← All jurisdictions
NY · data breach notification
highNew York
N.Y. Gen. Bus. Law §899-aa (30-day amendment eff. 12/21/2024)
Individual deadline
30 days
Trigger standard
Any breach
AG / regulator
Required
| Notice to individuals | 30 calendar days from discovery |
| Risk-of-harm standard | None, notice required on any qualifying breach of covered personal information. |
| Encryption safe harbor | Yes, encrypted data (key not compromised) generally exempt. |
| Regulator notice | New York Attorney General, required for any affected resident; without delaying consumer notice; template copy filed |
| NY Dept. of State, Division of Consumer Protection, required for any affected resident; without delaying consumer notice | |
| New York State Police, required for any affected resident; without delaying consumer notice State Police notification | |
| Credit reporting agencies | Notify CRAs above 5,000 residents. |
| Substitute notice | Typically available above $250,000 cost / 500,000 affected (verify). |
| Private right of action | No, enforcement by the state. |
| Penalties | AG action: up to $20 per failed notice ($20,000 cap historically; amended caps up to $250,000 for knowing/reckless) |
| Notable PI definitions | Includes biometric, credentials, medical, health insurance. |
Notes
※ NYDFS-covered entities must also notify DFS (see federal/sector overlays)
※ HIPAA-covered: AG/DOS/NYSP within 5 business days of HHS notice
Rule last verified July 10, 2026 · confidence high. This is a reference summary, not legal advice; verify against the current statute. How we compile this →
Is a New York breach part of a multi-state incident?
See every jurisdiction at once, with letters and filing packets generated.
Run the calculator →