Relates to when and how notification of a data breach is to be provided to the department of financial services

New breach notice rules for businesses

When you notify New York residents of a data breach, you must also notify three state agencies: the Attorney General, the Department of State, and the State Police. Your notice must state the timing, content, and how you will send the notices. Include the approximate number of people affected and a copy of the notice you sent. If you are a “covered entity” under 23 NYCRR 500.1, you must also notify the Department of Financial Services and follow 23 NYCRR 500.17. Notifying agencies cannot delay your notices to affected New Yorkers. This law takes effect on the same date as the 2024 state update to data breach notices.