(a) Effective date. This part is effective on June 21, 2001. In order to provide sufficient time for you to establish policies and systems to comply with the requirements for this part, the compliance date for this part is March 31, 2002.

(b)(1) Notice requirement for consumers who are your customers on the effective date. By March 31, 2002, you must have provided an initial notice, as required by § 160.4, to consumers who are your customers on March 31, 2002.

(2) Example. You provide an initial notice to consumers who are your customers on March 31, 2002 if, by that date, you have established a system for providing an initial notice to all new customers and have mailed the initial notice to all your existing customers.

(c) One-year grandfathering of service agreements. Until March 31, 2003, a contract that you have entered into with a nonaffiliated third party to perform services for you or functions on your behalf satisfies the provisions of § 160.13(a)(1)(ii) even if the contract does not include a requirement that the third party maintain the confidentiality of nonpublic personal information, as long as you entered into the agreement on or before March 31, 2002.