NB: This page summarizes current New York law. However, New York amended its data breach notification statute effective October 23, 2019. This page will be updated at that time.
Breach Based on Harm Threshold: NO
Deadline for Consumer Notice: Most expedient time possible and without unreasonable delay
Government Notification Required: YES
Scope of this Summary
Form of Covered Info
Encryption Safe Harbor
Timing: Must be made in the most expedient time possible and without unreasonable delay and consistent with any measures necessary to determine the scope of the breach and to restore the integrity of the system.
Content: Notice must include contact info for covered entity and a description of the categories of information reasonably believed to have been acquired without authorization.
Method: By written notice, telephone notice (if a log of notifications is kept), or by electronic notice (if resident expressly consented to receiving electronic notice, a log of each notification is kept, and business does not require resident to consent to receive notice electronically as a condition of the business relationship). Substitute notice is available if certain criteria are satisfied.