The NY SHIELD Act: a practical guide for NYC small businesses

The New York SHIELD Act requires any person or business that maintains private information about New York residents to adopt reasonable administrative, technical, and physical safeguards for that information. The law applies based on the data you hold about New York residents, so a small firm in Manhattan and an out-of-state company with New York customers can both be in scope. Small businesses get a proportionality standard: their safeguards must be reasonable for their size, complexity, activities, and the sensitivity of the data. This guide covers what that means in practice. It is a readiness overview, so confirm how the law applies to your specific situation with counsel.

Who does the SHIELD Act cover?

According to the New York Attorney General’s SHIELD Act guidance, the data security requirements apply to any person or business that maintains private information. What matters is the information you hold, wherever your office is. If your client files, HR records, customer accounts, or payment systems include private information about New York residents, the safeguard requirements are worth reviewing.

For most NYC small businesses, this describes the normal course of business. Accounting firms, medical and dental practices, property managers, staffing agencies, retailers, and professional services firms all routinely hold this kind of data.

What counts as private information?

The SHIELD Act expanded New York’s definition of “private information.” The Attorney General’s guidance highlights two additions:

• Biometric information. This matters for any business using biometric time clocks or biometric door access.
• Account credentials. A username or email address in combination with a password, which brings ordinary login data into scope.

The credentials addition is the one most small businesses underestimate. A database of customer portal logins, or an employee’s email address and password exposed in a compromise, can fall within the definition. Review the statute’s full definition with counsel to confirm which of your data sets qualify.

Does the small business standard apply to you?

The statute (New York General Business Law § 899-bb) defines a small business as one with any of the following:

• fewer than fifty employees, or
• less than $3 million in gross annual revenue in each of the last three fiscal years, or
• less than $5 million in year-end total assets.

A small business complies if its security program contains reasonable safeguards that are “appropriate for the size and complexity of the small business, the nature and scope of the small business’s activities, and the sensitivity of the personal information” it collects.

The standard scales with the business. A 15-person firm’s program will look very different from a bank’s, but it should still reflect a real look at its risks and sensible controls to match. The flip side is that “we are small” is not a defense for doing nothing. Reasonable safeguards still have to exist, and you should be able to show what they are.

The three safeguard categories, with practical examples

The law organizes safeguards into administrative, technical, and physical categories. The Attorney General’s guidance gives examples in each. Here is how they translate for a small business.

Administrative safeguards

The AG’s examples include designating one or more employees to coordinate the security program and identifying reasonably foreseeable internal and external risks. In practice:

• Name a person responsible for the program, even if much of the work is done by an outside provider.
• Write down where private information lives (email, file shares, accounting software, line-of-business apps) and what could go wrong with each.
• Train employees on phishing and data handling, and keep a record of who completed it.
• Select service providers that can maintain appropriate safeguards, and put security expectations in their contracts.

Technical safeguards

The AG’s examples include assessing risks in network and software design, and detecting, preventing, and responding to attacks or system failures. In practice:

• Require multi-factor authentication on email, remote access, and any system holding private information.
• Keep operating systems and applications patched on a defined schedule.
• Run endpoint detection and response on every device, with someone actually watching the alerts.
• Encrypt laptops and mobile devices, and back up critical data in a way you have tested.
• Review your network design and cloud configurations periodically, not just at setup.

Physical safeguards

The AG’s examples include assessing risks of information storage and disposal, and disposing of information within a reasonable time after it is no longer needed. In practice:

• Lock rooms and cabinets that hold paper records or network equipment.
• Set retention periods for records, and follow them.
• Wipe or destroy drives before retiring computers, copiers, and phones, and keep a record of disposal.

What happens if there is a breach?

New York’s breach notification law (General Business Law § 899-aa) requires notice to affected persons “in the most expedient time possible and without unreasonable delay,” and within thirty days after the breach has been discovered, except where law enforcement has legitimate needs that justify a delay. Other notification obligations may also apply, so confirm the full set with counsel.

Thirty days passes quickly once you account for investigation, determining whose data was affected, and drafting notices. The businesses that meet the deadline comfortably are the ones that already know where their data lives and have an incident response plan with legal counsel identified in advance. Because notification decisions carry legal consequences, involve counsel early in any suspected breach.

How Intelligent Group can help

Intelligent Group supports SHIELD Act readiness through our compliance and compliance support services: mapping where private information lives, documenting risks, and putting reasonable safeguards in place with records to show for them. Our managed IT service covers the technical side day to day, including MFA, patching, endpoint protection, and backups, with 24/7 US-based senior engineers. We are not a law firm, so we work alongside your counsel on legal interpretation.

Frequently asked questions

Does the SHIELD Act apply if my business is not located in New York?

The Attorney General’s guidance describes the requirements as applying to any person or business that maintains private information, and the law is focused on New York residents’ data. If you hold private information about New York residents, review your obligations with counsel regardless of where your office is.

Is a small business exempt from the SHIELD Act?

No. Small businesses as defined in the statute are held to a proportional standard, meaning their safeguards must be reasonable for their size, complexity, activities, and the sensitivity of the data. They still need a security program with administrative, technical, and physical safeguards.

Are email addresses and passwords really covered?

The SHIELD Act expanded the definition of private information to include a username or email address in combination with a password. That is why protecting stored credentials, and enforcing multi-factor authentication, matters even for businesses that hold little other sensitive data.

How long do we have to notify people after a breach?

The statute requires notice in the most expedient time possible and without unreasonable delay, and within thirty days after discovery, subject to legitimate law enforcement needs. Confirm the specific notification steps for your situation with counsel.