Meet the NY SHIELD Act's security duties with less manual work

The NY SHIELD Act is a New York law, passed in 2019, that strengthened the state's data breach notification rules and created a duty to protect private information. It requires businesses to keep reasonable administrative, technical and physical safeguards for New York residents' private information and to notify affected people and state regulators after a breach. It is codified in General Business Law sections 899-aa and 899-bb.

Any person or business that owns or licenses computerised private information of a New York resident must comply, regardless of where the business is based. That includes UK and other non-US companies with New York customers or employees. Service providers holding such data for others must notify the owner of any breach. Businesses compliant with GLBA, HIPAA or the NYDFS Cybersecurity Regulation are deemed compliant with the security requirement.

Private information is personal information combined with an unencrypted data element such as a Social Security number, driver's licence number, financial account or card number with access codes, biometric data, or, since March 2025, medical and health insurance information. It also covers a username or email address combined with a password or security question and answer that would allow access to an online account.

Affected New York residents must be notified in the most expedient time possible and within 30 days of discovering the breach, unless law enforcement requests a delay. The business must also notify the Attorney General, the Department of State and the State Police, plus the Department of Financial Services for NYDFS covered entities. If more than 5,000 residents are notified, consumer reporting agencies must also be told.

The New York Attorney General enforces the law; there is no private right of action. Failing to keep reasonable safeguards can lead to civil penalties of up to $5,000 per violation. For knowing or reckless failures to notify a breach, courts can impose the greater of $5,000 or up to $20 per failed notification, capped at $250,000, and may award damages for losses suffered by people who were not notified.

You comply by running a data security programme with reasonable administrative, technical and physical safeguards. The law gives examples: naming a security coordinator, assessing risks, training staff, vetting service providers by contract, testing key controls, detecting and responding to attacks, and securely disposing of data when no longer needed. Small businesses may scale safeguards to their size, activities and data sensitivity.

The SHIELD Act does not require ISO 27001 or SOC 2, and neither gives automatic deemed compliance. However, the safeguards it lists, such as risk assessment, staff training, vendor management, monitoring and secure disposal, closely match controls in both frameworks. An organisation with a working ISO 27001 or SOC 2 programme usually has much of the evidence needed to show reasonable safeguards.

Yes. The SHIELD Act is supported in OneClickComply today. Because its safeguards map to controls shared with ISO 27001 and SOC 2, evidence, policies and risk records you build in OneClickComply can be reused towards it. OneClickComply does not certify SHIELD Act compliance, as no certification exists.