Cyber Liability by state
New York data breach notification law and cyber insurance
Direct answer
What is New York's data breach notification law?
New York's breach notification law (N.Y. Gen. Bus. Law sect. 899-aa) requires businesses to notify affected residents in the most expedient time possible and without unreasonable delay, but not later than 30 days after discovery of the breach after a breach of personal information.
What the statute requires
New York's SHIELD Act requires businesses to notify affected residents of breaches of private information within 30 days of discovery, with notice to the Attorney General, Department of State, State Police, and Department of Financial Services regardless of size. Cyber liability insurance typically covers the forensics, notification, and legal review this statute drives, along with regulatory defense.
- Consumer notification deadline
- In the most expedient time possible and without unreasonable delay, but not later than 30 days after discovery of the breach
- Regulator notice
- Notify the New York Attorney General, the Department of State, the Division of State Police, and the Department of Financial Services of any breach regardless of the number of residents affected.
- Credit bureau notice
- Notify consumer reporting agencies when a breach requires notice to more than 5,000 residents.
- Safe harbor
- Notification is not required if the compromised data was encrypted and the encryption key was not acquired, or where the exposure is an inadvertent disclosure unlikely to cause harm.
- Enforcement
- Violations are enforceable by the Attorney General, who may seek civil penalties for each failure to notify subject to statutory caps.
Statutes and sources
-
New York SHIELD Act
N.Y. Gen. Bus. Law sect. 899-aa
Regulator: New York Attorney General . Last verified 2026-07-29 from the official source .
Related New York compliance pages
Cyber Liability in other states
- Alabama
- Alaska
- Arizona
- Arkansas
- California
- Colorado
- Connecticut
- Delaware
- District of Columbia
- Florida
- Georgia
- Hawaii
- Idaho
- Illinois
- Indiana
- Iowa
- Kansas
- Kentucky
- Louisiana
- Maine
- Maryland
- Massachusetts
- Michigan
- Minnesota
- Mississippi
- Missouri
- Montana
- Nebraska
- Nevada
- New Hampshire
- New Jersey
- New Mexico
- North Carolina
- North Dakota
- Ohio
- Oklahoma
- Oregon
- Pennsylvania
- Rhode Island
- South Carolina
- South Dakota
- Tennessee
- Texas
- Utah
- Vermont
- Virginia
- Washington
- West Virginia
- Wisconsin
- Wyoming
Get New York coverage handled
Share a few details and an agent will respond within one business day.