The Letter About Your Information
Gen. Bus. Law § 899-aa — within thirty days of discovery, and the attorney general told
In New York, disclosure of a breach of the security of the system to affected New York residents is made in the most expedient time possible and without unreasonable delay, and within thirty days after the breach has been discovered, except for the legitimate needs of law enforcement.
| Who is told | When, as the section puts it |
|---|---|
| Who is toldEach affected resident | When, as the section puts itWithin thirty days after discovery |
| Who is toldA business that maintains data it does not own | When, as the section puts itTells the owner immediately, and within thirty days following discovery |
| Who is toldThe state attorney general, the department of state and the division of state police, whenever residents are notified | When, as the section puts itThe timing, content and distribution of the notices, the approximate number affected, and a copy of the notice |
- Where a court finds a knowing or reckless violation, it may impose a civil penalty of the greater of five thousand dollars or up to twenty dollars per instance of failed notification, not to exceed two hundred fifty thousand dollars.
What counts as personal information, the forms notice may take, and the exceptions for encrypted data are in the section and are not reproduced in full here. Whether a notice was required or on time is a question for the attorney general, a court, and a licensed New York attorney.
Sources for this section (1)
- Gen. Bus. Law § 899-aa — Notification; person without valid authorization has acquired private information
Legal information, not legal advice. Verified as of October 2026. Applying it to a particular situation is the work of a licensed New York attorney.