Shown verbatim: the complete text as captured from the official source posted by the New York State Senate, fetched 2026-08-11. Nothing is edited or removed. Where this bill amends existing law, language marked for deletion in the official source appears here in brackets. The official bill page.
S T A T E O F N E W Y O R K
________________________________________________________________________
804
2025-2026 Regular Sessions
I N S E N A T E
(PREFILED)
January 8, 2025
___________
Introduced by Sen. COMRIE -- read twice and ordered printed, and when
printed to be committed to the Committee on Rules
AN ACT to amend the general business law, in relation to when and how
notification of a data breach is to be provided to the department of
financial services
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Paragraph (a) of subdivision 8 of section 899-aa of the
general business law, as amended by a chapter of the laws of 2024 amend-
ing the general business law relating to notification of a data breach,
as proposed in legislative bills numbers S. 2659-B and A. 8872-A, is
amended to read as follows:
(a) In the event that any New York residents are to be notified, the
person or business shall notify the state attorney general, the depart-
ment of state, the division of state police, and the department of
financial services as to the timing, content and distribution of the
notices and approximate number of affected persons and shall provide a
copy of the template of the notice sent to affected persons; PROVIDED,
HOWEVER, THAT NOTICE TO THE DEPARTMENT OF FINANCIAL SERVICES SHALL ONLY
BE REQUIRED IF THE PERSON OR BUSINESS IS A COVERED ENTITY, AS DEFINED IN
23 NYCRR 500.1, AND PROVIDED FURTHER THAT SUCH NOTICE SHALL BE PROVIDED
TO THE DEPARTMENT OF FINANCIAL SERVICES IN COMPLIANCE WITH 23 NYCRR
500.17. Such notice shall be made without delaying notice to affected
New York residents.
§ 2. This act shall take effect on the same date and in the same
manner as a chapter of the laws of 2024 amending the general business
law relating to notification of a data breach, as proposed in legisla-
tive bills numbers S. 2659-B and A. 8872-A, takes effect.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD02809-01-5Every fact on this page links to its source, starting with the official bill record.