1. Home
  2. State breach laws
  3. New York

New York data breach notification law

What New York requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by N.Y. Gen. Bus. Law § 899-aa.

30 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

New York's 2024 amendments removed the old flexibility. Notice is due within 30 days of discovery, and the filing goes to the Attorney General, the Department of State, and the State Police at once, plus the Department of Financial Services for the firms it regulates. That is up to four regulators for one incident. Organizations that just filed are usually looking for help proving they have a program, especially DFS-covered banks, insurers, and their vendors, where Part 500 makes the follow-up questions predictable.

See recent New York breach filings →

Requirements in detail

Statute
N.Y. Gen. Bus. Law § 899-aa
Deadline to notify residents
In the most expedient time possible and without unreasonable delay, and no later than 30 days after discovering the breach. Notice may be delayed only if law enforcement determines it would impede a criminal investigation. The exception for time to determine the breach's scope was removed in December 2024.
Attorney General notification
Yes, whenever any New York residents are notified, with no minimum number. The business must notify the Attorney General, the Department of State, and the Division of State Police of the timing, content, distribution, and approximate number of people affected, and send a copy of the notice template, without delaying notice to residents. The Department of Financial Services must also be notified if the business is a covered entity under its cybersecurity rules. Consumer reporting agencies must be notified when more than 5,000 New York residents are notified at one time.
Penalties
The Attorney General enforces the law and can recover actual costs or losses for people who should have been notified. For knowing or reckless violations, courts can impose a civil penalty of $5,000, or up to $20 per failed notification if that is greater, capped at $250,000.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
New York's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. New York has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
S2659-B/A8872-A (Chapter 647 of 2024, effective December 21, 2024) set a firm 30-day deadline, removed the scope-determination delay, and added the Department of Financial Services as a notice recipient. A follow-up law (Chapter 91 of 2025, signed February 14, 2025) limited the Department of Financial Services notice to its covered entities. S2376-B (Chapter 613 of 2024, effective March 21, 2025) added medical information and health insurance information to the definition of private information.

New York breach notification FAQ

What is the data breach notification deadline in New York?

In the most expedient time possible and without unreasonable delay, and no later than 30 days after discovering the breach. Notice may be delayed only if law enforcement determines it would impede a criminal investigation. The exception for time to determine the breach's scope was removed in December 2024. The governing law is N.Y. Gen. Bus. Law § 899-aa.

Does New York require notifying the Attorney General of a data breach?

Yes, whenever any New York residents are notified, with no minimum number. The business must notify the Attorney General, the Department of State, and the Division of State Police of the timing, content, distribution, and approximate number of people affected, and send a copy of the notice template, without delaying notice to residents. The Department of Financial Services must also be notified if the business is a covered entity under its cybersecurity rules. Consumer reporting agencies must be notified when more than 5,000 New York residents are notified at one time.

What are the penalties for failing to report a data breach in New York?

The Attorney General enforces the law and can recover actual costs or losses for people who should have been notified. For knowing or reckless violations, courts can impose a civil penalty of $5,000, or up to $20 per failed notification if that is greater, capped at $250,000.

Can individuals sue over a data breach in New York?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in New York?

New York's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does New York limit breach lawsuits for companies with a cybersecurity program?

No. New York has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the New York Attorney General before relying on them.

Other states with a 30-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →