Global Digital Forensics · Information gathering library · October 18, 2026
Read this guide freely. Choose a download, then share your work email and company or skip.
When you share your details, GDF records the requested resource with your introduction.
Your selected download starts immediately after you share your details or choose Skip.
No marketing subscription is created. Keep completed records in controlled systems.
Find where New York residents information is held and assemble existing safeguards and incident records for a privacy or cybersecurity specialist.
Owners, lawyers, privacy and risk managers, office administrators and client IT
General Business Law 899-aa and 899-bb preparation, with a separate branch for state entities and sector specific obligations. It prepares records for a specialist's review under those specific laws.
PII is a useful broad working label for the first pass. New York statutory private information under 899-aa has a particular definition, while DFS nonpublic information and HIPAA protected health information have different scopes, and a specialist will classify against each definition separately. Inventory the actual fields and the combinations in which they are stored before anyone makes the legal classification, because the classification turns on combinations rather than on field names.
The current 899-aa text reviewed includes medical and health insurance information as well as the specified identifiers, financial access information, biometrics and online credentials. A strong first inventory covers each of those categories and reaches well beyond Social Security and credit card numbers. For owners and licensees, 899-aa(2) uses prompt notice with a 30 day outer limit after discovery, subject to its terms. The maintainers branch in 899-aa(3) calls for immediate notice to the owner or licensee, again with a 30 day limit. These clocks are distinct from the DFS incident and payment clocks, so obtain the dates and the decisions, and counsel makes the notice determination from them.
899-bb has a safeguard compliance route for a person subject to and in compliance with specified regulatory regimes, so the file pairs the regulated status with the evidence of compliance with the named regime, which the specialist will ask to see. Its small business provision tailors safeguards to the business, so a small business gathers the records of the safeguards it keeps. State Technology Law 208 is a separate branch with its own state entity definition and local government provisions, so that branch is built from its own text, with its own definitions, deadlines and recipients. General hospitals, schools, employers, financial firms and government bodies may need additional specialist modules.
Give each request to the suggested owner. Record each answer, including the items awaiting confirmation, in the editable CSV checklist. Keep the records themselves in a secure evidence location agreed with the recipient and use the checklist as the index that points to them; passwords stay with their owners, and real patient data and controlled technical information stay in the secure location.
Records to find
Download the editable gathering checklist. CSV files hold plain records, and your spreadsheet sets the layout. Import as UTF-8, keep IDs as text, wrap text and widen columns before use. Blank client fields are intentional.
NY-R01 Organization and legal context
Ask
Legal or business owner
Gather
Legal entity, ownership/government status, business activities, resident populations and contracts or regulator requests.
Where to ask
Corporate files and business sponsor
Why it may be needed
Routes the facts to the right law and sector.
If missing or uncertain
Ask counsel which regime applies, and mark the branch pending until the answer comes back.
Where information is collected, used, shared, exported, archived, backed up and disposed; devices, tenants, integrations, paper copies and recipient organizations.
Where to ask
Data source atlas, purchasing and application diagrams
Why it may be needed
Looks for extra copies and processors beyond the device list.
If missing or uncertain
Mark each location as a candidate until its owner confirms it.
Access/MFA scope, secure configurations, patch/change history, monitoring coverage, existing test reports and response procedures for the relevant data flows.
Where to ask
Identity, endpoint, application and provider records
Why it may be needed
Lets the consultant assess existing technical safeguards.
If missing or uncertain
Request a scoped explanation of records held elsewhere or by providers; any new testing starts with written authorization.
Download the response template. A useful answer names the actual system, period, supporting record and its coverage. Where the answer sits with someone else, name the person or provider who can give it.
1. What exact information fields and combinations do you hold about New York residents?
Suggested responder
Client IT or system owner
Useful supporting record
Schema and masked examples, including credentials, medical and health insurance fields.
2. Which outside parties hold the same information or additional copies?
Suggested responder
Client IT or system owner
Useful supporting record
Provider list, contracts, tenants, exports and return/deletion terms.
3. What can you say about encryption and who could obtain the decryption keys?
Suggested responder
Client IT or system owner
Useful supporting record
Configuration description and responsible owner.
4. Which safeguards were in operation during the period, rather than added later?
Suggested responder
Client IT or system owner
Useful supporting record
Dated settings, reports, tickets and change history.
5. Are accounts, archives, paper stores or backups outside the main system inventory?
Suggested responder
Client IT or system owner
Useful supporting record
One inventory row for each actual location and owner.
6. If an incident is relevant, what happened, when was each fact learned and which questions are open?
Suggested responder
Client IT or system owner
Useful supporting record
Counsel approved chronology with evidence pointers.
7. What records were already supplied to a regulator, insurer or prior assessor?
Suggested responder
Client IT or system owner
Useful supporting record
Copies, scope and receipts subject to authorized disclosure.
8. Which people can explain a record being traced or a technical constraint?
Suggested responder
Client IT or system owner
Useful supporting record
Contact roster and next action per open item.
Facts to confirm and specialist decisions
These are explicit handoff questions, and each one closes with the specialist's written answer, drawing on the records marked Received. Add client specific questions and a responsible person.
NY-Q01 Which statutory definition and organizational branch apply?
Ask
Counsel and privacy specialist
Gather
Entity status, fields, residents, sector licenses and contracts
Resolution needed
Written scope and definitions for the actual recipient.
NY-Q02 Which additional sector or other state modules are necessary?
Ask
Legal team and specialist
Gather
Business locations, customers, patients, students, contracts and regulator orders
Resolution needed
A named list of additional work for each further state or sector in scope.
The handoff is ready when the data map uses actual fields and repository owners rather than a generic PII label; when the government, DFS and healthcare branches are kept separate; when any active incident has been escalated outside the ordinary preparation schedule; and when the specialist receives a record index, masked examples and explicit scope notes, with the records themselves held in the agreed secure location.
Download the record index. Use the shared walkthrough for custody, restricted records, follow up on open items and receipt steps.
Sources for this package
Official laws/rules establish duties within their scope. Guidance explains programs; NIST supplies methods; vendor documentation describes possible product behavior. The package works alongside the actual contracts, facts, configuration and case orders.
