Privacy Map

New York. Breach notification. Act

NY breach lawNew York data breach notification law (N.Y. Gen. Bus. Law § 899-aa; N.Y. State Tech. Law § 208)

In force

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about New York residents to notify affected individuals after a security breach. Core timing rule: Individuals within 30 days of discovery. Covered data: name plus SSN, driver's licence/ID, account/card numbers, biometric, medical and health insurance data; online credentials.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

SHIELD Act extends to any business holding NY residents' data and imposes reasonable security duties; 30-day cap removed time for scope and restoration from the calculation; no-notice determinations for >500 residents go to the AG within 10 days.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: New York requires the maintaining entity to notify the owner immediately and no later than 30 days after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals within 30 days of discovery; AG, Department of State, State Police (and DFS for Part 500 covered entities); CRAs if >5,000; HIPAA entities notify AG within 5 business days of HHS
DPO
No
Cross-border transfers
None
Maximum penalty
Greater of $5,000 or $20 per failed notification (per-instance component capped at $250,000); SHIELD security violations up to $5,000 each

§3Dates

Key dates
  • Adopted
  • In force
  • S2659B signed 2024-12-21 (30-day deadline, DFS notice; immediate); S2376B added medical and health insurance data effective 2025-03-21; chapter amendment S804 signed 2025-02-14; SHIELD Act 2019

§4Text and authority

Text
Authority
New York Attorney General (with Department of State, State Police and DFS)

§5Where it applies

Domestic law of
New York

§6Sources and verification

Sources consulted
Verification

High confidence.