Governance, risk & compliance

New York SHIELD Act (GBL ss. 899-aa and 899-bb) GBL 899-aa (2025-03-28); 899-bb (2020-03-27)

The Stop Hacks and Improve Electronic Data Security (SHIELD) Act, Chapter 117 of the Laws of 2019, changed two parts of the General Business Law.

Section 899-aa (breach notification) applies to any person or business that owns or licenses computerized data that includes the private information of a New York resident, wherever the business is. Section 899-bb (data security protections) requires reasonable safeguards for the same data.

The sponsor memo for the bill gives the 90th day after signing for s. 899-aa (23 October 2019) and the 240th day for s.

899-bb (21 March 2020); both dates are calculated from the signing date, not read from the chapter text. Private information is personal information combined with an unencrypted element: Social Security number; driver’s license or non-driver identification number; an account or card number with its access code, or usable without one; biometric data; medical information; or health insurance information; or a username or email address with a password or security question.

Medical and health insurance information were added by Chapter 613 of 2024 (signed 21 December 2024, effective on the 90th day after, which is 21 March 2025 by calculation). Notice to affected residents must be made in the most expedient time possible, without unreasonable delay, and within 30 days after discovery (Chapter 647 of 2024, signed and effective 21 December 2024), then to the Attorney General, the Department of State and the State Police, to the Department of Financial Services for Part 500 covered entities, and to consumer reporting agencies if more than 5,000 residents are notified.

A HIPAA covered entity that notifies the federal Secretary also notifies the Attorney General within five business days. A small business (fewer than 50 employees, or under $3 million in gross revenue in each of the last three years, or under $5 million in year-end assets) may scale its safeguards to its size.

Failing to meet s. 899-bb is treated as a violation of GBL s.

349 and the Attorney General may seek an injunction and civil penalties; there is no private right of action under s. 899-bb.

Knowing or reckless failure to notify carries a civil penalty of the greater of $5,000 or up to $20 per failed notice, capped at $250,000. A compliant regulated entity (GLBA, HIPAA/HITECH, 23 NYCRR Part 500 or other listed rules) is deemed to meet s.

899-bb. This framework stands alone because it applies far beyond New York sector rules; the sector tiers are in NY_STATE.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses New York SHIELD Act (GBL ss. 899-aa and 899-bb) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to New York SHIELD Act (GBL ss. 899-aa and 899-bb) compliance

Most of New York SHIELD Act (GBL ss. 899-aa and 899-bb) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to New York SHIELD Act (GBL ss. 899-aa and 899-bb), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against New York SHIELD Act (GBL ss. 899-aa and 899-bb) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports New York SHIELD Act (GBL ss. 899-aa and 899-bb) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.