Read this guide freely. Request download access with your name and email.
GDF records the selected resource in its lead intake and private Stats.
Open your emailed link for seven days of preparation downloads in this browser.
No marketing subscription is created. Keep completed records in controlled systems.
Find where New York residents information is held and assemble existing safeguards and incident records for a privacy or cybersecurity specialist.
Owners, lawyers, privacy and risk managers, office administrators and client IT
General Business Law 899-aa and 899-bb preparation, with a separate branch for state entities and sector-specific obligations. It is not a universal New York privacy certification.
PII is a useful broad working label. New York statutory private information under 899-aa has a particular definition, while DFS nonpublic information and HIPAA protected health information have different scopes. Inventory the actual fields and combinations before the specialist makes the legal classification.
The current 899-aa text reviewed includes medical and health-insurance information as well as specified identifiers, financial-access information, biometrics and online credentials. A checklist based only on Social Security and credit-card numbers can miss relevant data.
For owners/licensees, 899-aa(2) uses prompt notice with a 30-day outer limit after discovery, subject to its terms. The maintainers branch in 899-aa(3) calls for immediate notice to the owner/licensee, with a 30-day limit. These are distinct from DFS incident/payment clocks. Obtain dates and decisions; counsel determines notices.
899-bb has a safeguard-compliance route for a person subject to and in compliance with specified regulatory regimes. Being regulated is not enough by itself. Its small-business provision tailors safeguards to the business; it is not a blanket exclusion.
State Technology Law 208 is a separate branch, with its own state-entity definition and local-government provisions. Do not copy the GBS definitions, deadlines or recipients into that branch. General hospitals, schools, employers, financial firms and government bodies may need additional specialist modules.
Give each request to the suggested owner. Record what is available and what is unknown in the editable CSV checklist. Use a secure evidence location agreed with the recipient; the checklist is an index, not a place for passwords, real patient data or controlled technical information.
Records to find
Download the editable gathering checklist. CSV files contain plain records, without saved column widths or workbook formatting. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
NY-R01 Organization and legal context
Ask
Legal or business owner
Gather
Legal entity, ownership/government status, business activities, resident populations and contracts or regulator requests.
Where to ask
Corporate files and business sponsor
Why it may be needed
Routes the facts to the right law and sector.
If missing or uncertain
Ask counsel which regime applies; keep the branch unresolved.
Where information is collected, used, shared, exported, archived, backed up and disposed; devices, tenants, integrations, paper copies and recipient organizations.
Where to ask
Data-source atlas, purchasing and application diagrams
Why it may be needed
Reveals extra copies and processors that a device list misses.
If missing or uncertain
Mark each unconfirmed location as a candidate, not a fact.
Access/MFA scope, secure configurations, patch/change history, monitoring coverage, existing test reports and response procedures for the relevant data flows.
Where to ask
Identity, endpoint, application and provider records
Why it may be needed
Lets the consultant assess existing technical safeguards.
If missing or uncertain
Request a scoped explanation of missing or outsourced records; no new testing without authorization.
Download the response template. A useful answer names the actual system, period, supporting record and limits. If you do not know, name the person or provider who can answer.
1. What exact information fields and combinations do you hold about New York residents?
Suggested responder
Client IT or system owner
Useful supporting record
Schema and masked examples, including credentials, medical and health-insurance fields.
2. Which outside parties hold the same information or additional copies?
Suggested responder
Client IT or system owner
Useful supporting record
Provider list, contracts, tenants, exports and return/deletion terms.
3. What can you say about encryption and who could obtain the decryption keys?
Suggested responder
Client IT or system owner
Useful supporting record
Configuration description and responsible owner; do not attach keys.
4. Which safeguards were in operation during the period, rather than added later?
Suggested responder
Client IT or system owner
Useful supporting record
Dated settings, reports, tickets and change history.
5. Are accounts, archives, paper stores or backups outside the main system inventory?
Suggested responder
Client IT or system owner
Useful supporting record
One inventory row for each actual location and owner.
6. If an incident is relevant, what happened, when was each fact learned and what remains uncertain?
Suggested responder
Client IT or system owner
Useful supporting record
Counsel-approved chronology with evidence pointers.
7. What records were already supplied to a regulator, insurer or prior assessor?
Suggested responder
Client IT or system owner
Useful supporting record
Copies, scope and receipts subject to authorized disclosure.
8. Which people can explain a missing record or technical limitation?
Suggested responder
Client IT or system owner
Useful supporting record
Contact roster and next action per gap.
Missing facts and specialist decisions
These are explicit handoff questions. Marking records Received does not resolve them. Add client-specific questions and a responsible person.
NY-Q01 Which statutory definition and organizational branch apply?
Ask
Counsel and privacy specialist
Gather
Entity status, fields, residents, sector licenses and contracts
Resolution needed
Written scope and definitions for the actual recipient; do not generalize GBS to every public body.
NY-Q02 Which additional sector or other-state modules are necessary?
Ask
Counsel and specialist
Gather
Business locations, customers, patients, students, contracts and regulator orders
Resolution needed
A named list of additional work; this first edition does not complete every state or sector.
Data map uses actual fields and repository owners rather than a generic PII label.
Government, DFS and healthcare branches remain separate.
An active incident is escalated outside the ordinary preparation schedule.
Specialist receives a record index, masked examples and explicit limitations.
Download the record index. Use the shared walkthrough for custody, restricted records, missing information and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. Actual contracts, facts, configuration and case orders still matter.
