Data Breach Notice to Residents and State Authorities in New York
At a glance
| Covered entity and service provider | Person or business owning/licensing computerized private information: resident notice; nonowner custodian: owner/licensee notice immediately and within 30 days (§ 899-aa(2)-(3)) |
|---|---|
| Breach and covered information | Unauthorized access or acquisition of computerized private information; listed identifiers, medical/insurance/biometric data, or online credentials; encryption key compromise counts (§ 899-aa(1)) |
| Risk screen or notice exception | Narrow inadvertent authorized-person disclosure with no likely misuse or specified harm; written decision kept five years, AG copy within ten days if over 500 residents (§ 899-aa(2)(a)) |
| Individuals who receive notice | New York residents whose private information was or is reasonably believed accessed or acquired without valid authorization (§ 899-aa(2)) |
| Individual notice deadline and clock | Most expedient time possible, without unreasonable delay, within 30 days after discovery; law-enforcement exception (§ 899-aa(2), (4)) |
| Regulator threshold and deadline | Any New York resident notice: AG, Department of State, State Police, and DFS only for a 23 NYCRR 500.1 covered entity; send timing/content/distribution, count, and notice template without delaying residents (§ 899-aa(8)(a)) |
| Consumer-reporting-agency notice | More than 5,000 New York residents notified at once: tell consumer-reporting agencies timing, content, distribution, and approximate count without delaying residents (§ 899-aa(8)(b)) |
| Individual delivery and content | Writing; express-consent electronic notice with log; logged phone notice; contact and agency resources plus affected-data categories; qualifying substitute route (§ 899-aa(5), (7)) |
| Substitute notice conditions and channels | Cost over $250,000, class over 500,000, or insufficient contacts, shown to AG; available email or special credential-account notice, website if maintained, and statewide media together (§ 899-aa(5)(d)) |
| Delays and alternate compliance | Law-enforcement determination that notice impedes criminal investigation; notice after clearance; qualifying federal/state breach notice can replace repeat resident notice while state and agency duties remain (§ 899-aa(2)(b), (4)) |
Requirements one by one
Breach and covered information
Section 899-aa(1) covers unauthorized access or acquisition of computerized private information. It includes listed identifiers and financial, biometric, medical, insurance, and online-credential combinations. Data can count even when encrypted if the key was also accessed or acquired. An employee's good-faith access for the business is excluded only while the information is not misused or disclosed without authorization.
Resident and custodian clocks
Section 899-aa(2) requires owner or licensee notice in the “most expedient time possible and without unreasonable delay,” with an outside limit of 30 days after discovery unless the law-enforcement exception applies. Under subdivision (3), a custodian that does not own the data tells the owner or licensee immediately and within 30 days after discovering the breach.
State and reporting-agency notices
Under § 899-aa(8)(a), any New York resident notice triggers notice to the Attorney General, Department of State, and State Police. A business covered by 23 NYCRR 500.1 also notifies DFS under that regulation's route. The submission gives timing, content, distribution, approximate affected count, and a copy of the consumer notice template; it must not delay residents. If more than 5,000 New York residents are notified at one time, subdivision (8)(b) adds notice to consumer-reporting agencies.
Delivery and substitute notice
Under § 899-aa(5), notice may be in writing or electronic with express consent and a log, or logged telephone notice. Substitute notice requires a showing to the Attorney General that direct notice would cost over $250,000, the affected class exceeds 500,000, or contact information is insufficient. It then combines available email, a website posting if maintained, and major statewide media. If the breached data includes email plus online-account credentials, the special online account delivery replaces email.
What trips people up
A documented no-harm determination is narrow. Under § 899-aa(2)(a), notice may be withheld only for inadvertent disclosure by an authorized person when misuse or the specified harm is unlikely. The written decision must be retained five years; if more than 500 residents are affected, it goes to the Attorney General within ten days.
The notice letter needs specific information. Under § 899-aa(7), notice requires the sender's contact information, relevant state and federal agency resources, and the categories and elements of information accessed or acquired. The regulator submission's approximate count is a separate item.
Police control the delay. Section 899-aa(4) allows delay when a law- enforcement agency determines notice impedes a criminal investigation. Notice follows after that agency determines it no longer compromises the case.
Common questions
Does another breach-notice law remove the New York reporting duties? A qualifying federal or state notice may replace a second resident notice, but § 899-aa(2)(b) preserves the state-authority and applicable reporting-agency notices.
Does every business report to DFS? No. Section 899-aa(8)(a) limits that recipient to a covered entity under 23 NYCRR 500.1, while the other three state authorities receive notice when New York residents are notified.
Statutes and sources
- N.Y. Gen. Bus. Law § 899-aa(1)-(5), (7)-(8) — covered data, notice recipients, clocks, exceptions, delivery, and content. https://www.nysenate.gov/legislation/laws/GBS/899-AA (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does New York law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current New York law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace