Data Breach Notification Statutes – New York

Last Updated: 02/28/2024

• Applicable Statute: N.Y. Gen. Bus. Law §  899-aa
• Attorney General Notice Required: Yes,  Attorney General, N.Y. Dept. of State, and State Police if any resident is notified.
  • Timing :     Most expedient time possible and without unreasonable delay.
  • Method: Online at https://formsnym.ag.ny.gov/OAGOnlineSubmissionForm/faces/OAGSBHome;jsessionid=Qj6_OVM-7TckCD1ePyvckB92H1gW6blD2yCzzM6v_JlOt1FOEEH4!1488259156
  • Content :  Timing, content, and distribution of the notices and the approximate number of affected residents, and provide a copy of the template notice sent to affected residents.
• Consumer Notice Requirements:
  • Timing:  Must be made in the most expedient time possible and without unreasonable delay, consistent with any measures necessary to determine the scope of the breach and to restore the reasonable integrity of the system.
  • Content:  Notice must include the entity’s contact information, the telephone numbers and websites of the relevant state and federal agencies that provide information regarding security breach response and identity theft prevention, and a description of the categories of information that was reasonably believed to have been breached, including the elements of personal information accessed or acquired.
  • Method:  By written notice, electronic notice to residents who have expressly consented to receive notice electronically, or by telephone.  An entity must keep a log of each notification when notice is made electronically or by telephone.  An entity cannot require a resident to consent to receive electronic notice.
• Consumer Reporting Agency Obligations: If more than 5,000 residents are notified, the entity must also notify the list of consumer reporting agencies maintained by the Attorney General as to the timing, content and distribution of the notices and approximate number of affected persons. Such notice must be made without delaying notice to affected New York residents.