New York Data Breach Notification Law

The New York data breach notification law's 30-day deadline

New York's law, General Business Law § 899-aa, gives a business 30 days from discovering a breach to notify the New York residents whose private information was exposed ¹. The statute still requires notice in the most expedient time possible and without unreasonable delay, so a company that has its facts by day 10 should not hold the letters until day 30.

The fixed deadline is recent: Chapter 647 of 2024, signed December 21, 2024, added the 30-day limit along with a notice to the Department of Financial Services ². Chapter 91 of 2025, signed February 14, 2025, narrowed that DFS notice to businesses DFS regulates ³. Chapter 613 of 2024, in force since March 21, 2025, added medical and health insurance information to the covered data ⁴.

The only delay the statute allows past those limits is one requested by law enforcement ¹.

Which data counts, and the narrow no-harm exception

New York covers more than the classic name plus Social Security number. The statute also reaches ¹:

• Login credentials for an online account
• An account number on its own, in some cases
• Biometric data such as fingerprints
• Medical information and health insurance information

Encrypted data is exempt, unless the encryption key was also accessed or acquired ¹. Encrypting laptops and backups is one of the cheapest ways to keep a stolen device from becoming a notice event.

New York's no-harm exception is far tighter than the versions most states use. It applies only to an inadvertent disclosure by people who were allowed to see the data, and only if the business reasonably decides the exposure will not likely lead to misuse or financial harm, or, for online credentials, emotional harm ¹. That decision must be written down and kept for five years, and if more than 500 New York residents were affected, it goes to the Attorney General within 10 days ¹. A hacker, a ransomware gang or a stolen laptop does not fit this exception.

Notice to the Attorney General, State Police and DFS

Every breach that requires resident notice also requires notice to three state offices: the Attorney General, the Department of State and the Division of State Police ¹. There is no minimum count. The filing covers the timing, content and distribution of the resident notices and the approximate number of people affected, with a copy of the notice template. It has no separate deadline, but it may not hold up the resident letters ¹.

Three groups have extra steps:

• DFS-regulated businesses (banks, insurers and other DFS licensees) must also notify DFS ¹. Under the DFS cybersecurity regulation, that report is due no later than 72 hours after determining a cybersecurity incident occurred ⁵.
• HIPAA covered entities that report a breach to HHS must send the Attorney General a copy within 5 business days ¹.
• Businesses notifying under GLBA, HIPAA or 23 NYCRR 500 satisfy the resident notice that way, but they still owe the state agency notice ¹.

When more than 5,000 New York residents are notified at one time, the consumer reporting agencies must be told as well ¹. A vendor that holds data for another company must tell that company immediately and within 30 days of discovery ¹.

Penalties and the SHIELD Act's security duty

The Attorney General enforces the law and can sue for an injunction and damages ¹. For knowing or reckless violations, a court may impose a civil penalty of the greater of $5,000 or up to $20 per failed notice, with the per-notice amount capped at $250,000 ¹.

The statute does not create its own right for residents to sue. It does say its remedies are in addition to other lawful remedies, so whether other claims are open is a question for counsel ¹.

A second law sits beside the notice rule. The SHIELD Act, § 899-bb, requires any business holding computerized private information of New York residents to keep reasonable safeguards, with room for small businesses to scale them to their size ⁶. A written information security plan is the usual way to show what those safeguards are. IC3 logged 45,255 complaints from New Yorkers in 2025 and about $1.23 billion in reported losses, fourth nationally on both measures ⁷.

The first week after a breach at a New York business

While the attack is live, a New York business with cyber coverage calls its carrier first and files an IC3 report for the FBI second, and the affected machines stay untouched until evidence is captured ⁸⁹¹⁰. Read the policy before hiring anyone, since some require the carrier's chosen lawyers and forensic firm.

Then work in this order:

1. Get your IT firm or an outside forensic team to contain it; what breach response costs and who does it lays out the split.
2. Pin down the exposed data and list people by home state. A customer list that reaches into New Jersey or Connecticut brings in the New Jersey breach law and others, and every state's deadline is in our table.
3. Prepare the three-agency filing at the same time as the resident letters, not after them.
4. Fix the cause, record what changed, and measure your controls against what carriers check at renewal.

Our guides for New York City, Brooklyn, Long Island, Albany and Buffalo compare local IT support that includes breach response.

General Business Law § 899-aa was compared with this guide on October 13, 2026. The page explains the statute and stops short of legal advice; New York counsel should confirm what applies to you.