New York SHIELD Act: What New Data Security Requirements Mean For Your Business

Certain provisions of the New York Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) recently took effect in the state of New York. The act was signed into law by the governor in July 2019, and its data breach notification rules — which expanded the definition of a reportable breach and personally identifiable information (PII) covered as well as notification and reporting requirements — took effect in October 2019. However, the new data security requirements became effective on March 21, 2020, with limited fanfare amid a global pandemic. But the SHIELD Act's security requirements have significant impact — particularly their reach to non-New York businesses that hold New York resident data.