The New York State Legislature recently enacted a notable, albeit minor, amendment to the state’s data breach notification laws. This marks the second revision to New York’s data breach notification requirements within two months.
Prior to this legislative change, data breaches that impacted sensitive personal data (e.g., Social Security numbers, financial account data, biometric data) and required notification to any New York resident, also required the business subject to the breach to make additional notification to specific state agencies: the state attorney general, the department of state, the division of state police, and the department of financial services (NYDFS). The notification to regulatory agencies needed to address the timing, content, and distribution of the notices sent to impacted residents, the approximate number of affected residents, and a copy of the notice sent to them.
The recent legislative amendment now clarifies that only “covered entities” regulated by the NYDFS are required to report breaches to that department. Additionally, such notifications must comply with the requirements set forth in 24 NYCRR 500.17. The term “covered entity” essentially means any person or organization operating under—or required to operate under—a license, registration, charter, certificate, permit, accreditation, or similar authorization pursuant to the New York Banking Law, the Insurance Law, or the Financial Services Law. This requirement applies regardless of whether the covered entity is also regulated by other government agencies.
The legislative amendment to the New York data breach notification law took effect on February 14, 2025. Organizations subject to these changes should update their incident response plans to ensure compliance with the revised notification requirements.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel. This document may be considered attorney advertising in some jurisdictions.
© 2025 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
