New York Private Information Preparation Package
Find where New York residents' private information is held and assemble the safeguard and incident records a privacy or cybersecurity specialist will review.
Edition 2026-11-03 | November 3, 2026
Who uses it: Owners, counsel, privacy and risk managers, office administrators and client IT.
Scope: New York General Business Law 899-aa (breach notice) and 899-bb (safeguards), with a separate branch for state entities under State Technology Law 208 and for sector rules such as the DFS and hospital regulations.
Package 02: New York private information
Find where New York residents' private information is held and assemble the safeguard and incident records a privacy or cybersecurity specialist will review. Who uses it: Owners, counsel, privacy and risk managers, office administrators and client IT. Scope: New York General Business Law 899-aa (breach notice) and 899-bb (safeguards), with a separate branch for state entities under State Technology Law 208 and for sector rules such as the DFS and hospital regulations.
Before you gather
Inventory actual fields, not labels. PII is a useful working term, but private information under GBL 899-aa has its own definition, and DFS nonpublic information and HIPAA protected health information have different scopes. The current 899-aa definition reaches beyond Social Security and card numbers to biometric information, online account credentials, medical information and health insurance information, so a checklist built only on identification numbers will miss records.
Record the times that start the notice clocks. Notice to affected New York residents must be made in the most expedient time possible and without unreasonable delay, and within 30 days after the breach has been discovered, subject to the law enforcement provision (GBL 899-aa(2), as revised March 28, 2025). A business that maintains data on behalf of its owner must notify the owner or licensee immediately, and within 30 days following discovery (899-aa(3)). When the business is a DFS covered entity, notice also goes to the Department of Financial Services under 23 NYCRR 500.17, without delaying notice to residents (899-aa(8)). These clocks are separate from the DFS incident and payment clocks in package 01.
Gather the safeguard records, not only the policies. GBL 899-bb requires reasonable administrative, technical and physical safeguards. A business that is subject to, and in compliance with, Gramm Leach Bliley regulations, HIPAA and HITECH, 23 NYCRR Part 500 or similar data security rules is treated as compliant, so collect the records that show that compliance. A small business meets the duty with safeguards appropriate for its size and complexity (899-bb(2)(c)).
Keep the state entity branch separate. State entities follow State Technology Law 208, with its own definitions, deadlines and recipients. Hospitals, schools, employers, financial firms and government bodies may need an added module.
Using the worksheets
Give each request to its suggested owner and record each response, including any gap, in Gathering-checklist.csv. Point to records held in the approved evidence location, where passwords, real patient data and controlled technical information stay.
New York private information: records to find
Each request below matches a row in Gathering-checklist.csv. Record the response, status and record IDs there.
NY-R01 Organization and legal context
Ask: Legal or business owner.
Gather: Legal entity, ownership or government status, business activities, resident populations and contracts or regulator requests.
Where to ask: Corporate files and business sponsor.
Why it matters: Routes the facts to the right law and sector.
If missing or uncertain: Ask counsel which regime applies; keep the branch unresolved.
Sources: NY01 2; NY02 2; NY03 1(c), 10
NY-R02 Data field and combination inventory
Ask: Business process owners.
Gather: Field names and masked samples; people concerned; purpose; volumes; residence facts; data combinations; encryption and key exposure facts.
Where to ask: HR, payroll, customer, financial and medical systems.
Why it matters: Supports classification without collecting real identifiers in the checklist.
If missing or uncertain: Name the owner who can supply a schema or masked example; no guessed counts.
Sources: NY01 1; NY02 1; DFS01 500.1(k)
NY-R03 Information journey
Ask: IT and business owners.
Gather: Where information is collected, used, shared, exported, archived, backed up and disposed; devices, tenants, integrations, paper copies and recipient organizations.
Where to ask: Data source atlas, purchasing and application diagrams.
Why it matters: Reveals extra copies and processors that a device list misses.
If missing or uncertain: Mark each unconfirmed location as a candidate until its owner confirms it.
Sources: NY02 2(b)
NY-R04 Responsibility and risk records
Ask: Management and security lead.
Gather: Program coordinator, risk assessments, decisions, policy set and business changes since last review.
Where to ask: Policy and risk systems.
Why it matters: Organizes administrative safeguard records for the recipient.
If missing or uncertain: Name the person who may have records so the specialist can follow up.
Sources: NY02 2(b)(ii)(A)
NY-R05 Personnel and supplier safeguards
Ask: HR and procurement.
Gather: Training records, confidentiality or access procedures, provider list, selection reviews, contracts requiring safeguards and change or reassessment records.
Where to ask: HR, procurement, provider agreements.
Why it matters: Supplies the actual administrative and provider arrangements.
If missing or uncertain: Request actual signed terms and records for the period rather than a sales brochure.
Sources: NY02 2(b)(ii)(A)
NY-R06 Technical protection records
Ask: IT and service providers.
Gather: Access or MFA scope, secure configurations, patch or change history, monitoring coverage, existing test reports and response procedures for the relevant data flows.
Where to ask: Identity, endpoint, application and provider records.
Why it matters: Lets the consultant assess existing technical safeguards.
If missing or uncertain: Request a scoped explanation of missing or outsourced records; any new testing runs under written authorization.
Sources: NY02 2(b)(ii)(B)
NY-R07 Physical records and disposal
Ask: Facilities and records manager.
Gather: Storage, transport and visitor procedures; cabinet or media controls; retention schedules; destruction certificates and holds that prevent disposal.
Where to ask: Facilities, offsite storage and media vendor.
Why it matters: Includes paper, portable media and disposal, not only cloud security.
If missing or uncertain: Identify storage sites and providers not yet contacted.
Sources: NY02 2(b)(ii)(C)
NY-R08 Incident facts and chronology
Ask: Counsel and incident owner.
Gather: Discovery, detection or determination timestamps, system events, affected fields, persons or residences, access versus acquisition evidence, encryption or key facts and provider notice.
Where to ask: Restricted incident file.
Why it matters: GBL 899-aa(2) requires notice to affected residents within 30 days after discovery; accurate times let counsel apply that clock.
If missing or uncertain: Escalate live matters; label suspected facts and dates as unconfirmed.
Sources: NY01 1(c), 2, 3; NY03
NY-R09 Notification and decision file
Ask: Counsel and compliance.
Gather: Notice decisions and basis, templates, dates or recipients, agency receipts, any law enforcement delay determination and updates.
Where to ask: Counsel and incident correspondence.
Why it matters: Allows review of actual actions and applicable branches.
If missing or uncertain: Keep legal advice segregated; provide counsel approved factual chronology and privilege handling instructions.
Sources: NY01 2, 4, 7, 8, 9
NY-R10 Regulated entity or size support
Ask: Finance and legal.
Gather: Other applicable security regimes, actual compliance records relied on, small business facts and the prior determination.
Where to ask: Legal, finance and other assessment files.
Why it matters: Supports the 899-bb provision for regulated entities with the records the specialist reviews for compliance.
If missing or uncertain: Send the available facts and the proposed basis to the specialist.
Sources: NY02 1 and 2(b)-(c)
NY-R11 Government and sector routing
Ask: Legal or privacy lead.
Gather: State or local status, governmental policy, actual healthcare, school or financial licenses, contractual requirements and regulator orders.
Where to ask: Legal records and sector owner.
Why it matters: Identifies which specialist should add a tailored module. Read the hospital regulation itself, not only the guidance.
If missing or uncertain: Obtain the current text of 10 NYCRR 405.46 before building a hospital requirement list.
Sources: NY03; NY04; HE01; DFS01
NY-R12 Gaps and transmittal
Ask: Coordinator.
Gather: Completed source inventory, request responses, periods not covered, access restrictions and named follow up owners.
Where to ask: Coordinator and receiving specialist.
Why it matters: Gives the specialist a clear handoff.
If missing or uncertain: Keep Unknown or Partially received visible; ask recipient which gap is first priority.
Sources: NY02
New York private information: questions for IT and system owners
A useful answer names the actual system, period, supporting record and limits. Where someone else holds the answer, record who can give it. The same questions are in IT-and-owner-questions.csv.
| No. | Question | Suggested responder | Supporting record |
|---|---|---|---|
| 1 | What exact information fields and combinations do you hold about New York residents? | Client IT or system owner | Schema and masked examples, including credentials, medical and health insurance fields. |
| 2 | Which outside parties hold the same information or additional copies? | Client IT or system owner | Provider list, contracts, tenants, exports and return or deletion terms. |
| 3 | What can you say about encryption and who could obtain the decryption keys? | Client IT or system owner | Configuration description and responsible owner, with keys kept in their secure store. |
| 4 | Which safeguards were in operation during the period, rather than added later? | Client IT or system owner | Dated settings, reports, tickets and change history. |
| 5 | Are accounts, archives, paper stores or backups outside the main system inventory? | Client IT or system owner | One inventory row for each actual location and owner. |
| 6 | If an incident is relevant, what happened, when was each fact learned and what is still uncertain? | Client IT or system owner | Counsel approved chronology with evidence pointers. |
| 7 | What records were already supplied to a regulator, insurer or prior assessor? | Client IT or system owner | Copies, scope and receipts subject to authorized disclosure. |
| 8 | Which people can explain a missing record or technical limitation? | Client IT or system owner | Contact roster and next action per gap. |
New York private information: decisions and handoff
These decisions belong to counsel or the receiving specialist. Each stays open until its owner records a decision. Add questions specific to the client and a responsible person in Open-questions.csv.
Preparing the handoff
The handoff is ready when the data map uses actual fields and repository owners rather than a generic PII label; the government, DFS and healthcare branches stay separate; an active incident has gone to counsel outside the ordinary schedule; and the specialist has a record index, masked examples and a list of what is still missing.
Use Record-index.csv for one row per file or defined record set, and follow the walkthrough in the library for custody, restricted records and receipt.
| ID | Decision | Decision owner | Information needed | Closed by |
|---|---|---|---|---|
| NY-Q01 | Which statutory definition and organizational branch apply? | Counsel and privacy specialist | Entity status, fields, residents, sector licenses and contracts | Written scope and definitions; state entities follow State Technology Law 208 separately. |
| NY-Q02 | Which additional sector or other state modules are necessary? | Counsel and specialist | Business locations, customers, patients, students, contracts and regulator orders | A named list of the additional state or sector modules needed. |
Sources for this package
Laws and regulations set duties within their scope; agency guidance explains how they are applied; NIST supplies methods; vendor documentation describes how a product can behave. The full list is in Source-register.csv.
NY01 New York General Business Law 899-aa. State statutory text. 1 definitions; 2 and 3 notice; 8 agencies; 9 HIPAA notice. https://www.nysenate.gov/legislation/laws/GBS/899-AA
NY02 New York General Business Law 899-bb. State statutory text. 1 regulated entities and small business; 2 safeguards. https://www.nysenate.gov/legislation/laws/GBS/899-BB
NY03 New York State Technology Law 208. State statutory text. Breach notice regime for state entities. https://www.nysenate.gov/legislation/laws/STT/208
DFS01 DFS final adopted second amendment to Part 500. Adopted regulatory text. 500.1 through 500.24 as amended November 1, 2023; read the amendment markup carefully. https://www.dfs.ny.gov/industry_guidance/regulations/final_adoptions_fs/rf_fs_2amend23nycrr500_text_20231101
NY04 New York hospital cybersecurity rule. Agency regulatory text. 10 NYCRR 405.46; general hospitals only. https://regs.health.ny.gov/content/section-40546-hospital-cybersecurity-requirements
HE01 HIPAA Security Rule. Federal regulatory compilation. 164.308(a)(1), 164.312(b) and 164.316. https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C
DFS07 23 NYCRR 500.12 and 500.17 (Cornell LII text). Regulatory text. 500.12(a) multifactor authentication; 500.17(a)(1) 72 hour notice, 500.17(b) April 15 filing, 500.17(c) extortion payment notice. https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.17
Talk to a senior examiner
Get a free consultation. The initial consultation is free, and requests are handled in confidence.
Call (800) 868-8189 at any hour, or write to info@evestigate.com.
Request a consultation online at evestigate.com/contact.
© 2026 Global Digital Forensics, Inc. All rights reserved.