Stop Hacks and Improve Electronic Data Security (SHIELD) Act, Attorney General enforcement

N.Y. Gen. Bus. Law §§ 899-aa(6), 899-bb(2)(d)-(2)(e)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 23 October 2019.

An enforcement supervision rule binding private bodies.

As of 27 August 2026.

What it requires

Expect SHIELD Act violations, for both the breach notification duty and the data security program duty, to be enforced exclusively by the New York Attorney General, never by a private plaintiff.
Expect the Attorney General to seek an injunction and, for a failure to notify, actual costs, plus for a knowing or reckless violation a civil penalty of the greater of $5,000 or $20 per instance of failed notification, capped at $250,000.
Expect a data-security-program violation to be treated as a violation of General Business Law section 349, letting the Attorney General seek an injunction and civil penalties on that separate basis.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Attorney General may bring an action to enjoin and restrain a violation of SHIELD's breach-notification duty, and a court may award actual costs for a failure to notify and, for a knowing or reckless violation, a civil penalty of the greater of $5,000 or up to $20 per instance of failed notification, capped at $250,000; a three-year limitations period runs from Attorney General discovery or notice, extendable to six years if the breach was concealed.

A violation of the separate data-security-program duty is deemed a violation of General Business Law section 349, letting the Attorney General bring an action to enjoin it and obtain civil penalties on that basis.

Section 899-bb expressly bars a private right of action for the safeguards duty, and section 899-aa carries no comparable express bar in its own text, but its enforcement subdivision is written entirely in terms of Attorney General authority, with no private-suit provision found anywhere in that section. Neither half of SHIELD arms a private plaintiff.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official New York statute text, N.Y. General Business Law, New York State Senate

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app