Any business that holds computerised private information about a New York resident owes New York two duties, wherever it is based: keep reasonable safeguards, and notify quickly when that data is accessed without authorisation. The Stop Hacks and Improve Electronic Data Security Act (SHIELD Act), signed on 25 July 2019, rewrote the state breach law in General Business Law (GBL) section 899-aa and added a data security duty in section 899-bb. The current text, last revised in March 2025, also covers medical and health insurance information and sets a 30-day outer limit for consumer notice. This guide covers both sections, Attorney General enforcement and an evidence-based programme, for security, privacy and legal leads at organisations of any size, in any state, that hold data about New Yorkers. For how New York sits beside the other state security laws, see the US State Cybersecurity Laws Map. The statute text was checked on the New York Senate site on 9 November 2026.
Key takeaways
- Residence of the data subject decides scope. Section 899-bb applies to any person or business that owns or licenses computerised private information of a New York resident, with no requirement to do business in New York.
- Access alone can be a breach. Since the SHIELD Act, unauthorised access to private information counts, not only acquisition, and the statute lists factors for deciding whether data was viewed, copied or downloaded.
- Thirty days is the ceiling, not the target. Residents must be told in the most expedient time possible and within 30 days of discovery, with the Attorney General, the Department of State and the State Police notified as well.
- The safeguards list is the audit checklist. Section 899-bb names fourteen administrative, technical and physical safeguards; a programme that maps evidence to each one is deemed compliant, and small businesses scale them.
- Enforcement is by the Attorney General, not class actions. There is no private right of action under 899-bb; failures are treated as deceptive practices under GBL 349 with civil penalties, and recent settlements require MFA, logging, data inventories and encryption.
Who the SHIELD Act covers
Both sections attach to the data, not the company's location: a Texas firm with remote staff in Buffalo is in scope. Three roles carry different duties.
| Role | Breach duty (899-aa) | Security duty (899-bb) |
|---|---|---|
| Owner or licensee of the data | Notify affected residents, then the Attorney General, Department of State and State Police; consumer reporting agencies above 5,000 residents | Develop, implement and maintain reasonable safeguards, including disposal |
| Maintainer (a service provider holding data it does not own) | Notify the owner or licensee immediately, and in any case within 30 days of discovery | No direct statutory duty in 899-bb, but owners must select capable providers and require safeguards by contract |
| Compliant regulated entity (GLBA, HIPAA and HITECH, 23 NYCRR Part 500, or other federal or New York data security rules) | Notice already given under those regimes satisfies the resident notice; state agency notice still applies | Deemed compliant if subject to and in compliance with that regime |
Small businesses: section 899-bb defines a small business as one with fewer than 50 employees, or under $3 million gross annual revenue in each of the last three fiscal years, or under $5 million in year-end total assets. The test is "or", so meeting any one limb qualifies. A small business still needs safeguards, but they are judged against its size and complexity, the nature and scope of its activities and the sensitivity of the information it collects.
Deemed compliance lasts only while the entity actually complies with its sector rule, so a Part 500 or HIPAA gap is also a SHIELD gap. See the NYDFS Part 500 Guide, the GLBA Safeguards Rule Guide and the HIPAA Security Rule Guide.
What counts as private information
Personal information is any information that can identify a natural person. It becomes private information, the trigger for both duties, when combined with one of the data elements below and either the element or the combination is unencrypted, or encrypted with a key that was also accessed or acquired.
| Data element (GBL 899-aa(1)(b)) | Typical systems that hold it | Security team note |
|---|---|---|
| Social Security number | HR, payroll, benefits, KYC | Tokenise or encrypt at field level; restrict exports |
| Driver's licence or non-driver ID number | Insurance quoting, rental, age checks | Never echo back in public web forms (see the insurer settlements below) |
| Account or card number with any security code, access code or password, or usable without one | Billing, payments, CRM | PCI scope overlaps; card data alone can be private information |
| Biometric information used to authenticate identity | Time clocks, physical access, face or voice login | Templates count; encrypt and separate from identity records |
| Medical information | Benefits, occupational health, wellness apps | Added by a later amendment; reclassify data stores |
| Health insurance information, including claims and appeals history | Benefits administration, claims platforms | Also added by a later amendment |
| User name or email address with a password or security question and answer that permits access to an online account | Identity provider, customer portals, logs | Credential exposure is a reportable breach on its own |
Publicly available information lawfully made available from government records is excluded. The credentials element matters most for identity teams: a leaked database of customer email and password hashes that can be cracked, or plaintext passwords captured in application logs, is private information. See the Password Spraying and Credential Stuffing Defence Guide.
Breach notification duties under GBL 899-aa
A breach of the security of the system is unauthorised access to or acquisition of computerised data that compromises the security, confidentiality or integrity of private information. Good-faith access by an employee or agent for business purposes is not a breach if the information is not misused or further disclosed. To decide whether data was accessed or acquired, the statute points to indications such as information being viewed, copied or downloaded, or used fraudulently, so access logs are the primary evidence.
Clocks and recipients
| Who | When | What |
|---|---|---|
| Affected New York residents | Most expedient time possible, no later than 30 days after discovery, subject to a law enforcement delay | Business contact details, state and federal agency phone numbers and websites for identity theft help, the categories of information and the private information elements involved |
| Data owner or licensee (from a maintainer) | Immediately, and within 30 days of discovery | Facts of the breach so the owner can notify |
| Attorney General, Department of State, Division of State Police | Whenever any New York resident is notified, without delaying resident notice | Timing, content and distribution of notices, approximate number affected and a copy of the template notice |
| Department of Financial Services | Where the business is a Part 500 covered entity, under 23 NYCRR 500.17 | As required by Part 500 |
| Consumer reporting agencies | When more than 5,000 New York residents are notified at one time | Timing, content, distribution and approximate number |
| Attorney General (HIPAA covered entities) | Within five business days of notifying the HHS Secretary of a breach | Copy of the HHS breach report |
The Attorney General's office says that submitting its online breach form through the OAG data breach reporting portal is sufficient for the state agency notice.
The no-harm exception and its paperwork
Resident notice is not required where exposure was an inadvertent disclosure by persons authorised to access the information and the business reasonably determines it is unlikely to result in misuse, financial harm or emotional harm (the last applies to online credentials). The determination must be in writing and kept for at least five years; if more than 500 New York residents are affected, it must be sent to the Attorney General within 10 days.
Methods of notice
Written, telephone (with a log) and electronic notice (only with the person's express consent and a log) are allowed. Substitute notice, combining email, a conspicuous website posting and statewide media, is available only where the business shows the Attorney General that notice would cost over $250,000, that more than 500,000 people are affected or that it lacks sufficient contact information. The section preempts local laws, so cities and counties cannot add stricter breach rules. Prepare with the Data Breach Notification Checklist to prepare.
The reasonable safeguards duty under GBL 899-bb
Section 899-bb requires reasonable safeguards to protect the security, confidentiality and integrity of private information, including its disposal. A business is deemed compliant if it is a compliant regulated entity or if it runs a data security programme containing the safeguards in the table. The evidence column is our suggestion, not statutory text.
| Statutory safeguard | Evidence to keep (NHI Mgmt Group suggestion) |
|---|---|
| Administrative | |
| Designate one or more employees to coordinate the programme | Board or executive minute appointing the coordinator |
| Identify reasonably foreseeable internal and external risks | Dated risk assessment with owners |
| Assess the sufficiency of safeguards in place to control those risks | Control assessment results and remediation tickets |
| Train and manage employees in the programme's practices and procedures | Completion records and phishing simulation results |
| Select capable service providers and require safeguards by contract | Questionnaires, contract clauses, review cadence |
| Adjust the programme for business changes or new circumstances | Annual programme review record |
| Technical | |
| Assess risks in network and software design | Design review records, threat models |
| Assess risks in information processing, transmission and storage | Data inventory and encryption status report |
| Detect, prevent and respond to attacks or system failures | Alert rules, incident tickets, exercise reports |
| Regularly test and monitor the effectiveness of key controls, systems and procedures | Scan and test reports with closure dates |
| Physical | |
| Assess risks of information storage and disposal | Retention schedule and disposal risk review |
| Detect, prevent and respond to intrusions | Access logs, visitor records |
| Protect against unauthorised access or use during or after collection, transport and disposal | Courier, shredding and transfer procedures |
| Dispose of private information within a reasonable time after it is no longer needed, by erasing electronic media so it cannot be read or reconstructed | Deletion job logs, sanitisation certificates |
The statute does not name specific technologies. The Attorney General's April 2023 business guide on protecting personal information fills that gap with the practices the office expects: strong authentication such as multi-factor authentication with unique, complex passwords; encryption of sensitive customer data such as Social Security numbers; vetting and contractually binding vendors and monitoring them; an asset inventory recording where customer information is stored; safeguards against credential stuffing; and prompt, accurate breach notices that do not downplay scope. Read this list beside the statutory safeguards: it is the clearest public statement of what "reasonable" means to the enforcer.
Enforcement and what settlements require
A failure to comply with 899-bb is deemed a violation of GBL 349 (deceptive acts and practices), and the Attorney General can sue to enjoin it and seek civil penalties under GBL 350-d. The Attorney General's SHIELD page states that failing to maintain reasonable safeguards carries a civil penalty of up to $5,000 per violation. Section 899-bb states that it creates no private right of action. For notification failures under 899-aa, courts may award actual costs or losses to people who were not notified and, where a violation is knowing or reckless, a civil penalty of the greater of $5,000 or up to $20 per failed notification, capped at $250,000. Actions must start within three years of the Attorney General becoming aware of the violation or receiving notice, and no later than six years after discovery of the breach unless the company concealed it.
Settlements show the controls the Attorney General expects:
- Car insurers, October 2025: the Attorney General, after a joint investigation with the Department of Financial Services, secured $14.2 million from eight car insurers whose online quoting tools pre-filled driver's licence numbers from data broker sources, exposing more than 825,000 New Yorkers. Required measures included a comprehensive information security programme, a data inventory of private information, reasonable authentication for access to private information, logging and monitoring with alerts on suspicious activity, and improved threat response. Ten insurers paid $20.79 million in total across this line of cases.
- Marymount Manhattan College, September 2023: after a 2021 ransomware intrusion that exposed data on 99,097 New Yorkers, the college agreed to invest $3.5 million over six years, encrypt personal information at rest and in transit, maintain patch management, enable multi-factor authentication for network logins, scan for vulnerabilities and publish a retention and deletion plan.
How to implement a SHIELD programme
- Find the data. Run discovery for the seven private information elements across databases, file shares, SaaS, backups and logs. Tag each store with owner, record count and whether it holds New York resident data.
- Decide your route. If you are a GLBA, HIPAA or Part 500 regulated entity, confirm compliance with that regime and document it as your SHIELD position. Otherwise adopt the fourteen-safeguard programme, scaled if you meet the small business definition.
- Close the identity gaps first. Enforce multi-factor authentication on remote access, email and any system that reads private information in bulk, and add credential stuffing defences to customer logins. The 23andMe credential stuffing breach shows how reused passwords without MFA or login anomaly detection expose data far beyond the accounts taken over. See the MFA Guide.
- Encrypt and minimise. Encrypt stores of private information, keep keys separate (a key accessed with the data removes the encryption benefit) and set retention limits that delete data when no longer needed. See the Data Retention and Secure Deletion Guide.
- Bind your vendors. Add security clauses and a 30-day or shorter breach notice to every contract with a provider that maintains private information, so the provider's statutory 30 days does not consume your own clock.
- Build the notification playbook. Pre-draft resident notices with the required content, prepare the OAG portal fields, define the 5,000-resident consumer reporting agency trigger and the 500-resident trigger for filing a no-harm determination.
- Test and review. Run a tabletop exercise that starts the 30-day clock at discovery, then review the programme annually and after any material business change, as 899-bb requires.
Rollback: pilot MFA and encryption changes with administrators first, use report-only modes where available and keep a dated exception list rather than disabling controls.
Where machine identities and AI agents fit
Most bulk access to private information is by service accounts, API keys and tokens. Inventory non-human identities with read access to private information stores, remove standing broad access, rotate credentials and log their queries so the "accessed or acquired" question can be answered after an incident. AI agents that query customer or HR records are a new access path: give each agent its own identity, scope it to the minimum data and record its tool calls. See the NHI Authentication Guide.
Detection, measurement and framework mapping
Log authentication, bulk reads and exports, and failed logins on systems holding private information. Measures:
- Inventory coverage: percentage of systems holding private information with a named owner and record count.
- MFA coverage: percentage of human and administrative accounts with access to private information using MFA.
- Encryption coverage: percentage of private information stores encrypted at rest with separately managed keys.
- Retention compliance: records past their retention date still present.
- Notification readiness: time from discovery to a draft resident notice in the last exercise, against the 30-day limit.
| SHIELD requirement | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Programme coordinator | GV.RR-02 | PM-2 |
| Identify risks and assess safeguards | ID.RA-03 | RA-3, CA-2 |
| Training | PR.AT-01 | AT-2 |
| Service providers by contract | GV.SC-05 | SA-9 |
| Data inventory (settlement requirement) | ID.AM-07 | CM-8 |
| Authentication (settlement requirement) | PR.AA-03 | IA-2 |
| Protect data at rest and in transit | PR.DS-01, PR.DS-02 | SC-28, SC-8 |
| Detect and respond, test and monitor | DE.CM-01 | SI-4, AU-6 |
| Disposal | PR.DS-01 | MP-6 |
| Breach notice | RS.CO-02 | IR-6 |
The mapping is ours, to help teams reuse existing control evidence; it is not part of the statute.
Common failure patterns
- Assuming out-of-state means out of scope: remote staff and customers in New York bring the business into 899-bb whatever its headquarters.
- Exposing private information in public forms: pre-fill and lookup features that return licence or account numbers to anyone who types a name and date of birth were the root of the insurer settlements.
- Waiting for forensic certainty: the 30-day limit runs from discovery, not from the end of the investigation. Notify on what is known and supplement.
- Vendor clocks that eat yours: contracts letting a provider take its full 30 days leave the owner almost no time.
- Retention without limits: data kept long after it is needed enlarges every breach; disposal is an explicit statutory safeguard.
Practitioner checklist
- Confirm whether you hold private information of New York residents and in which systems.
- Record your compliance route: regulated entity, full programme or small business scaling.
- Name the programme coordinator and date the latest risk assessment.
- Map evidence to each of the fourteen 899-bb safeguards and close gaps with owners and dates.
- Enforce MFA for access to private information and credential stuffing defences on customer logins.
- Encrypt private information stores with separately managed keys and enforce retention limits.
- Add security and short breach-notice clauses to every provider contract.
- Pre-build resident, OAG portal, consumer reporting agency and DFS notices, and test the 30-day clock in a tabletop.
Standards and references
- New York State Senate: General Business Law section 899-aa, notification of breach of security
- New York State Senate: General Business Law section 899-bb, data security protections
- New York Attorney General: Stop Hacks and Improve Electronic Data Security Act (SHIELD Act)
- New York Attorney General: Data security guide to help businesses protect consumers' personal information
- New York Attorney General: $14.2 million from car insurance companies over data breaches
- New York Attorney General: Agreement with Marymount Manhattan College to invest $3.5 million
Related NHI Mgmt Group resources: US State Cybersecurity Laws Map · NYDFS Part 500 Guide · Massachusetts 201 CMR 17.00 Guide · Breach Notification Laws by Country Guide. This guide summarises the New York SHIELD Act (General Business Law sections 899-aa and 899-bb) as checked on 9 November 2026 and is not legal advice.