Skip to content
Network USA

NY · Breach notification statute

New York data breach notification law

A summary of the New York breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

N.Y. Gen. Bus. Law §§ 899-aa to 899-bb (Notification of Unauthorized Acquisition of Private Information; Data Security Protections (SHIELD Act)) (amended 2025)

Last amended
2025 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

30 days New York requires businesses and persons to notify affected individuals in the most expedient

Attorney general notice

Yes New York requires notification to the Attorney General, Department of State, Division of State Police,

What counts as a breach

In New York 'breach of the security of the system' means unauthorized access to or acquisition of, or access to or acquisition without valid authorization, of computerized data that compromises the security, confidentiality, or integrity of private information maintained by a business. Good faith access to, or acquisition of, private information by an employee or agent of the business for the purposes of the business is not a breach of the security of the system, provided that the private inform

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in New York

516 reports to HHS OCR affecting 42,558,825 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in New York.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Excellus Health Plan, Inc.Health Plan9,358,891Sep 9, 2015Hacking/IT IncidentArchive (closed)
Newkirk Products, Inc.Business Associate3,466,120Aug 9, 2016Hacking/IT IncidentArchive (closed)
Enzo Clinical Labs, Inc.Healthcare Provider2,470,000Jun 5, 2023Hacking/IT IncidentArchive (closed)
IBMBusiness Associate1,900,000Apr 14, 2011UnknownArchive (closed)
New York City Health and Hospitals CorporationHealthcare Provider1,800,000Mar 24, 2026Hacking/IT IncidentUnder investigation

Frequently asked questions

When must New York businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the New York timing rule as: "30 days New York requires businesses and persons to notify affected individuals in the most expedient". (Source: PRC 2026 survey extract.)

Does New York require notice to the attorney general?

The PRC 2026 extract notes: "Yes New York requires notification to the Attorney General, Department of State, Division of State Police,". (Source: PRC 2026 survey extract.)

Does the New York law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the New York breach law.

Does the New York law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the New York breach law.

Does the New York law cover paper records?

No. The PRC 2026 survey records the New York law as covering computerised data only, not paper records.

Is there a private right of action in New York?

No. The PRC 2026 survey does not record a private right of action under the New York breach law.

Is credit monitoring required in New York?

No. The PRC 2026 survey does not record a credit monitoring requirement in New York.

How does the New York law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the New York statute, and see our HIPAA vs state breach notification laws guide.

Sources