New York's own guidance still leaves out its 30-day deadline
2026-11-01
New York changed its breach law in late 2024. Businesses now have a hard limit for telling affected residents:
within thirty days after the breach has been discovered
Source: https://legislation.nysenate.gov/pdf/bills/2023/S2659B. Read 2026-11-01.
You wouldn't know that from the attorney general's SHIELD Act page, which is where many businesses would look first. It describes the older standard, "the most expedient time possible, consistent with legitimate needs of law enforcement agencies", and gives no number of days for telling residents.
At least one 2026 guide has the same gap, listing New York as "Without unreasonable delay".
Official isn't the same as current
This is the hard part about checking sources. We'd normally trust a state's own page over a law firm's blog, and usually that's right. But a page can be official and out of date at once, and it still looks authoritative.
It's why our rule is the newest official text we can open, not just any official page, and why each value shows the day it was read.
This isn't legal advice: check the source, and ask a lawyer before you rely on it.