SHIELD Act private-information security safeguards
Enacted in force
Fields requiring verification
- enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
In plain English
- Persons or businesses owning or licensing computerized data containing New York residents’ private information; size-appropriate safeguards and statutory deemed-compliance provisions apply. Primary source
- Maintain reasonable administrative safeguards including responsible staff, risk assessment, training and service-provider controls. Primary source
- Maintain reasonable technical safeguards covering network/software risks, attack detection, response and testing. Primary source
- Maintain reasonable physical safeguards and securely dispose of private information when no longer needed for business purposes. Primary source
Dates and phased obligations
General breach amendments2019-10-23; §4 safeguards2020-03-21 Primary source
The 90-day and 240-day clauses, counted from the AG-confirmed signature date, give2019-10-23 for the general breach amendments and2020-03-21 for safeguards. This row focuses on safeguards and does not present its later date as the start of every SHIELD provision. Source and qualifications
Questions from this record
Who does SHIELD Act; GBL899-aa/899-bb; S5575B (2019) cover?
Persons or businesses owning or licensing computerized data containing New York residents’ private information; size-appropriate safeguards and statutory deemed-compliance provisions apply. Primary source
What is the law’s status?
Enacted / in force Primary source
What date does this record track?
General breach amendments2019-10-23; §4 safeguards2020-03-21 Primary source
Has this record been verified?
This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source
- New York Attorney General, SHIELD Act guidanceSignature2019-07-25; coverage, safeguards and penalties
- New York Assembly, S5575B final text§4 addsGBL899-bb; §6 commencement90days generally and240days for§4
Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.