What's happening
This bill requires businesses to notify New Yorkers of data breaches within five days of discovery, replacing the previous thirty-day period.
Why it matters
Shortening the notification window to five days means individuals will learn much sooner if their personal information has been compromised, giving them a better chance to protect themselves from identity theft and financial fraud.
Businesses will face increased pressure to have well-developed breach detection and response plans, as they must act quickly to investigate incidents and notify affected customers within a much tighter timeframe.
The change could increase compliance costs and legal risks for companies, especially smaller organizations that may lack dedicated cybersecurity teams, as failing to meet the new deadline could result in regulatory penalties or lawsuits.
Faster notification also allows state regulators and law enforcement to respond more promptly to data breaches, potentially improving their ability to prevent widespread harm or catch perpetrators.
Albany, before your first meeting.
Every bill that moved yesterday, summarized in a sentence and ranked by impact. The Albany Scorecard follows on Sundays.
Free. Unsubscribe in one click. Want alerts on specific bills? Create an account.
Who cares
Businesses that own or license computerized private information
They would have to notify affected New York residents within five days of discovering or being notified of a breach, replacing the current 30-day outer deadline.
New York residents affected by data breaches
They would receive notice within five days when their private information was, or is reasonably believed to have been, accessed or acquired without authorization.
Law enforcement agencies
The bill would remove the notification provision’s express exception for legitimate law enforcement needs.
Headline styles
Disclose Security Breach in 5 Days
Plain English, a few words. Used as the page title.
Sponsors
Assembly Member · Assembly District 111
History
- Referred to consumer affairs and protection
- Referred to consumer affairs and protection
Full text
1 pageUnderlined is new[Struck] is removedOfficial text on nysenate.gov ↗
STATE OF NEW YORK
1157
2025-2026 Regular Sessions
IN ASSEMBLY
January 9, 2025
Introduced by M. of A. SANTABARBARA -- read once and referred to the Committee on Consumer Affairs and Protection
AN ACT to amend the general business law, in relation to disclosure of breaches of the security of the system
The People of the State of New York, represented in Senate and Assembly, do enact as follows:
Section 1. The opening paragraph of subdivision 2 of section 899-aa of the general business law, as amended by chapter 647 of the laws of 2024, is amended to read as follows:
Any person or business which owns or licenses computerized data which includes private information shall disclose any breach of the security of the system [following] within five days of the discovery or notification of the breach in the security of the system to any resident of New York state whose private information was, or is reasonably believed to have been, accessed or acquired by a person without valid authorization. [The disclosure shall be made in the most expedient time possible and without unreasonable delay, provided that such notification shall be made within thirty days after the breach has been discovered, except for the legitimate needs of law enforcement, as provided in subdivision four of this section.]
§ 2. This act shall take effect immediately.
EXPLANATION--Matter in italics (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD03501-01-5
Reflowed for reading: line numbers and page breaks removed. Cite the official text.
Summaries, headlines and scores are AI-generated from the official bill text. How we score bills. Source: NYS Open Legislation.