Services / Privacy Compliance / New York
Breach and consumer notification laws in New York — what a business must do when personal information is lost or exposed.
Did you know? Every state sets its own rules for when a breach is reportable, who must be told and how. In New York:
There are specific considerations when determining if a breach is reportable in New York
There are comprehensive requirements for the information included in notifications
Notifications may only be given by specific methods, and some methods must be tracked
If your breach affects residents of other states, you must notify them under that state’s rules
If a vendor is breached, they must report it to the data owner, who is responsible for reporting and consumer notification
Notifications must be given to the State Attorney General, the Department of State and the Division of State Police, each on a breach reporting form
If the breach affects over 5,000 NY residents, the consumer reporting agencies must be notified using the Attorney General’s list
Violations can incur penalties up to $150,000; the business can be enjoined and required to pay actual costs plus consequential losses
New York has additional laws on how personal data is protected and disposed of to prevent a breach
Federal laws, industry regulations and out-of-country laws may also apply
Please note
This summary of regulations is provided for information purposes only. No action based on this summary alone should be undertaken. Each individual or entity must obtain appropriate guidance for its specific circumstances.
© 2018 CSR. All rights reserved. CSR refers to the corporation CSR Professional Services, Inc.
Readiness Pro
CSR Readiness Pro and the Breach Reporting Service handle the reporting and notification rules for you.
Mon – Fri · 8:00am – 5:30pm
Privacy compliance
Get started
Secure, scheduled shredding is the simplest way to keep paper records out of a breach report. Save 10% on your initial shred.
Mon – Fri · 8:00am – 5:30pm
