Keypoint: New York has amended its data breach notification law twice in the last 60 days to (1) add a 30-day deadline for notifying affected residents, (2) clarify that covered financial entities must still notify the New York Department of Financial Services (NYDFS) in accordance with existing NYDFS cybersecurity regulations, and (3) expand the prior definition of “private information” to include medical and health insurance information.
In the last sixty days, the New York legislature twice amended its data breach notification law. In the below article, we discuss the amendments and takeaways for covered businesses.
A Shorter Notification Deadline for the Private Sector
The NY legislature amended General Business Law § 899-aa, the state’s private-sector data breach notification law in December 2024, and has since enacted a second amendment to clarify which types of businesses must provide updates to the New York Division of Financial Services (NYDFS).
The December 2024 amendment (underlined text below) requires businesses that suffer a breach to inform affected residents in the most expedient time possible and without unreasonable delay, provided that such notification is within thirty days after the breach has been discovered. The amendment also eliminated allowances to delay notification while the businesses assessed the scope of the breach or restored system integrity. The amended law still allows notification delays for legitimate law enforcement purposes.
The December amendment adds (underlined text below) a similar outer limit to the notification deadline for businesses that are processing or servicing data on behalf of other companies. A business that experiences a data breach on its systems but does not own the data must inform the data owner immediately, provided that notification is made within 30 days following the discovery of the breach.
These 30-day deadlines went into effect immediately, and they put companies subject to New York law on the same timeline as companies subject to Colorado, Florida, and Washington law, which also have 30-day deadlines to notify their residents.
New York agencies, however, are not bound by the 30-day deadline. State agencies must notify affected individuals in the most expedient time possible and without unreasonable delay. This time frame can take into account the needs of law enforcement or measures necessary to determine the scope of the breach and restore data system integrity.
Covered Financial Entities Must Still Update NYDFS per its Cybersecurity Regulations (after a second amendment was passed)
Under the original breach notification law, every business that is required to notify affected NY residents must also notify the following NY government entities – the Attorney General, the Department of State, and the State Police. Those requirements were not changed in the December amendment, but a requirement was added for all businesses to notify NYDFS. See NY Senate Bill S2659B. The new requirement for all business types to notify NYDFS apparently had broader application than the legislature intended. On February 14, 2025, the Governor signed a second amendment to GBL § 899-aa, clarifying precisely which types of businesses had to notify NYDFS of a data breach, and when those notifications were required. See NYSenate Bill S804.
The February amendment added language to subdivision (8) of GBL § 899-aa, specifying that only those businesses that are defined as covered entities under NYDFS regulations must report breaches to NYDFS, and such notification to NYDFS will be made in accordance with the existing NYDFS cybersecurity regulations.[1]
A Broader Definition of “Private Information” for the Private Sector and State Agencies
The amendments also expanded the state’s definition of “private information” to include medical and health insurance information. Starting March 21, 2025, the scope of “private information” that would trigger a notification requirement will expand to include sensitive health-related data. Specifically, the new definition will cover:
- Medical information, such as an individual’s medical history, mental or physical condition, or medical treatment or diagnosis by a healthcare professional; and
- Health insurance information, including policy numbers, subscriber identification numbers, unique identifiers used by health insurers, and information in an individual’s application, claims, or appeals history.
The expanded definition of private information applies to the notification obligations for private sector entities and state agencies.
For the private sector, this expanded definition means that breaches involving medical or health insurance information will not only trigger federal notification requirements under the Health Insurance Portability and Accountability Act (HIPAA), but these breaches will trigger additional obligations under New York law. For HIPAA-regulated entities, the deadline to notify NY residents will be 30 days as opposed to 60 days under HIPAA.
Takeaways
Businesses should review and update their incident response plans and data security policies to account for New York’s shorter deadline and the expanded definition of private information that would start the clock for that deadline.
New York is one of several states where the data breach notification laws operate alongside federal laws regulations such as HIPAA and its Breach Notification Rule, and the Federal Trade Commission’s Health Breach Notification Rule. While these parallel requirements do not require duplicative notifications to be sent to affected individuals, these overlapping legal obligations do mandate that businesses notify the applicable state regulators along with their federal counterparts.
[1] The NYDFS cybersecurity regulations have a 72-hour deadline for covered financial entities to report a cybersecurity incident, and a 24-hour deadline to report an extortion/ransom payment. 23 NYCRR Part 500.