NY SHIELD Act Compliance: What Every New York Small Business Must Do in 2026

The NY SHIELD Act is not new — but enforcement expectations in 2026 are. If your business holds a name plus one identifier for a single New York resident, this law applies to you. Here’s what compliance actually looks like in practice.

What the SHIELD Act Requires — In Plain English

The Stop Hacks and Improve Electronic Data Security (SHIELD) Act, effective March 2020, does two things: it broadens New York’s data breach notification law, and it imposes an affirmative duty on businesses to implement reasonable safeguards to protect the private information of New York residents.

Two features of the law consistently surprise business owners:

• It applies to any business anywhere that owns or licenses computerized data containing the private information of a New York resident. A Florida accounting firm with three New York clients is in scope.
• The definition of “private information” is broader than most people think. It includes not just Social Security numbers and financial account numbers, but also biometric data, and any user name or email combined with a password or security question that would permit access to an online account.

Who Is Covered — And Who Gets a Break

Every business that holds private information on a New York resident is subject to the breach notification requirements. The safeguards requirement scales with size:

• Small businesses (fewer than 50 employees, less than $3M in gross annual revenue for each of the last three fiscal years, or less than $5M in year-end total assets) may satisfy the safeguards standard with a program that is “appropriate for the size and complexity of the small business, the nature and scope of the small business’s activities, and the sensitivity of the personal information the small business collects.”
• All other businesses must implement the full administrative, technical, and physical safeguards laid out in the statute.

The small-business carve-out is real, but it is not a pass. The New York Attorney General has made clear that even a small business is expected to have documented safeguards proportionate to its risk.

The Three Categories of Reasonable Safeguards

1. Administrative Safeguards

These are the policies, people, and processes that govern how data is handled.

• Designate one or more employees to coordinate the security program.
• Identify reasonably foreseeable internal and external risks.
• Assess the sufficiency of safeguards in place to control those risks.
• Train and manage employees in security program practices and procedures.
• Select service providers capable of maintaining appropriate safeguards and require those safeguards by contract.
• Adjust the security program in light of business changes or new circumstances.

2. Technical Safeguards

These are the controls implemented in your systems and networks.

• Assess risks in network and software design.
• Assess risks in information processing, transmission, and storage.
• Detect, prevent, and respond to attacks or system failures.
• Regularly test and monitor the effectiveness of key controls, systems, and procedures.

3. Physical Safeguards

These control physical access to private information.

• Assess the risks of information storage and disposal.
• Detect, prevent, and respond to intrusions.
• Protect against unauthorized access to or use of private information during and after the collection, transportation, and destruction or disposal of the information.
• Dispose of private information within a reasonable amount of time after it is no longer needed, and in a way that renders it unreadable.

The Compliance Documents You Should Have on File Right Now

The statute doesn’t mandate a specific document set, but if the Attorney General ever asks how you satisfy the “reasonable safeguards” standard, having the following materials ready is the difference between a five-minute conversation and a six-month investigation.

1. A written Information Security Program (WISP). One document that names the responsible person, describes your safeguards, and references your policies.
2. A written Incident Response Plan. Who does what in the first 24 hours of a suspected breach, and how notifications are decided and delivered.
3. Vendor security assessments for any service provider that touches your private information — payroll processors, cloud providers, IT vendors, disposal companies.
4. Employee training records. Not attendance sheets — completed modules, dates, and topic coverage.
5. A risk assessment updated at least annually, and after any material change to your systems or business.
6. Data disposal logs for records that were destroyed.

Breach Notification Under the SHIELD Act

The Act broadened what counts as a breach in two important ways:

• “Breach” now includes unauthorized access to private information — not just acquisition. The old “we don’t think they took anything” defense no longer buys you as much room.
• Notification is required to affected New York residents, the Attorney General, the Department of State, and the Division of State Police, unless the exposure of private information was an inadvertent disclosure by persons authorized to access it and the business reasonably determines it will not likely result in misuse or harm — and even then, you must document that determination in writing and keep it for at least five years.

What Enforcement Actually Looks Like

The Attorney General has authority to seek civil penalties of up to $5,000 per violation, and there is no statutory cap on notification-failure penalties. Recent settlements have made two things clear: investigators focus on whether you had a program before the incident, and they look hard at vendor management. Blaming the breach on a service provider is not a defense if you never assessed that provider.

A 60-Day Path to a Defensible Program

If your business currently has no formal SHIELD program, a realistic 60-day path looks like this:

• Days 1–15: Data inventory. Where does private information live? Which systems, which people, which vendors?
• Days 16–30: Risk assessment against that inventory. What could reasonably go wrong, and what is in place today to prevent or detect it?
• Days 31–45: Write the WISP and Incident Response Plan. Assign the security coordinator role. Kick off employee training.
• Days 46–60: Vendor security reviews for the top five providers touching your data. Set an annual review calendar.

Bottom Line

The SHIELD Act rewards businesses that can demonstrate a reasonable program — not just describe one over the phone during an incident. Documentation is compliance. If you cannot show it, you do not have it.

Brightworks IT builds and maintains SHIELD-aligned security programs for small and mid-market businesses across New York. Reach out for a scoped compliance review.