NY SHIELD Act and the 30-day breach clock — a plain-English checklist for small businesses

You don't need to be a bank to be covered. If your business — any size, anywhere — holds private information about New York residents, the SHIELD Act applies to you. That includes accountants, dentists, law offices, landlords, contractors keeping copies of IDs, and shops storing customer records.

This is practical guidance, not legal advice. For your specific obligations, talk to a lawyer.

What the law asks for

The SHIELD Act (General Business Law §899-bb, in force since March 2020) requires reasonable administrative, technical, and physical safeguards for private information (NY Senate). Small businesses aren't exempt — their safeguards just need to be appropriate for the size and complexity of the business and how sensitive the data is. The law defines a small business as fewer than 50 employees, or under $3 million in gross annual revenue in each of the last three fiscal years, or under $5 million in year-end total assets.

The 30-day clock

In December 2024, New York amended its breach notification law (§899-aa) to require notifying affected New Yorkers within 30 days of discovering a breach (NY Senate bill S2659-B). And as of March 2025, medical and health-insurance information counts as private information too.

Thirty days goes fast when you're also trying to get the business running again. You need to know what data you have, where it lives, and who to call before anything happens.

It's being enforced

In October 2025, the New York Attorney General settled with a small CPA firm for $60,000 after a ransomware attack and a vendor breach, with notice to clients delayed for more than a year (NY AG). Larger settlements have specifically cited missing multi-factor authentication.

The small-business checklist

Administrative

Name one person responsible for security (it can be you, with help).
Write down what personal data you collect, where it's stored, and who can access it.
Train staff once a year on phishing and fake invoices.
Have a written breach plan: who you call, how you investigate, how you notify within 30 days.
Check that vendors who handle your data protect it too.

Technical

Multi-factor authentication on email and every remote-access tool. This is the single biggest risk reducer.
Automatic updates on every computer and phone.
Encrypted laptops (BitLocker / FileVault) and encrypted backups.
Automatic, versioned offsite backups — tested.
Separate admin accounts; remove access when people leave.

Physical

Lock the server or network closet.
Shred paper with personal info.
Securely wipe old computers and drives before disposal.

When to call a tech

Most small offices can get the technical side in shape in a visit or two, and keep it there with monitoring. Our Complete plan includes endpoint security and email protection; Core covers patching, monitoring, and backup checks. Start with a free conversation: tell us what data you keep, and we'll tell you where the gaps are.