New York SHIELD Act, data security and breach notification

Identifier

Identifier

N.Y. Gen. Bus. Law §§ 899-aa and 899-bb

Level

State NY

Status

In force

Adopted

2019-07-25

Applies from

2020-03-21

Supervisory bodies

New York AG

Named requirements

• Reasonable safeguards

  N.Y. Gen. Bus. Law § 899-bb(2)

  Administrative, technical and physical safeguards, with a named security coordinator and vendor selection duties.

• Small business standard

  N.Y. Gen. Bus. Law § 899-bb(2)(c)

  Safeguards proportionate to size, complexity and the sensitivity of the data held.

• Breach notification

  N.Y. Gen. Bus. Law § 899-aa

  Notice to affected residents and to the state authorities, including for unauthorised access without acquisition.

Official source

• www.nysenate.gov
• ag.ny.gov

EU acts on the same ground

• gdpr

  Articles 32 to 34 GDPR cover the same ground on security and breach notification, with a seventy two hour deadline that the SHIELD Act does not set.

United States case law

4 decisions · Read from CourtListener, Free Law Project on 2026-08-22.

• United Healthcare Insurance v. Davis

  602 F.3d 6185th Cir.2010-03-31Open to review by a higher court, the source does not state the outcome

• Russell Lee Jones v. Truett Goodwin, Warden

  982 F.2d 46411th Cir.1993-01-15Open to review by a higher court, the source does not state the outcome

• Mark W. Heckman v. The Federal Press Company, Allen Bradley Company C/o Corporation Trust Company v. Clark Equipment Company, Brown Trailer Division

  587 F.2d 6123rd Cir.1979-01-03Open to review by a higher court, the source does not state the outcome

• Silver & Co. v. S. Sternau & Co.

  258 F. 4482d Cir.1919-04-16Open to review by a higher court, the source does not state the outcome