By Brad Miller
Chief Compliance/Regulatory Officer & Head of Legal
Two significant changes to New York’s data breach notification law were signed in December 2024.
Effective Immediately (as of December 21, 2024):
- Organizations must notify affected New York residents within 30 days of discovering a data breach
- Service providers must notify data owners within 30 days of breach discovery
- All notifications must now be sent to the NY Department of Financial Services (NYDFS), in addition to existing requirements
- Law enforcement needs are the only valid reason for notification delays
Effective March 25, 2025:
- The definition of “private information” requiring breach notification will be expanded
For dealers needing to comply with these new requirements, ComplyAuto offers a data breach wizard tool that automatically walks dealers through the state law requirements, and which has been updated to fully align with New York’s new notification requirements and timelines. This tool can help ensure timely and compliant breach notifications to all required parties, including the newly mandated NYDFS notifications. Dealers should also ensure their breach response procedures align with these new requirements to maintain compliance.
Reach out to ComplyAuto today for details or to see the data breach wizard in action.