Governance, risk & compliance
New York State privacy and security rules (sector tiers) Sources read 23 Oct 2026; see description
No comprehensive New York consumer privacy statute was found enacted when this pack was written (23 October 2026).
The New York Privacy Act (A4947) is in Assembly committee, and the New York Health Information Privacy Act (S9269) passed both houses in June 2026 after S929 was vetoed on 19 December 2025, but no delivery to the Governor or signature was recorded when this pack was written, so neither is treated as law. What does apply is a set of sector rules, and this framework groups them in tiers you can combine.
General privacy and AI: the Child Data Protection Act (GBL s. 899-ee and following, effective 20 June 2025), employee electronic monitoring notice (Civil Rights Law s.
52-c), secure disposal of records (GBL s. 399-h), and NYC Local Law 144 on automated employment decision tools (Admin.
Code ss. 20-870 to 20-874, enforced from 5 July 2023), with a section that applies existing law to AI tools.
Insurance: DFS Insurance Circular Letter No. 7 (11 July 2024) on AI systems and external data in underwriting and pricing, and 11 NYCRR Part 420 on consumer privacy.
Finance: three cross-references to 23 NYCRR 500. 17 (the full Part 500 stays in NYDFS_500) and 23 NYCRR 200.
16 for virtual currency licensees. Health care: Public Health Law s.
18 patient access, Mental Hygiene Law s. 33.
13, Public Health Law s. 2782 (HIV-related information) and the hospital cybersecurity regulation, 10 NYCRR 405.
46. Transportation: Department of Motor Vehicles record rules in Vehicle and Traffic Law ss.
201 and 202. Public bodies: the Freedom of Information Law, the Personal Privacy Protection Law, State Technology Law s.
208, the LOADinG Act on automated decision-making by state agencies, General Municipal Law Article 19-c incident reporting for municipalities and public authorities, and Education Law s. 2-d.
Pass-through programs: the state rules that sit on top of federal program data for unemployment insurance (Labor Law s. 537), public assistance (Social Services Law s.
136), Medicaid HIV-related information (18 NYCRR 360-8. 1) and criminal justice data (Executive Law s.
837). The SHIELD Act is its own framework, NY_SHIELD, and applies to almost every organization that holds New York residents’ private information.
Not read, so not asserted: 11 NYCRR 420. 1 onward, Social Services Law s.
367-b(4), Banking Law Article 13-B beyond s. 641, and AI statutes other than those named.
General information, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses New York State privacy and security rules (sector tiers) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| General privacy and AI | For any organization that employs people in New York, runs online services used by minors, disposes of records with personal identifying information, or hires in New York City with automated tools. Covers the Child Data Protection Act, employee electronic monitoring notice, GBL s. 399-h, NYC Local Law 144, and a section applying existing law to AI tools. Combine with NY_SHIELD for breach notification and safeguards. | — |
| Insurance | For insurers and other licensees of the Department of Financial Services in insurance: Insurance Circular Letter No. 7 (11 July 2024) on AI systems and external consumer data in underwriting and pricing (it does not cover Child Health Plus, Essential Plan or Medicaid managed care), 11 NYCRR Part 420 on privacy of consumer financial and health information (only the preamble, s. 420.0, was read), and cross-references to 23 NYCRR 500.17. | — |
| Finance and banking | For DFS-regulated financial institutions and virtual currency licensees: cross-references to 23 NYCRR 500.17 (72-hour incident notice, annual certification by 15 April, extortion payment notice), and 23 NYCRR 200.16 for Part 200 licensees. The rest of Part 500 is in NYDFS_500. Banking Law s. 641 requires a licence to transmit money; other money transmitter rules were not researched. | — |
| Health care | For general hospitals (10 NYCRR 405.46, effective 2 October 2024, with one year to comply except the 72-hour incident report) and for providers holding patient records: Public Health Law s. 18 access, Mental Hygiene Law s. 33.13 clinical records, and Public Health Law s. 2782 HIV-related information. HIPAA is the HIPAA framework. The New York Health Information Privacy Act is not law. | — |
| Transportation | For organizations that receive or handle Department of Motor Vehicles data, or run automated vehicle enforcement programs: Vehicle and Traffic Law s. 201 (restricted license application data, legal process, immigration enforcement requests) and s. 202 (data contracts), with the federal Driver’s Privacy Protection Act referenced in s. 201. Other transportation rules (for-hire vehicles, transit agencies) were not researched. | — |
| Public bodies | For state agencies, municipalities, public authorities and school districts: Freedom of Information Law, Personal Privacy Protection Law, State Technology Law s. 208 breach notification, the LOADinG Act (Chapter 674 of 2024) on automated decision-making by state agencies, General Municipal Law Article 19-c incident reporting (72 hours, ransom payments 24 hours) and Education Law s. 2-d for student data. | — |
| Pass-through programs | For state and local agencies and contractors that run federally funded programs and must follow state confidentiality rules on top of federal ones: unemployment insurance (Labor Law s. 537), public assistance (Social Services Law s. 136), Medicaid HIV-related information (18 NYCRR 360-8.1) and criminal justice data (Executive Law s. 837). Read with IRS_1075 and CJIS where federal tax or criminal justice information is held. General Medicaid confidentiality (Social Services Law s. 367-b(4)) was not read. | — |
How Lavawall® helps you get to New York State privacy and security rules (sector tiers) compliance
Most of New York State privacy and security rules (sector tiers) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to New York State privacy and security rules (sector tiers), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against New York State privacy and security rules (sector tiers) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports New York State privacy and security rules (sector tiers) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- New York State privacy and security rules (sector tiers) Sources read 23 Oct 2026; see description
- Category
- Privacy
- Region
- USA - New York
- Levels
- 7 assessment tiers
All New York, United States frameworks and training →
Map this framework freeTalk to our team