What confidentiality standards govern information shared among unrelated client families?
Information from one client family should remain separate from information belonging to every other family. Privacy laws, adviser policies, contracts, professional duties, and security controls limit access and sharing. Disclosure generally requires client authorization or a lawful exception. A family office should use need-to-know access, written procedures, careful vendor controls, and documented incident response.
Privacy laws set the floor
The Gramm-Leach-Bliley Act requires covered financial institutions to explain their privacy practices and limit disclosure of nonpublic personal information to unaffiliated third parties. Certain exceptions allow sharing for service delivery, legal compliance, or other permitted purposes. The law also limits reuse and redisclosure by recipients. [1]
SEC Regulation S-P applies to SEC-registered investment advisers and other covered institutions. It requires privacy notices and written policies for protecting customer records and information. The SEC’s 2024 amendments also require covered firms to maintain written incident response procedures for unauthorized access to or use of customer information. [2] Coverage depends on the entity and its regulatory status, so a family office should confirm which rules apply to each service provider.
Professional duties and contracts add protection
Confidentiality is also a professional obligation. CFA Institute Standard III(E) calls for members and candidates to preserve information from current, prospective, and former clients. It recognizes limited exceptions when disclosure is required by law or concerns illegal activity. [3]
A family office should put its own standard in writing. Engagement letters, confidentiality agreements, privacy notices, and vendor contracts should state who may receive information, why they may receive it, and how long they may retain it. Separate client records, role-based access, and a need-to-know rule help prevent accidental mixing of family data. Sharing one family’s portfolio, liquidity, tax, health, security, or personal details with another unrelated family should require documented authorization or a clear legal basis.
Privacy policies regarding family matters should be set up from the beginning, and violations of these policies should be met with swift repercussions in order to set an example for other team members.
Security controls apply to service providers
The FTC Safeguards Rule requires covered financial institutions under FTC jurisdiction to maintain an information security program with administrative, technical, and physical safeguards. The rule also expects institutions to take steps so affiliates and service providers protect customer information in their care. [4]
In practice, the office should vet vendors, limit data exports, use secure transmission, review access logs, train staff, and maintain a written response plan. These controls support confidentiality across unrelated families, but they do not replace checking the specific privacy, securities, employment, and data breach rules that apply to each entity and location.
Related guides
- Family Office Due Diligence: A Practical Guide for Multifamily Offices
- Access to Alternatives Through an MFO: A Practical Guide for Families
- Cross-Border Families and Multifamily Offices: A Practical Guide