NY SHIELD Act

No changes recorded yet — we are watching, and nothing has been published.

1. 2025-02-14 Chapter amendments signed (chapters 30 and 91 of 2025)
2. 2024-12-21 Chapter 647 of 2024 signed and effective – 30-day breach notice, DFS notification
3. 2019-07-25 SHIELD Act signed (chapter 117 of 2019)

1. 2025-02-14
   GBL 899-aa, as amended by chapters 30 and 91 of 2025 AmendmentCurrent text

   Two chapter amendments to the December 2024 acts, signed on 14 February 2025, narrowed the notice to the Department of Financial Services and made technical changes. source

   More

   • Chapter 91 (S804), a chapter amendment to chapter 647 of 2024, limits the notice to the Department of Financial Services to covered entities under 23 NYCRR 500.1 and requires it to be given in compliance with 23 NYCRR 500.17; it takes effect with chapter 647.
   • Chapter 30 (A920/S785), a chapter amendment to chapter 613 of 2024, adjusts that chapter's medical and health insurance information changes, including technical amendments to section 899-aa; it takes effect with chapter 613.
2. 2024-12-21
   Chapters 613 and 647 of 2024 Amendment

   Two acts signed on 21 December 2024 set a 30-day deadline for breach notice, added the Department of Financial Services to the agencies notified, and added medical and health insurance information. source

   More

   • Chapter 647 (S2659B), effective immediately, requires notice within 30 days after the breach is discovered and adds DFS to the agencies to be notified.
   • Chapter 613 (A4737B/S2376B), effective on the 90th day after becoming law, adds medical and health insurance information to the private information covered by section 899-aa.
3. 2019-07-25
   SHIELD Act – chapter 117 of 2019 (S5575B) Major version

   Signed on 25 July 2019; widened breach notification to unauthorized access and created the section 899-bb reasonable data security duty. source

   More

   • The breach notification amendments took effect on the 90th day after the act became law, and the data security section 899-bb on the 240th day.

Anyone holding New York residents' private information in computerized form, with a scaled programme for small businesses and deemed compliance for GLBA, HIPAA and 23 NYCRR 500 entities.

Who

Any person or business that owns or licenses computerized data including private information of a New York resident (899-bb(2)(a)). source

Breach trigger

Private information that was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization (899-aa(2)). source

Deemed compliant

Entities subject to and compliant with GLBA, HIPAA/HITECH, 23 NYCRR 500 or other official data security rules are compliant regulated entities under 899-bb. source

Small business

Fewer than 50 employees, under $3 million gross annual revenue in each of the last three years, or under $5 million in year-end total assets. source

Businesses run their own data security programme and notify residents and state agencies of breaches within 30 days of discovery.

Security programme

Reasonable administrative, technical and physical safeguards, such as a designated coordinator, risk assessment, training, vendor contracts, testing of key controls and timely disposal (899-bb(2)(b)). source

Small business

Safeguards appropriate to the size and complexity of the business, its activities and the sensitivity of the information (899-bb(2)(c)). source

Notice deadline

In the most expedient time possible and within 30 days after the breach is discovered, except for the legitimate needs of law enforcement (899-aa(2)). source

State notice

Notify the Attorney General, the Department of State, the State Police and, for 23 NYCRR 500 covered entities, DFS; credit agencies too if more than 5,000 residents (899-aa(8)). source

Inadvertent disclosure

Notice is not required for an inadvertent disclosure by authorized persons unlikely to cause harm; the written determination is kept five years and sent to the Attorney General if over 500 residents. source

The Attorney General sues for injunctions, damages and civil penalties; the data security section creates no private right of action.

Data security

Failing the reasonable security requirement is a violation of GBL 349; the Attorney General may sue for an injunction and civil penalties under GBL 350-d (899-bb(2)(d)). source

Private suits

Nothing in section 899-bb creates a private right of action. source

Time limit

A breach notification action must be brought within three years of the Attorney General learning of the violation or of the notice, and never more than six years after discovery unless the breach was hidden. source

1. Law text GBL 899-aa – Notification; person without valid authorization has acquired private information
2. Law text GBL 899-bb – Data security protections
3. Law text S5575B (2019) – SHIELD Act
4. Law text S2659B (2023-2024) – 30-day breach notification
5. Law text S2376B (2023-2024) – medical and health insurance information

1. NYDFS Part 500

   23 NYCRR 500 sets prescriptive cybersecurity rules for DFS-regulated financial entities, which are deemed compliant with the SHIELD Act's security duty.

2. 201 CMR 17.00

   Massachusetts prescribes specific controls such as encryption; New York lists illustrative safeguards and scales them for small businesses.

3. CA SB 1386

   California also requires notice within 30 days, but is triggered by acquisition of data; New York is triggered by access as well.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 30 September 2026. Subscribe to NY SHIELD Act (RSS)