At a glance
- Short name
- NY SHIELD
- Issuing / stewarding body
- New York AG
- Also known as / related labels
- NY General Business Law §899-aa · NY General Business Law §899-bb · 23 NYCRR Part 500
What this entry covers
The New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act consists of General Business Law §899-bb, which requires anyone owning or licensing computerized private information of New York residents to maintain reasonable administrative, technical, and physical safeguards, and §899-aa, which sets breach notification duties. Violations of §899-bb are enforced by the New York Attorney General; the section creates no private right of action.
MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid. It is not legal advice and is not a substitute for the official text.
Official documentation
- Primary official source: https://www.nysenate.gov/legislation/laws/GBS/899-BB
- Breach notification, GBL §899-aa: https://www.nysenate.gov/legislation/laws/GBS/899-AA
Recent changes
- 2025-02-14: Chapter 91 of the Laws of 2025 (S804), a chapter amendment, limited the Department of Financial Services notice to covered entities under 23 NYCRR 500.1, given in line with 23 NYCRR 500.17. NY Senate, S804
- 2024-12-21: Chapter 647 of the Laws of 2024 (S2659-B) set a 30-day deadline for notifying affected New York residents after a breach is discovered and added the Department of Financial Services to the agencies that must be notified. NY Senate, S2659-B
- Current text: §899-aa now lists medical information and health insurance information within “private information.” NY Senate, GBL §899-aa
How to use this index entry
- Open the official link above (or the agency home if the deep link drifts).
- Confirm edition / revision date against your program scope.
- Map applicability by sector and jurisdiction listed in the metadata.
- Follow related frameworks only after checking their own official sources.
Disclaimers
- MyRHC does not host proprietary standards text (ISO, some industry bodies).
- Where standards are paywalled, we link to the publisher’s catalog page.
- Always verify current requirements with counsel and the issuing authority.
Index only — not legal advice.
MyRHC does not certify compliance. Confirm current requirements with the issuing authority and qualified counsel. Proprietary standards text remains with its publisher.