State Guide
New York Privacy & Data Security Laws
Every statute below can apply to a business handling New York residents' data, depending on your revenue, the number of New York consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Data Security & Breach Notification · 1
SHIELD Act imposes an affirmative duty to implement a data security program with administrative, technical, and physical safeguards. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
Student Data Privacy · 1
Requires a parents' bill of rights, data-security requirements, and restricts commercial use of student data by third-party contractors.
On the Horizon — Proposed, Not Yet Law · 1
Would create a WA My Health My Data-style consumer health data law for New York if it clears this second attempt — worth monitoring closely given it's already reached the Governor's desk once more.
Status: The original bill (S929/A2141) passed both chambers in January 2025 but was vetoed by Gov. Hochul on Dec 19, 2025. A revised version — S9269/A10357, removing the prior bill's revenue-based penalty of up to 20% of revenue — was reintroduced, has already passed both the Senate and Assembly again, and was delivered to the Governor as of Jun 4, 2026. Awaiting a second gubernatorial decision.