Data breach notification
New York's breach rule is General Business Law § 899-aa, and it pairs a 30-day ceiling with a list of several state recipients.
The disclosure shall be made in the most expedient time possible and without unreasonable delay, provided that such notification shall be made within thirty days after the breach has been discovered.
Thirty days is the outer edge, not the target; the first half of the sentence still asks for speed.
In the event that any New York residents are to be notified, the business shall notify the state attorney general, the department of state and the division of state police. The department of financial services is also named, for entities it covers. There is no minimum headcount for this; any breach that leads to resident notice triggers it.
New York starts from any personal information combined with a data element, when the element or the combination is not encrypted, or is encrypted with an encryption key that has also been accessed or acquired.
| Category | Covered |
|---|---|
| Identity numbers | Social Security number; driver's license or non-driver ID number. |
| Financial accounts | Account or card number with any required code or password, or alone if usable without one. |
| Biometric information | Data generated by electronic measurements of an individual's unique physical characteristics. |
| Medical information | Information regarding medical history, mental or physical condition, or treatment or diagnosis by a health care professional. |
| Health insurance | Health insurance information. |
| Online accounts | A user name or email address with a password or security question and answer that would permit access to an online account. |
Notice to affected persons is not required if the exposure was an inadvertent disclosure by persons authorized to access private information, and the business reasonably determines it will not likely result in misuse. That determination must be documented, and if more than 500 New York residents are affected it goes to the Attorney General within 10 days. Outside authorized insiders, the exception does not apply.
The first job after an incident is often a list of names.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
Every room has a watermark setting that is on by default. Recipients confirm their email with a six-digit code and need no account, and groups see only their folders. The chained log exports as CSV, so a New York team can sort views and downloads inside ShareAndGo by person and by day.
Checked against New York's published law on November 2, 2026. This is general information, not legal advice.
