The New York SHIELD Act requirements can apply to an app company even when it has no New York office. The trigger is holding computerized data that includes the private information of a New York resident. For a product team, that turns account design, vendor contracts and incident response into parts of the same compliance problem.
This guide explains the current text of New York General Business Law §§ 899-aa and 899-bb. It is general information, not legal advice.
Which data brings an app into scope
New York separates “personal information” from “private information.” Personal information identifies a person. Private information is personal information combined with one or more protected data elements.
The statute covers combinations involving a Social Security number, driver’s-license or other qualifying identification number, an account or payment-card number with the information needed to reach the account, biometric data, and specified medical or health-insurance information. It also covers an online account’s username or email address when paired with a password or security question and answer that would permit access.
The full definitions appear in GBS § 899-aa. A product inventory should therefore map fields and the combinations that make them sensitive. Treating every identifier as identical can hide the systems that create the greatest notice risk.
The security duty follows the resident
GBS § 899-bb requires a person or business that owns or licenses New York residents’ private information to develop, implement and maintain reasonable safeguards. The text reaches businesses regardless of where they are organized.
The program must include reasonable administrative, technical and physical safeguards. The statute gives examples rather than a single universal checklist:
- designate one or more people to coordinate the program;
- identify reasonably foreseeable internal and external risks;
- assess whether existing controls address those risks;
- train and manage staff who handle the data;
- select service providers capable of maintaining safeguards and bind them by contract;
- adjust the program when circumstances change;
- detect, prevent and respond to attacks or system failures;
- test and monitor key controls;
- dispose of private information within a reasonable time when it is no longer needed.
A small business may scale its program to its size, activities, and the sensitivity and volume of data. That is proportionality, not an exemption.
Vendor contracts are part of the control
An app may send data to a cloud host, analytics service, support desk, payment processor or email provider. Section 899-bb specifically calls for service providers capable of maintaining appropriate safeguards and contracts that require them.
The practical question is not simply whether a vendor advertises security. Record what data the vendor receives, where it is retained, who can access it, how an incident is reported and how deletion is confirmed. A security addendum that does not match the actual integration is weak evidence of control.
The same inventory helps with AI credit-decision notices: a system cannot explain or protect data flows that the team has not mapped.
A breach includes access, not only theft
The law defines breach as unauthorized access to or acquisition of private information. That broader wording matters for cloud logs, exposed databases and employee credentials. A company cannot wait for proof that an attacker downloaded a file if the evidence already shows unauthorized access.
Section 899-aa lists factors that can establish access, including indications that information was viewed, communicated, used or altered without valid authorization. Preserve audit logs and investigation notes long enough to support that judgment.
There is a narrow route for an inadvertent disclosure by an authorized person when the business reasonably determines that misuse or financial or emotional harm is unlikely. The determination must be documented and kept for at least five years. If the incident affects more than 500 New York residents, the determination must be sent to the Attorney General within ten days.
The notification clock
When notice is required, affected New York residents must be notified in the most expedient time possible and without unreasonable delay. The current statute also sets an outside limit of 30 days after discovery unless a legitimate law-enforcement need delays notice.
The resident notice must describe the incident in understandable terms and include contact information for the business, the categories of information believed to have been accessed or acquired, and advice about relevant state and federal resources.
At the same time, the business must notify the New York Attorney General, Department of State and State Police. A covered entity must also notify the Department of Financial Services. Incidents affecting more than 5,000 New York residents require notice to consumer reporting agencies about timing, content and distribution.
The Attorney General provides a data-breach reporting page for organizations. Teams should confirm the current submission route when an incident occurs.
What to build before an incident
Start with a short operational packet that engineering, security and legal staff can all use:
- a field-level map of private information and the systems that hold it;
- owners for detection, investigation, decision-making and notices;
- vendor notification deadlines that leave time for the company’s own 30-day limit;
- preserved logs and a documented method for deciding whether access occurred;
- resident and regulator notice templates with variable fields marked;
- a record of any no-harm determination and its retention date;
- a post-incident review that feeds changes back into the security program.
The packet should be tested. A tabletop exercise can reveal that the team cannot export affected New York residents, identify which password hashes were exposed or obtain a vendor’s incident timeline quickly enough.
Enforcement and other laws
Section 899-bb states that it does not create a private right of action. The New York Attorney General may bring an action to enjoin violations and obtain civil penalties. Other federal, state or sector-specific rules may impose additional duties.
Meeting another listed security regime can satisfy the safeguard requirement for covered data, but it does not erase the need to check New York’s breach-notice rules. A fintech app may have overlapping duties under financial regulation; a health product may face separate medical-privacy requirements.
Source check: statutory pages and the Attorney General’s reporting resource were reviewed on October 18, 2026. The Legislature pages displayed a March 28, 2025 revision date for both sections.
