Data Guard
Cybersecurity compliance

Data Breach in New York: Complete Legal Requirements Guide for SMBs

Published October 21, 2025

Scales of justice over the Manhattan skyline, surrounded by icons for legal documents, compliance and data security.

A data breach can strike your business at any moment—from a ransomware attack to an accidental disclosure of customer information. If you operate a business in New York or store data belonging to New York residents, you need to understand your legal obligations under state law.
The consequences of non-compliance are severe: penalties up to $250,000, reputational damage, and potential lawsuits. This guide breaks down exactly what New York law requires when a data breach occurs.

The Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) was signed into law by Governor Cuomo on July 25, 2019. The data breach notification requirements took effect on October 23, 2019, while data security protection requirements became effective on March 21, 2020.
As a result, the SHIELD Act fundamentally transformed New York’s data breach notification framework, expanding both the definition of what constitutes a breach and the protective measures businesses must implement.

Recent December 2024 Amendments: What Changed

In December 2024, Governor Kathy Hochul signed amendments that significantly strengthened the law. Three critical changes you need to know:
1. 30-Day Notification Deadline (Effective Immediately)
Previously, the law required notification “in the most expedient time possible and without unreasonable delay.” However, the December 2024 amendments set a clear 30-day maximum timeline from discovery of the breach.
2. Additional Reporting to NY Department of Financial Services (Effective Immediately)
In addition, businesses must now notify the New York State Department of Financial Services (NYDFS) in addition to existing notification requirements.
3. Expanded Definition of “Private Information” (Effective March 21, 2025)
The definition will expand to include medical information (medical history, conditions, treatments, diagnoses) and health insurance information (policy numbers, subscriber IDs, claims history, appeals history).

Who Must Comply? Broader Than You Think

The NY SHIELD Act applies to any person or business that owns or licenses computerized data containing private information of New York residents—regardless of where your business is located.
This means if you’re a:

    • California-based e-commerce company with NY customers
    • Florida SaaS provider with NY users
    • International business serving NY residents
    • Local NYC restaurant storing customer credit cards
    • Brooklyn accounting firm with NY clients
      You’re covered by this law if you have even ONE New York resident’s private information.
      There are no small business exemptions for breach notification requirements. However, small businesses (defined as having fewer than 50 employees, less than $3 million in gross annual revenue over the past three years, or less than $5 million in year-end total assets) have some flexibility in implementing security safeguards.

What Constitutes “Private Information” Under NY Law?

Private information means personal information (name, number, personal mark, or identifier) combined with one or more of the following data elements:

Currently Protected Data Elements:

    • Social Security number
    • Driver’s license number or non-driver ID card number
    • Account number, credit card number, or debit card number—if circumstances exist where the number can be used to access a financial account without additional information
    • Biometric information (e.g., fingerprints, facial recognition data)
    • Username or email address in combination with a password or security question/answer that would permit access to an online account

Additional Protected Data (Effective March 21, 2025):

    • Medical information: medical history, medical conditions, medical treatments, and medical diagnoses
    • Health insurance information: health insurance policy numbers, subscriber identification numbers, unique identifiers used by health insurers, claims history, and appeals history

Important Note: Private information does NOT include publicly available information lawfully made available from federal, state, or local government records.

What Qualifies as a “Breach of the Security of the System”?

The SHIELD Act significantly expanded the definition of a breach. Under current law, a breach includes unauthorized access to or acquisition of computerized data that compromises the security, confidentiality, or integrity of private information.
Key point: Consequently, You don’t need to prove that data was actually stolen. Unauthorized access alone can trigger notification requirements.

Exception: The Risk-of-Harm Assessment

You may NOT be required to provide notification if:

    1. The exposure was an inadvertent disclosure by persons authorized to access the private information, AND
    2. You reasonably determine that the exposure will not likely result in:
  • Misuse of the information
  • Financial harm to affected persons
  • Emotional harm (in cases of credential disclosure)

Critical Requirement: This determination must be documented in writing and maintained for at least five years. If the incident affects over 500 New York residents, you must provide this written determination to the Attorney General within 10 days of making it.

Timeline: 30 Days Maximum

You must notify affected New York residents within 30 days after discovering the breach. This is a hard deadline as of the December 2024 amendments. On the other hand, permissible delays include:

    • If a law enforcement agency determines notification would impede a criminal investigation
    • To determine the scope of the breach and restore system integrity

Who Must Be Notified?

1. Affected New York Residents
Every NY resident whose private information was, or is reasonably believed to have been, accessed or acquired without authorization.

2. State Agencies (Must NOT cause delay to resident notification):

    • New York State Attorney General
    • New York Department of State
    • New York Division of State Police
    • New York Department of Financial Services (new requirement as of December 2024)

3. Consumer Reporting Agencies (if more than 5,000 NY residents affected):
You must notify the three major consumer reporting agencies without delaying notification to residents.

What Information Must Be Included in Notifications?

Your breach notification must include:

    • Description of the breach: What happened and when it was discovered
    • Types of information compromised: Specifically what private information was or may have been accessed
    • Contact information: Phone number and address where individuals can learn more
    • Remedial actions: Steps you’re taking to protect individuals and prevent future breaches
    • Resources for identity theft protection: Phone numbers and websites of relevant state and federal agencies (the NY Attorney General provides a helpful list)

Notification Methods

You can notify affected individuals through:

    • Written notice (mail)
    • Electronic notice (email), if you have a prior business relationship and the person consented to electronic communication
    • Telephone notification
    • Substitute notice (only if you demonstrate to the NY Attorney General that standard notification would cost more than $250,000 OR more than 500,000 NY residents are affected)

Special Rules for HIPAA-Covered Entities

If you’re a HIPAA-covered entity or business associate:

    • You do NOT need to send duplicate individual notifications if you’re already notifying individuals under HIPAA requirements (HIPAA’s 60-day notification requirement supersedes NY’s 30-day requirement for individual notifications)
    • However, you MUST still notify the NY State Attorney General within 5 business days of notifying the Secretary of Health and Human Services
    • Furthermore, you MUST notify all other required NY state agencies (AG, Department of State, State Police, NYDFS)

Penalties and Enforcement: What’s at Stake?

The NY SHIELD Act does not provide a private right of action—meaning individuals cannot sue you directly under this law. However, the New York State Attorney General has significant enforcement authority.

Civil Penalties:

For Breach Notification Violations:

    • Non-reckless violations: Court may award actual costs or losses incurred by affected persons, including consequential financial losses
    • Knowing and reckless violations: Greater of $5,000 OR $20 per failed notification, with a maximum cap of $250,000

For Failure to Implement Reasonable Safeguards:

    • Up to $5,000 per violation (no cap specified)

Statute of Limitations:

The Attorney General must act within:

    • 3 years of becoming aware of the breach, OR
    • 6 years from the date of the breach itself (extended if you attempted to conceal the breach)

Real-World Context:

By August 2019, the NY Attorney General’s office had already levied fines of more than $600 million related to data breaches under existing statutes. In short, New York takes data security seriously.

Required Security Safeguards: Prevention is Key

Beyond breach notification, the SHIELD Act requires businesses to implement reasonable safeguards to protect private information. You must establish a data security program with three categories of safeguards:

Administrative Safeguards:

    • Designate one or more employees to coordinate the security program
    • Conduct risk assessments to identify internal and external risks
    • Train and manage employees in security practices and procedures
    • Select service providers capable of maintaining appropriate safeguards and require those safeguards by contract

Technical Safeguards:

    • Assess risks in network security, information processing, and transmission
    • Implement measures to detect, prevent, and respond to attacks or system failures
    • Regularly test and monitor the effectiveness of security measures

Physical Safeguards:

    • Protect private information during collection, transportation, and disposal
    • Detect and respond to physical intrusions
    • Dispose of private information within a reasonable time after it’s no longer needed
    • Erase electronic media so information cannot be read or reconstructed

Compliance Exemptions:

You’re considered compliant with security requirements if you’re already subject to and compliant with:

Small Business Flexibility:

Small businesses must still comply but can implement safeguards that are “appropriate” considering:

    • The size and complexity of the business
    • The nature and scope of activities
    • The sensitivity of the information

This doesn’t exempt small businesses from requirements—it allows for reasonable, scaled approaches.

Practical Action Steps for NYC SMBs

Immediate Actions (Do This Now):

1. Inventory Your Data

    • Identify what private information you collect and store
    • Document where this data is located (cloud services, local servers, employee devices)
    • Determine how many NY residents’ data you hold

2. Review Your Current Security Posture

    • Do you have the required administrative, technical, and physical safeguards?
    • Is anyone specifically designated to coordinate security?
    • When was your last risk assessment?

3. Create or Update Your Incident Response Plan

    • Document step-by-step procedures for responding to a breach
    • Include contact information for required state agencies
    • Assign roles and responsibilities to team members
    • Include template notification letters

4. Document Your Compliance

    • Create written security policies and procedures
    • Document risk assessments and determinations
    • Keep records of employee security training

Preparing for March 21, 2025 Changes:

For Healthcare and Insurance-Related Businesses:

    • Review what medical and health insurance information you maintain
    • Assess whether current breach notification templates need updating
    • Consider cyber liability insurance that covers these new categories

Vendor Management:

    • Review contracts with third-party service providers
    • Ensure contracts require vendors to maintain appropriate safeguards
    • Understand your vendors’ breach notification procedures
    • Know whether you’re a data “owner” or “maintainer” in these relationships

Critical Note: If you maintain but don’t own data containing NY residents’ private information, and you experience a breach, you must notify the data owner or licensee.

Creating Your Breach Response Checklist

Within First 24 Hours of Discovery:

    • Contain the breach and secure systems
    • Document the incident (date, time, what was accessed)
    • Determine if law enforcement needs to be contacted
    • Activate incident response team
    • Begin investigation to determine scope

Within First Week:

    • Complete initial scope assessment
    • Determine which NY residents are affected
    • Conduct risk-of-harm analysis (document in writing)
    • If over 500 residents affected and risk-of-harm exemption applies, notify AG within 10 days with written determination
    • Begin drafting notifications

Within 30 Days:

    • Send notifications to all affected NY residents
    • Submit notifications to NY State Attorney General
    • Submit notifications to NY Department of State
    • Submit notifications to NY Division of State Police
    • Submit notifications to NY Department of Financial Services
    • If 5,000+ residents affected, notify consumer reporting agencies
    • Document all notifications sent and dates

Ongoing:

    • Preserve all documentation for at least 5 years
    • Implement remedial measures to prevent future breaches
    • Review and update security program
    • Consider offering credit monitoring or identity theft services to affected individuals

Common Mistakes to Avoid

1. Waiting Too Long
The 30-day deadline is firm. Start your clock from the moment of discovery, not from when you finish investigating.
2. Failing to Document Risk-of-Harm Determinations
If you decide notification isn’t required, document this decision in writing with detailed justification. Keep it for 5 years.
3. Forgetting to Notify All Required Agencies
Don’t just notify residents—you must notify four state agencies (as of December 2024). Missing any of them could result in penalties.
4. Incomplete Notifications
Ensure your notification includes all required elements. Generic “we had a breach” notices don’t satisfy legal requirements.
5. Assuming HIPAA Compliance Means Full Exemption
HIPAA-covered entities still must notify NY state agencies, even if they’re exempt from duplicate individual notifications.
6. Neglecting Vendor Breaches
If your service provider experiences a breach affecting your data, you’re still responsible for notifications.

Consider consulting with a cybersecurity attorney if:

    • The breach affects more than 1,000 individuals
    • Sensitive data like Social Security numbers or financial accounts were accessed
    • You’re uncertain whether notification is required
    • You need help conducting a risk-of-harm analysis
    • You’re facing potential regulatory investigation
    • You need to negotiate with cyber criminals (ransomware situations)
    • Media attention is likely

Resources and Next Steps

Official Resources:

    • NY Attorney General Data Breach Portal: Submit notifications and access forms
    • Consumer Reporting Agencies Contact Information: Available from NY AG upon request

Professional Support:

    • Consider cyber liability insurance that covers breach response costs
    • Engage a cybersecurity firm for regular security assessments
    • Work with legal counsel familiar with NY data breach law

The Bottom Line

The NY SHIELD Act imposes serious obligations on businesses of all sizes. The December 2024 amendments made compliance more stringent with the 30-day notification deadline and expanded agency reporting requirements.
Key Takeaways:

    1. Scope is broad: Any business with NY residents’ data must comply, regardless of location
    1. Timeline is strict: 30 days maximum from discovery to notification
    1. Penalties are significant: Up to $250,000 for notification failures, plus $5,000 per security violation
    1. Prevention matters: Required security safeguards can prevent breaches and demonstrate good faith
    1. Documentation is critical: Written policies, risk assessments, and breach determinations must be maintained

Don’t wait for a breach to get compliant. The time to act is now—before you’re racing against a 30-day clock with significant penalties at stake.

**Need help assessing your *cybersecurity posture* or developing a breach response plan? **Contact us for a free consultation tailored to your **NYC business**!**
*This article provides general information about NY SHIELD Act requirements and should not be considered legal advice. Consult with qualified legal counsel for guidance specific to your situation.*

Data Guard by Arkadian Cybersecurity Inc.

+1 (929) 535-3509

sales@dataguard.nyc

198 Huron St #1L, Brooklyn, NY 11222 / United States

All articles