New York Changes Data Breach Law—In December and February

Norton Rose Fulbright – New York just finished a series of adjustments to its data breach notification requirements. Effective immediately, organizations must notify impacted individuals of a data breach within 30 days of its discovery instead of “in the most expedient time possible and without unreasonable delay.” Moreover only entities regulated by the New York Department of Financial Services (DFS) must notify it of a data breach.