NY SHIELD Act for Small Business: Questions Owners Ask

The NY SHIELD Act (Stop Hacks and Improve Electronic Data Security Act) is a New York law that requires any business holding New York residents' private information to keep reasonable security safeguards and to notify people after a breach, wherever the business is located. Small businesses get safeguards scaled to their size, not an exemption, and as of October 2026 breach notices are due within 30 days of discovering the breach. If you have customer or employee data on New Yorkers, below is the compliance checklist, the breach steps and the questions we hear most from owners, answered plainly.

NY SHIELD Act compliance checklist

The safeguards duty is in New York General Business Law section 899-bb, and the breach notice rules are in section 899-aa. A business that is subject to and compliant with the Gramm-Leach-Bliley Act, HIPAA or the DFS cybersecurity regulation (23 NYCRR 500) is deemed to comply with the safeguards requirement (our 23 NYCRR 500 guide covers that regulation). Everyone else needs a security program with the administrative, technical and physical safeguards the law lists. Our NY SHIELD Act compliance work builds and documents that program for small businesses.

What counts as reasonable depends on your size. A small business under the law (fewer than 50 employees, less than $3 million in gross annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets) complies with safeguards appropriate to its size and complexity, the nature and scope of its activities, and the sensitivity of the personal information it collects. The law does not name products. It asks whether your safeguards fit the business and whether they work.

Type	Safeguard the law lists	What it looks like in a small business
Administrative	Designate one or more employees to coordinate the security program	A named owner, in-house or working with an outside provider, written into your policy
Administrative	Identify reasonably foreseeable internal and external risks	An inventory of the New York residents' private information you hold, and a dated risk assessment
Administrative	Assess whether the safeguards in place control the identified risks	A gap list with an owner and a date for each item
Administrative	Train and manage employees in the security program's practices and procedures	Onboarding and annual training records
Administrative	Select service providers that can maintain appropriate safeguards, and require those safeguards by contract	A vendor list and security terms in each vendor contract
Administrative	Adjust the program for business changes or new circumstances	A review whenever you add a system, a vendor or a location
Technical	Assess risks in network and software design	A review of remote access, admin rights and MFA coverage
Technical	Assess risks in information processing, transmission and storage	Knowing where the data lives, with encryption on laptops and for data sent outside the business
Technical	Detect, prevent and respond to attacks or system failures	Endpoint protection, email filtering, tested backups and an incident response plan
Technical	Regularly test and monitor the effectiveness of key controls, systems and procedures	Scheduled vulnerability scans, restore tests and access reviews, with the results kept
Physical	Assess risks of information storage and disposal	Where paper and devices with private information are kept, and how they leave the business
Physical	Detect, prevent and respond to intrusions	Locked offices and storage, and visitor controls
Physical	Protect against unauthorized access to or use of private information during or after its collection, transportation and destruction or disposal	Secure handling of records and devices in transit, and locked shred bins
Physical	Dispose of private information within a reasonable time after it is no longer needed, erasing electronic media so the information cannot be read or reconstructed	A retention schedule and certified wiping or destruction of old drives and devices

If private information is exposed, section 899-aa sets the sequence:

1. Decide whether it is a breach. Unauthorized access to or acquisition of computerized private information counts. Signs that the data was viewed, copied, used or altered, or that a device holding it was lost, point to one. Private information includes Social Security, driver's license and financial account numbers, biometric data, medical and health insurance information, and a username or email address with its password.
2. If you hold the data for someone else, tell the owner immediately.
3. Notify affected New York residents in the most expedient time possible and within 30 days of discovering the breach, unless law enforcement asks you to wait. Use written notice, electronic notice where the person has agreed to it, or telephone with a call log; substitute notice is allowed only in the cases the law lists.
4. Include what the law requires: your contact information, the phone numbers and websites of state and federal agencies that help with breach response and identity theft, and which categories of information were involved.
5. Notify the state. Tell the Attorney General, the Department of State and the Division of State Police about the timing, content and distribution of the notices and roughly how many people are affected, with a copy of the notice template. The Attorney General's office says a submission through its data breach reporting form is sufficient for those notices. DFS-regulated businesses also notify DFS under Part 500, and if more than 5,000 New Yorkers are notified at one time, notify the consumer reporting agencies too.
6. Document any decision not to notify. If the exposure was an inadvertent disclosure by authorized people and you reasonably decide it is not likely to cause harm, put that determination in writing and keep it for five years. If more than 500 New Yorkers are involved, send it to the Attorney General within 10 days.
7. HIPAA covered entities that notify HHS of a breach must also notify the Attorney General within five business days.

The Attorney General's SHIELD Act page summarizes the same safeguards and notice duties.

How is the New York SHIELD Act enforced?

The Attorney General enforces it. Customers cannot sue under the law itself, but the Attorney General can seek injunctions, restitution and civil penalties. Two settlements with professional practices in late 2025 show what investigators look at, and each came with a list of security fixes the business must make:

• A CPA firm, $60,000 (October 2025). A 2023 ransomware attack, likely started by a phishing email, exposed data on 4,726 New Yorkers, and Social Security numbers were not encrypted in parts of the network. The firm did not notify clients until November 2024. The settlement requires an information security program, encryption, a data inventory, tighter access controls, vulnerability management, an incident response plan and staff training.
• An orthopedic practice, $500,000 (December 2025). Attackers used stolen login credentials to reach the network remotely and downloaded unencrypted files on about 656,000 patients and employees. The Attorney General's office pointed to missing multifactor authentication on remote access, unencrypted patient data and no regular risk assessments.

Neither case turned on exotic technology. The gaps were phishing, unencrypted files, remote access without multifactor authentication, no risk assessment and slow notice, which are the same items in the checklist above.

Frequently asked questions

What is the NY SHIELD Act?

The Stop Hacks and Improve Electronic Data Security (SHIELD) Act is a New York law that requires businesses to protect New York residents' private information with reasonable safeguards and to notify people when that data is breached. It broadened both what counts as a breach and who has to comply, well beyond the state's older, narrower data-breach law. It was signed on July 25, 2019; the breach notice changes took effect that October and the safeguards duty on March 21, 2020. Amendments signed in December 2024 added the 30-day notice deadline, and since March 21, 2025 medical and health insurance information count as private information too.

Does it apply to my business if I'm not located in New York?

Yes. The law covers any person or business that owns or licenses computerized data containing the private information of a New York resident, regardless of where the business itself operates. A company in New Jersey, Florida, or anywhere else that serves even a handful of New York customers is on the hook.

Is my small business exempt from the SHIELD Act?

Not exempt, but scaled. A "small business" (fewer than 50 employees, under $3 million in gross revenue for each of the last three years, or under $5 million in total year-end assets) may implement safeguards appropriate to its size and complexity. The breach-notification requirement, though, applies to everyone with no small-business carve-out.

Does the SHIELD Act cover employee data, or only customer data?

Both. The law protects the private information of any New York resident, so payroll and HR records with Social Security numbers, driver's license numbers or bank account numbers for direct deposit count the same way customer records do. A business with no New York customers but a handful of New York employees still needs safeguards for those files and still owes notice if they are breached.

What "reasonable safeguards" do I actually have to put in place?

The law names three categories rather than a checklist: administrative, technical, and physical. In practice that means designating someone responsible for security, running risk assessments, training staff, holding vendors to security terms by contract, encrypting and controlling access to data, disposing of records securely, and testing that your key controls work. It maps closely to the core controls that actually stop attacks.

What counts as a data breach under the law?

The SHIELD Act expanded a breach to include unauthorized access to private information, not only its acquisition. It also widened "private information" to cover things like biometric data and an email address paired with a password or security question answer, and as of March 21, 2025 the list includes medical and health insurance information. So an incident that exposes login credentials can trigger obligations even if you cannot prove data was copied.

What are the penalties for violations?

For a knowing or reckless notification failure, a court may impose the greater of $5,000 or up to $20 per instance, capped at $250,000. For failing to maintain reasonable safeguards, penalties run up to $5,000 per violation. The New York Attorney General enforces the law; there is no private right of action, but investigations and fines are real.

What do I have to do if we have a breach?

Notify affected New York residents in the most expedient time possible and within 30 days of discovering the breach, a deadline in force since December 21, 2024. Notify the state Attorney General, the Department of State and the State Police too, including a template of the notice you plan to send. DFS-covered entities also notify the Department of Financial Services, and a breach affecting more than 5,000 New Yorkers also requires notice to the consumer reporting agencies. Moving quickly and correctly matters, which is why every business should have an incident response plan written before an incident, not during one.

How do I get compliant, and where should I start?

Start with a data inventory: know what New York-resident private information you hold, where it lives, and who can reach it. Then run a risk assessment against the three safeguard categories and close the gaps, prioritizing encryption, access control, vendor terms, and a tested response plan. Strong data loss prevention and current cyber insurance both support the effort.

A practical first month for a small office looks like this:

1. Name the person who coordinates the program and write it down.
2. List every place private information lives: the line-of-business app, Microsoft 365 or Google mailboxes, file shares, laptops, phones, paper files and each vendor that holds a copy.
3. Turn on multifactor authentication for email, remote access and admin accounts, and confirm laptops are encrypted.
4. Collect the security terms in each vendor contract, and note the vendors that have none.
5. Write a short incident response plan that names who decides whether an event is a breach and who sends notices, so the 30-day clock does not run out while people look for the form.
6. Date the risk assessment and the gap list, and put the next review on the calendar.

If an outside IT provider or vendor holds our data, who is responsible?

You are. The safeguards duty sits with the business that owns or licenses the data, and the law expects you to choose service providers that can keep appropriate safeguards and to require those safeguards by contract. A vendor that maintains your data and discovers a breach must tell you immediately, but notifying residents and the state is still your job. Spell out in each contract how fast the vendor reports an incident, who at your company receives that call, and who handles the escalation from there.

What affects the cost of SHIELD Act compliance?

The law sets no fee and requires no certification, so the cost is the work of closing your gaps. What moves it: how many systems, locations and vendors hold private information, whether laptops and phones are already managed and encrypted, whether multifactor authentication is already on everywhere, how much policy and vendor paperwork exists, and whether you already comply with HIPAA, Gramm-Leach-Bliley or Part 500, which count as compliance with the safeguards duty. When NetSys runs the ongoing safeguards, they are part of a flat monthly fee per user, and the size of the environment is what changes it.

Where can I get help?

The NetSys Group runs security assessments and delivers the ongoing cybersecurity services that keep SHIELD Act safeguards in place year-round for businesses across New York and the surrounding region. Book a call with an engineer to walk through where your safeguards stand against the law's list.

For help putting the safeguards in place, see our NY SHIELD Act compliance support, which builds and documents the administrative, technical and physical safeguards the law lists and a breach response plan.