Melissa Crespo and Reiley Porter wrote this article for Corporate Compliance Insights about recent amendments to New York's data breach notification law, which imposed a 30-day notification requirement and expanded the definition of protected information to include medical and health insurance data. Effective December 21, 2024, businesses must notify affected New York residents within 30 days of discovering a breach, aligning with a national trend towards stricter notification timelines. Additionally, DFS-regulated entities must notify the New York Department of Financial Services, alongside other state regulators, of any breaches. The amendments reflect a broader shift across states towards more comprehensive definitions of personal information and expedited breach notification requirements.
Read the full article.
