New York. Cybersecurity. Act
NY SHIELD ActStop Hacks and Improve Electronic Data Security Act (SHIELD Act; N.Y. Gen. Bus. Law §§ 899-aa, 899-bb)
In force
Partly verified
Medium confidence.dpo_required Conditional: designate employees to coordinate security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.
§1Summary
- Synopsis
Requires any person owning or licensing computerised private information of New York residents to maintain reasonable administrative, technical and physical safeguards, and expanded the state's breach notification law.
- Key themes
- Unique features
Security duty applies regardless of whether the business operates in New York; compliant regulated entities (HIPAA, GLBA, DFS) are deemed compliant.
- SaaS relevance
Any SaaS holding New York residents' private information must maintain a reasonable security programme.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Individuals within 30 days of discovery; AG, Department of State and State Police (and DFS for regulated entities)
- DPO
- Conditional
- Cross-border transfers
- None
- Maximum penalty
- Up to $5,000 per security violation; breach notice failures $20 per failed notice up to $250,000
§3Dates
- Key dates
- Adopted
- In force
- Breach provisions effective 2019-10-23; security requirements 2020-03-21; December 2024 amendment set 30-day individual notice deadline.
§4Text and authority
- Text
- Authoritative text nysenate.gov
- Authority
- New York Attorney General
§5Where it applies
- Domestic law of
- New York
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.dpo_required Conditional: designate employees to coordinate security programme. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.