New York Amends Data Breach Notification Requirements

Published on January 7, 2025 at 9:00 am

Eric Rosenkoetter

Maurice Wutscher, LLP
Editor's Note: This article by Eric Rosenkoetter was originally published on the Maurice Wutscher blog and is republished here with permission.
Alexander / AdobeStock

New York Gov. Kathy Hochul recently signed into law A8872-A and S2659-B which amend New York’s data breach notification law. 

The bills, which are identical, do two things:

  1. Require notification of a breach be made to affected residents within 30 days of discovery, as opposed to just “the most expedient time possible and without unreasonable delay,” subject to the needs of law enforcement; and
  2. Require notice to the Department of Financial Services, in addition to the existing requirement to notify the Attorney General, Department of State, and Division of State Police.

The amendments went into effect immediately upon enactment.