State Guide
New York Privacy & Data Security Laws
Every statute below can apply to a business handling New York residents' data, depending on your revenue, the number of New York consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Data Security & Breach Notification · 1
SHIELD Act imposes an affirmative duty to implement a data security program with administrative, technical, and physical safeguards. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
Student Data Privacy · 1
Requires a parents' bill of rights, data-security requirements, and restricts commercial use of student data by third-party contractors.
On the Horizon — Proposed, Not Yet Law · 1
Would create a WA My Health My Data-style consumer health data law for New York if it clears this second attempt — worth monitoring closely given it's already reached the Governor's desk once more.
Status: The original bill (S929/A2141) passed both chambers in January 2025 but was vetoed by Gov. Hochul on Dec 19, 2025, who called its definitions and scope too broad. The revised S9269/A10357 — narrower in scope, with added carve-outs for data already covered by state and federal regulation, and without the prior 20%-of-revenue penalty — passed the Senate 48-13 on Jun 3, 2026 and the Assembly on Jun 4, 2026. As of Sep 11, 2026 the Senate record still shows "Passed Senate & Assembly" with no chapter number and no recorded gubernatorial action — the last entry remains the Jun 4, 2026 Assembly passage.