What Is New York’s Personal Privacy Protection Law?

New York’s personal privacy protection law is the Stop Hacks and Improve Electronic Data Security Act, known as the SHIELD Act, which requires any business holding a New York resident’s private information to keep that data secure and to notify residents promptly after a breach. It works alongside New York City’s biometric privacy ordinance, a separate cybersecurity regulation for banks and insurers, and several federal protections. New York does not yet have a comprehensive consumer privacy law of the kind other states have passed, though one has been reintroduced in the legislature.

What Information the Law Protects

The SHIELD Act covers computerized data that pairs your name with any of the following: a Social Security number, a driver’s license or state ID number, or a financial account number combined with a security code or password that would allow access to the account.¹ It also covers biometric identifiers and login credentials such as an email address paired with a password or security question.²

Information already made public through federal, state, or local government records is not covered.¹ The protection runs only to computerized data, so paper-only records fall under different rules.

Who Has to Follow It

The SHIELD Act reaches “any person or business which owns or licenses computerized data” that includes private information of a New York resident.³ That language is deliberately broad. A company based in another state or country that holds data on even a single New York resident is covered. If a business collects your name, account numbers, or login credentials through a website or app, the law applies regardless of where the company is located.

What Businesses Must Do to Keep Your Data Safe

The SHIELD Act is not just a breach-notification statute. It independently requires any business holding New Yorkers’ private information to maintain a data-security program with administrative, technical, and physical safeguards.² That means designating someone to run the program, training staff, vetting vendors, monitoring systems for attacks, and properly destroying data when it is no longer needed.

The law does not name specific technologies. Instead, it uses a “reasonable safeguards” standard that scales with the size and complexity of the business and the sensitivity of what it holds. Attorney General enforcement actions give practical shape to the standard: outdated password hashing, unencrypted Social Security numbers, and failing to reset customer passwords after a known breach have all drawn penalties.⁴

When Businesses Must Tell You About a Breach

If a business discovers that your private information was accessed without authorization, it must notify you “in the most expedient time possible and without unreasonable delay.”³ A December 2024 amendment tightened that further, requiring notice within 30 days of discovery. Law enforcement can ask for a delay if disclosure would interfere with a criminal investigation; no other reason justifies waiting.

The notice has to describe the categories of information believed to have been acquired and give you contact information for follow-up.¹ The business must also report the breach to the Attorney General’s office, the Department of State, and the Division of State Police. When more than 5,000 New York residents are affected at once, consumer reporting agencies get notified too.³

Extra Protection for Biometric Data in New York City

Since 2021, any commercial establishment in New York City that collects biometric identifiers (fingerprints, retina or iris scans, facial geometry, voiceprints, hand scans) must post a clear and conspicuous sign near every customer entrance disclosing the collection. Selling, leasing, or otherwise profiting from biometric data is flatly prohibited.⁵

Unlike the SHIELD Act, this city law gives you a private right of action. You can sue a business directly. Damages run $500 per violation of the notice requirement and $5,000 per intentional or reckless violation of the sale prohibition, and winning plaintiffs can recover attorney’s fees.⁵ Before suing over a missing sign, you must give the business 30 days’ written notice and a chance to fix the problem. No cure period applies to suits over selling biometric data.

Separate Rules for Banks and Insurers

If the company that mishandled your data is a bank, insurer, HMO, or other entity licensed under the Banking Law, Insurance Law, or Financial Services Law, a separate and more demanding regulation applies: 23 NYCRR Part 500, enforced by the Department of Financial Services.⁶ Covered entities must report cybersecurity incidents to the DFS superintendent within 72 hours when the incident triggers a government notification obligation, threatens material harm to operations, or involves ransomware in a material part of their systems. DFS imposed $19 million in combined penalties against eight auto insurance companies in one recent round of enforcement.

Can You Sue a Business That Loses Your Data?

Not under the SHIELD Act. The statute gives enforcement power only to the Attorney General, so you cannot file a SHIELD Act lawsuit on your own. Your options are to complain to the AG, to sue under a different legal theory such as negligence, or, if biometric data is involved, to use New York City’s biometric privacy ordinance, which does allow private suits.

When the AG does act, the stakes for the business can be significant. For knowing or reckless violations of the notification requirements, a court can impose a civil penalty of the greater of $5,000 or up to $20 per person who should have been notified, capped at $250,000.³ Courts can also award actual damages, including consequential financial losses, to people who were entitled to notice but never received it. The statute of limitations is three years from either the violation or the date the AG became aware of it. Settlements with T-Mobile, CafePress, and Zoetop (SHEIN’s parent company) have run into the millions.⁴

How to File a Complaint

The most direct path is the Attorney General’s Bureau of Internet and Technology.⁷ Submit a complaint through the AG’s online form, which handles data breaches, deceptive practices, and unauthorized data sharing.⁸ Include the company’s name, what happened, when you learned about it, and any correspondence you received.

For problems with a bank, insurer, or other regulated financial entity, the Department of Financial Services handles complaints connected to its cybersecurity regulation.⁶ Health-data breaches involving HIPAA-covered entities also trigger federal reporting obligations through the U.S. Department of Health and Human Services.⁹

What to Do if Your Data Was Exposed

Filing a complaint is one piece. Protecting your credit is another, and New York law gives you tools that cost nothing to use.

You can place a security freeze on your credit report at no charge. Consumer reporting agencies must activate the freeze within one business day of a phone or online request, and lifting it is also free and must happen within one hour for phone or electronic requests. If the breach involved your Social Security number, the credit reporting agency must offer you identity theft prevention services for up to five years at no cost and tell you how to enroll.¹⁰

Federal law lets you dispute inaccurate information that appears on your credit report because of identity theft. The credit reporting agency has to conduct a free reinvestigation within 30 days and correct or delete the disputed item.¹¹ The Federal Trade Commission runs IdentityTheft.gov, where you can file a federal identity theft report and get a step-by-step recovery plan.¹²

What’s Missing From Current Law

New York does not yet give residents the kinds of affirmative rights over their personal information that some other states have enacted: no general right to access or delete data a company holds about you, no required opt-in before a company processes sensitive categories, no broad restrictions on targeted advertising. The New York Privacy Act (Senate Bill S3044) was reintroduced in the 2025–2026 session and sits in the Senate Internet and Technology Committee; it has not been enacted.¹³

If passed, the bill would define “sensitive data” to include racial or ethnic origin, religious beliefs, health conditions, sexual orientation, genetic information, biometric identifiers, precise geolocation data, and government-issued ID numbers, and it would require explicit opt-in consent before a business could process any of it.¹³ Until something like it becomes law, your protections in New York run through the SHIELD Act, the city biometric ordinance, the DFS regulation for financial institutions, and federal credit-reporting law.

1
Department of State. Fact Sheet for Business
2
New York State Attorney General. Stop Hacks and Improve Electronic Data Security Act (SHIELD Act)
3
New York State Senate. New York General Business Law GBS 899-AA – Notification
4
New York State Attorney General. Protecting Consumers’ Personal Information
5
The New York City Council. New York City Local Law 2021-003 – Biometric Identifier Information
6
Department of Financial Services. Cybersecurity Resource Center
7
New York State Attorney General. Technology
8
New York State Office of the Attorney General. Internet, Technology and Privacy Complaint Form
9
Federal Trade Commission. Data Breach Response: A Guide for Business
10
New York State Senate. New York General Business Law GBS 380-T – Security Freeze
11
Office of the Law Revision Counsel. 15 USC 1681i – Procedure in Case of Disputed Accuracy
12
Federal Trade Commission. IdentityTheft.gov: Report Identity Theft and Get a Recovery Plan
13
New York State Senate. Senate Bill S3044 2025-2026 Legislative Session – NY Privacy Act