing advisory clients.

Conclusion

For private fund sponsors and advisers, protecting personally identifiable information is part of investor trust and a core element of a credible compliance program. Allen Matkins regularly represents private fund sponsors, registered investment advisers, and exempt reporting advisers in forming private funds and can assist with reviewing fundraising information flows and preparing compliance policies designed to address applicable federal and state privacy, cybersecurity, and investor information requirements.