Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | New York |
|---|---|
| Statute citation | N.Y. Gen. Bus. Law §§ 899-aa to 899-bb (Notification of Unauthorized Acquisition of Private Information; Data Security Protections (SHIELD Act)) (amended 2025) |
| Individual notice timing | 30 days New York requires businesses and persons to notify affected individuals in the most expedient |
| Attorney general notice | Yes New York requires notification to the Attorney General, Department of State, Division of State Police, |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In New York 'breach of the security of the system' means unauthorized access to or acquisition of, or access to or acquisition without valid authorization, of computerized data that compromises the security, confidentiality, or integrity of private information maintained by a business. Good faith access to, or acquisition of, private information by an employee or agent of the business for the purposes of the business is not a breach of the security of the system, provided that the private inform |