Section node
Breach notification
N.Y. Gen. Bus. Law § 899-aa
- What this page is
- Section node, N.Y. Gen. Bus. Law § 899-aa
- Checked against the official source
- 2026-08-15Changed
- Responsible publisher
- ExploreWorld Legal, editorial deskLiability position
Short answer
What does N.Y. Gen. Bus. Law § 899-aa require, and where does it carry an outcome in the rule tree?
N.Y. Gen. Bus. Law § 899-aa is the paragraph the Breach notification decision agent rests on for this question. Notice to affected residents and to the state authorities, including for unauthorised access without acquisition. The block was read against the publisher on 2026-08-15 and carries 2 outcomes in the agent's rule tree. The reference can be cited as it stands, with a link to the official text and a content hash.
N.Y. Gen. Bus. Law § 899-aaChecked against the publisher 2026-08-15Official text
A source reference, not legal advice.
- Jurisdiction
- N.Y. Gen. Bus. Law §§ 899-aa and 899-bb
- Section node
- breach
- Read
- 2026-08-15
- Hash
- sha256:1bde9c1a6631a9f2
Outcomes resting on this section
The rules below point to this section in their outcome. The verdict is a machine classification, not a judgment on an individual matter.
br-hipaa-500
Notice to HHS, individuals and media within 60 days
45 CFR 164.404 to 164.408 require notice to individuals and HHS without unreasonable delay and no later than 60 days after discovery, and to media when more than 500 residents of a state are affected.
risk, Requirement applies
br-ny
Notice to residents and New York authorities
N.Y. Gen. Bus. Law § 899-aa requires notice to affected residents in the most expedient time possible and within 30 days, and to the Attorney General, Department of State and State Police. More than 5,000 affected residents also requires notice to consumer reporting agencies.
risk, Requirement applies
Section nodes
- Reasonable safeguardsN.Y. Gen. Bus. Law § 899-bb(2)
- Small business standardN.Y. Gen. Bus. Law § 899-bb(2)(c)
- Administrative safeguards45 CFR 164.308
- Physical safeguards45 CFR 164.310
- Technical safeguards45 CFR 164.312
- Business associate contracts45 CFR 164.314
The verdict is a machine classification of the outcome, not legal advice and not a compliance decision.
Verifiable trust signals
- Six fixed blocks, one source per line
- No sentence written by a language model
- Engine version and read date on every answer
- No customer data, no documents, no advice
- Model card and audit published under the EU AI Act