# New York — US state data breach notification deadlines by state

For New York, statute citation is N.Y. Gen. Bus. Law § 899-aa; individual notice deadline is in the most expedient time possible and without unreasonable delay; ag / regulator notice deadline is without delaying notice to affected New York residents; consumer reporting agency notice trigger (residents) is more than five thousand New York residents; encryption safe harbor is yes, recorded from its source on 2026-08-18.

- **State:** New York _(verified: appears in the quote below)_
- **Statute citation:** N.Y. Gen. Bus. Law § 899-aa
- **Individual notice deadline:** in the most expedient time possible and without unreasonable delay
- **AG / regulator notice deadline:** without delaying notice to affected New York residents _(verified: appears in the quote below)_
- **Consumer reporting agency notice trigger (residents):** more than five thousand New York residents _(verified: appears in the quote below)_
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** AG notice (and notice to the Department of State and Division of State Police) is required whenever any New York residents are to be notified — there is no resident-count threshold for AG notice. The CRA notice threshold is 5,000 residents notified at one time. GLBA- and HIPAA-regulated entities are exempt from the individual notice requirement but must still notify the AG, Department of State, and Division of State Police. _(our reading, not quoted from the source)_

## What the source says

> Such notice shall be made without delaying 24 notice to affected New York residents. 25 (b) In the event that more than five thousand New York residents are 26 to be notified at one time, the person or business shall also notify 27 consumer reporting agencies as to the timing, content and distribution 28 of the notices and approximate number of affected persons. Such notice 29 shall be made without delaying notice to affected New York residents.

## Source

- https://legislation.nysenate.gov/pdf/bills/2019/S5575B

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).