Looming Data Security Requirements Under The New York SHIELD Act: What Businesses Need To Know

By March 21, 2020, nearly every business—not only those that conduct business in New York State—that owns or licenses computerized data that includes the private information of any New York State resident, will be required to implement certain safeguards to protect the security of such information.

As we reported in September 2019, the New York State Legislature passed and Governor Andrew Cuomo signed two bills last year that aim to improve protections for the handling of computerized private information of New York residents. The Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) amended New York law by requiring businesses to implement safeguards for handling the private information of New York residents and broadened security breach notification requirements. While the SHIELD Act's breach notification requirements are already in effect, the "reasonable safeguards" requirements are not effective until March 21, 2020.