← All US breach laws·NY

New York data breach notification law

New York's data breach notification requirements under N.Y. Gen. Bus. Law §899-aa + §899-bb (SHIELD Act, eff. 2020). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
N.Y. Gen. Bus. Law §899-aa + §899-bb
Enforcer
New York Attorney General + Department of State + Department of Financial Services (for licensed entities under 23 NYCRR 500)
AG notification
Required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore reasonable system integrity
Notify the state regulator
Yes — written notice to the NY AG, Department of State, and State Police; for DFS-licensed entities, also DFS within 72 hours under 23 NYCRR 500.17(a)
Notify consumer reporting agencies
Yes — if more than 5,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
SHIELD Act expanded breach to include unauthorized ACCESS (not just acquisition); inadvertent disclosure exception applies only if the recipient is unlikely to misuse the information and the determination is documented
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under New York law

First name/initial + last name with SSN, DL/state ID, financial account + access code (or account alone if accessible), biometric data, OR username/email + password/security Q&A; SHIELD Act significantly broadened from prior law

Penalties and enforcement

Civil penalty up to $5,000 per violation OR $20 per failed notification (capped at $250,000) — whichever is greater; DFS-licensed entities face additional 23 NYCRR 500 penalties
Enforced by: New York Attorney General + Department of State + Department of Financial Services (for licensed entities under 23 NYCRR 500). Official regulator page →

Common pitfalls

⚠ DFS-regulated entities (banks, insurers, etc.) must ALSO file under 23 NYCRR 500.17(a) within 72 hours — separate from the SHIELD Act AG filing
⚠ SHIELD Act covers unauthorized ACCESS, not just acquisition — many out-of-state companies use the narrower 'acquisition' framing and miss notification triggers

Frequently asked questions

How long do I have to notify New York residents after a data breach?
In the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore reasonable system integrity
Do I have to notify the New York Attorney General?
Yes — written notice to the NY AG, Department of State, and State Police; for DFS-licensed entities, also DFS within 72 hours under 23 NYCRR 500.17(a)
Does New York require notification to nationwide consumer reporting agencies?
Yes — if more than 5,000 residents, notify nationwide CRAs
Is encrypted data exempt from New York's breach notification requirement?
Yes — New York has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can New York residents sue me directly for a data breach?
No — New York's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under New York law?
First name/initial + last name with SSN, DL/state ID, financial account + access code (or account alone if accessible), biometric data, OR username/email + password/security Q&A; SHIELD Act significantly broadened from prior law
What are the penalties for failing to comply with New York's breach notification law?
Civil penalty up to $5,000 per violation OR $20 per failed notification (capped at $250,000) — whichever is greater; DFS-licensed entities face additional 23 NYCRR 500 penalties

Related state breach laws

New Jersey (NJ)
N.J. Stat. §56:8-163
New Mexico (NM)
N.M. Stat. §§57-12C-1 to 57-12C-12
North Carolina (NC)
N.C. Gen. Stat. §§75-60 to 75-65
North Dakota (ND)
N.D. Cent. Code §§51-30-01 to 51-30-07

Pre-empt the New York breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against New York's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit