The SEC Data Protection Act amends the Investment Advisers Act of 1940, requiring the Securities and Exchange Commission (SEC) to implement robust data protection policies. These policies are specifically designed to safeguard sensitive, nonpublic proprietary information that the SEC obtains or receives from investment advisers. Within one year of the bill's enactment, and after a period of public notice and comment, the SEC must adopt these procedures. The policies must address how the Commission requests such information, ensure its protection based on sensitivity, and restrict access to only appropriate staff. Ultimately, the goal is to prevent the unlawful use or disclosure of this critical financial data.