Relates to when and how notification of a data breach is to be provided to the department of financial services

Narrower breach reporting for New York businesses

When a breach requires notice to New York residents, only covered entities under 23 NYCRR 500.1 must notify the Department of Financial Services. These notices must follow 23 NYCRR 500.17 and cannot delay notice to affected residents. Required notices to the Attorney General, Department of State, and State Police remain unchanged. Those agencies still receive notice timing, content, distribution details, the approximate number affected, and a copy of the resident notice template. The law takes effect on the same date and in the same manner as the referenced 2024 breach-notice amendment.