Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

The New York State Legislature <a href="https://www.nysenate.gov/legislation/bills/2025/S804">recently enacted</a> a notable, albeit minor, amendment to the state’s data breach notification laws. This marks the <a href="https://www.thompsonhine.com/insights/new-york-data-breach-law-amended-new-timelines-and-expanded-regulatory-reporting/">second revision</a> to New York’s data breach notification requirements within two months.

core/paragraph

Prior to this legislative change, data breaches that impacted sensitive personal data (e.g., Social Security numbers, financial account data, biometric data) and required notification to any New York resident, also required the business subject to the breach to make additional notification to specific state agencies: the state attorney general, the department of state, the division of state police, and the department of financial services (NYDFS). The notification to regulatory agencies needed to address the timing, content, and distribution of the notices sent to impacted <a>residents</a>, the approximate number of affected residents, and a copy of the notice sent to them.

The recent legislative amendment now clarifies that only “covered entities” regulated by the NYDFS are required to report breaches to that department. Additionally, such notifications must <a href="https://www.thompsonhine.com/insights/nydfs-amends-data-breach-and-cybersecurity-regulations/">comply with the requirements</a> set forth in <a>24 NYCRR 500.17</a>. The term “covered entity” essentially means any person or organization operating under—or required to operate under—a license, registration, charter, certificate, permit, accreditation, or similar authorization pursuant to the New York Banking Law, the Insurance Law, or the Financial Services Law. This requirement applies regardless of whether the covered entity is also regulated by other government agencies.

The legislative amendment to the New York data breach notification law took effect on February 14, 2025. Organizations subject to these changes should update their incident response plans to ensure compliance with the revised notification requirements.

<em>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel. This document may be considered attorney advertising in some jurisdictions.</em>

https://admin.thompsonhine.com/wp-content/uploads/2025/02/New-York-Refines-Data-Breach-Notification-Rules-for-Covered-Entities.pdf

New York Refines Data Breach Notification Rules for Covered Entities

Services