New York data breach notification law: residents within thirty days, three state agencies and, for DFS licensees, a DFS report within 72 hours

New York's breach law, General Business Law 899-aa, covers any person or business that owns or licenses computerized private information, and requires notice to affected New York residents within thirty days after the breach is discovered. Every New York notice also goes to the Attorney General, the Department of State and the State Police. The Department of Financial Services (DFS) is a fourth recipient only if you are a Part 500 covered entity, and then through 23 NYCRR 500.17. Our multi-state breach notification procedure covers the steps that repeat across states.

Does New York's breach law apply to this incident?

It applies when the person is a New York resident, the data includes a listed element, a (1)(b)(i) element was unencrypted (or the key was also taken), and someone without valid authorization accessed or acquired it, or you reasonably believe so (899-aa(1) and (2)). The text has no "conducts business in New York" test; in our view, the person's New York residence is the hook, not your location.

A breach is "unauthorized access to or acquisition of" data that compromises the security, confidentiality or integrity of private information (899-aa(1)(c)). Factors include indications that information was "viewed, communicated with, used, or altered", or "downloaded or copied".

Which data counts. Personal information combined with one of these elements (899-aa(1)(b)(i)): (1) Social Security number; (2) driver's license or non-driver ID number; (3) account or card number with any required security code, access code or password that permits access to the financial account; (4) account or card number usable to access the account without such a code; (5) biometric information; (6) medical information; (7) health insurance information. A user name or email address with a password or security question and answer that would permit access to an online account counts alone (899-aa(1)(b)(ii)).

Encryption. For the (1)(b)(i) elements, data is outside the law unless it is unencrypted "or is encrypted with an encryption key that has also been accessed or acquired". Online-account credentials under (1)(b)(ii) have no encryption exception.

A scoping case (fictional). A retailer finds ransomware operators held administrator access for six days to unencrypted Social Security numbers of New York customers; logs show no outbound transfer. Under New York's text the access itself can be the breach, so "no proof of exfiltration" does not end the analysis. California's acquisition standard would turn on acquisition instead. Plan to notify unless counsel documents in writing why the Social Security numbers were not, and are not reasonably believed to have been, accessed (899-aa(1)(c)).

When must residents be notified?

Residents must be notified "within thirty days after the breach has been discovered", in the most expedient time possible, except for the legitimate needs of law enforcement (899-aa(2)).

Law enforcement may delay notice if it determines notice impedes a criminal investigation, until it determines notice no longer compromises it (899-aa(4)). The statute sets no day cap or writing requirement; get the request in writing anyway. There is no delay for your own investigation: the pre-December 2024 text allowed "any measures necessary to determine the scope of the breach and restore the integrity of the system", and that language is gone.

The statute does not say how to count days or whether a vendor's notice starts your clock; plan to the earlier date.

Which agencies and credit reporting agencies get notice?

When any New York residents are to be notified, send the Attorney General, the Department of State and the State Police the timing, content and distribution of the notices, the approximate number of affected persons and a copy of the template of the notice (899-aa(8)(a)). There is no resident threshold and no separate day count; the only condition is that agency notice not delay the resident notice.

The Attorney General's online form says the submission is also sent to the Department of State and the State Police in satisfaction of your requirement to notify them, so one filing covers all three. The form's DFS line omits the covered-entity limit in (8)(a); the statute governs.

If more than five thousand New York residents are to be notified at one time, also notify consumer reporting agencies of the same details except the template copy (899-aa(8)(b)).

If you are regulated by DFS

A DFS licensee has a faster clock that runs alongside the 899-aa notices, not instead of them. A covered entity is any person operating under, or required to operate under, a license, registration, charter, certificate, permit, accreditation or similar authorization under the Banking Law, Insurance Law or Financial Services Law (23 NYCRR 500.1(e)).

• 72 hours from determination. Notify DFS as promptly as possible, and no later than 72 hours after determining that a cybersecurity incident has occurred at the covered entity, an affiliate or a third-party service provider (500.17(a)). A vendor's incident still obliges you to file (DFS cybersecurity FAQs); ransomware deployed within a material part of your systems counts.
• 24 hours from an extortion payment. File a notice within 24 hours of the payment, then, within 30 days, a written description of why payment was necessary, the alternatives considered, and the diligence done to find alternatives and to comply with applicable rules, including OFAC sanctions rules (500.17(c)(2)).
• Where. The DFS Portal, with a DFS ID (DFS, Cybersecurity submissions).

Section 899-aa(8)(a) says the DFS notice is provided "in compliance with 23 NYCRR 500.17"; whether the Portal filing alone satisfies it, template copy included, is an open question. File under 500.17 with the 899-aa details, and have counsel confirm that covers the DFS notice.

How do the two clocks fall on a calendar?

In this fictional case a DFS-licensed company pays a ransom: DFS is due on day 4, residents by day 30 (calendar days, day 1 is the day after discovery).

A company outside DFS skips the DFS rows.

What must the letter say?

Include your contact information, the telephone numbers and websites of relevant state and federal agencies that provide breach response and identity theft information, and which categories and elements of information were involved (899-aa(7)). The statute names no agencies.

What changed in December 2024 and 2025?

• December 21, 2024 (ch. 647 of 2024, S2659-B / A8872-A), effective immediately. Residents: before, "the most expedient time possible" plus the scoping carve-out; now, thirty days from discovery, with only law enforcement. Maintainers: before, "immediately following discovery"; now, also within thirty days. The pre-December 2024 text set no number and the current text says thirty; a summary giving 45 days is wrong.
• February 14, 2025 (ch. 91 of 2025, S804). DFS notice is required only from covered entities, given under 500.17.
• March 21, 2025: health data. Chapter 613 of 2024 (signed December 21, 2024) added medical and health insurance information, effective on the ninetieth day after it became law, which is March 21, 2025. Chapter 30 of 2025 (signed February 14, 2025) rewrote the definitions with the same effective date.
• October 23, 2019. The SHIELD Act (ch. 117, signed July 25, 2019, effective on the ninetieth day) added "access" to the trigger.

What changes for vendors, HIPAA entities and exceptions?

Maintainers. A business that maintains data it does not own must notify the owner or licensee "immediately", and within thirty days of discovery (899-aa(3)). Contract for a shorter limit in vendor incident notification clauses.

Inadvertent disclosure. Notice is not required if the exposure was an inadvertent disclosure by persons authorized to access private information and you reasonably determine it will not likely result in misuse or financial harm (emotional harm for online credentials) (899-aa(2)(a)). An outside attacker's access is not a disclosure by an authorized person, so it does not qualify. Document the determination in writing and keep it at least five years; if over five hundred residents of New York are affected, give it to the Attorney General within ten days after the determination, through the form's inadvertent-disclosure option. The record should say what was exposed, why misuse is unlikely, and who decided when.

Deemed compliance. Notifying under the GLBA or HIPAA regulations, 23 NYCRR 500 or another federal or New York data security regime means no additional resident notice, but the three agencies are still notified, and credit reporting agencies above the (8)(b) threshold (899-aa(2)(b)). Have counsel confirm which regime's resident notice you rely on.

HIPAA. A covered entity that notifies the Secretary of HHS also notifies the Attorney General within five business days, including for information that is not "private information" (899-aa(9)). Our HIPAA breach notification procedure covers the HHS timing.

What else applies in New York?

• Enforcement. The Attorney General may sue (899-aa(6)). For knowing or reckless violations a court may impose the greater of $5,000 or up to $20 per failed notification, the latter capped at $250,000. Suits must start within three years of the Attorney General learning of the violation or the date the (8)(a) notice was sent, whichever is first, and no later than six years after the company discovered the breach unless it took steps to hide it (899-aa(6)(c)).
• Private suits. 899-aa gives enforcement to the Attorney General and creates no private right of action in its text; the sentence "Nothing in this section shall create a private right of action" is in 899-bb(2)(e). Ask counsel whether individuals could sue on other grounds.
• Out of scope. Section 899-bb (reasonable safeguards) and State Technology Law 208 (state agencies).

What to do in order

1. Hour 0, incident lead: log discovery and decision-maker; if DFS-licensed, the time you determined a cybersecurity incident. Verify: a timed entry.
2. Within 72 hours of that, compliance lead (DFS licensees): file in the DFS Portal; after a ransom payment, file within 24 hours. Verify: Portal confirmation.
3. Day 1, privacy lead with counsel: decide the four tests, estimate New York residents, write any inadvertent-disclosure determination. Verify: written count.
4. Day 1, calendar owner: enter the resident deadline and any vendor report date. Verify: dates in the incident calendar.
5. Days 1 to 10, counsel: if law enforcement is involved, ask in writing whether it needs a delay. Verify: reply on file.
6. By day 25, privacy lead: draft the letter to the checklist and the agency template copy. Verify: counsel sign-off.
7. By the resident deadline (thirty days after discovery), privacy lead: mail letters; file the Attorney General form that day; notify credit reporting agencies above the threshold; HIPAA entities copy the Attorney General within five business days of the HHS filing. Verify: proof of mailing and form confirmation. Then add the deadlines to your incident response plan.

An AI agent can pull log timestamps and count New York addresses; a human decides dates and determinations.

New York checklist (copy into a ticket)