Licensing company data in New York: SHIELD, monitoring notices and no privacy act
New York has not enacted a comprehensive consumer privacy law. What it has is a data security law that applies to every business holding a New Yorker’s private information, and an employer notice rule that matters for anyone thinking of licensing staff email. Those two carry most of the weight for a New York company.
Where New York stands
The Attorney General’s SHIELD Act page lists the safeguards: naming staff to run the security program, testing key controls and securely destroying data once the business no longer needs it.
| Question | Answer as of 2 November 2026 |
|---|---|
| Comprehensive privacy law | No. It is not on the list of enacted state laws kept by the tracker we checked on 2 November 2026. |
| SHIELD Act | Signed 25 July 2019. It applies to any person or business that holds private information of New York residents, wherever the business is based. |
| What counts as private information | Under the amended breach law it includes biometric data, usernames or email addresses with passwords, and the older categories such as Social Security and account numbers. |
| Who enforces | The Attorney General. |
Destroying data you no longer need
The disposal duty cuts two ways for a closing company. Old private information has to be destroyed securely when it is no longer needed, and a licensing deal is a reason to keep a copy. The way through is to license a de-identified copy and destroy the original, with the destruction logged.
Penalties are civil: up to 20 dollars per failed notification, capped, and up to 5,000 dollars per violation of the safeguards duty. The Attorney General can also seek an injunction.
Monitoring notices for staff email
New York Civil Rights Law section 52-c requires employers that monitor staff email, phone or internet use to give written notice when they hire and to post it. An archive of employee email in New York is therefore a record of monitored communication. A company that wants to license it should confirm the notice was given, because the rule shapes what staff expected about their messages.
Bills to watch
New York has had several comprehensive privacy bills in the legislature and has not passed one. That can change, and the sheet behind this page carries the date it was last checked.
Read next
- United States rules. The federal laws behind every state.
- Other states. What each state adds.
- De-identification. How personal detail comes out.
- Liability. Who answers for what in a deal.
Questions about licensing company data in New York: SHIELD, monitoring notices and no privacy act
Is New York without a privacy law?
Without a comprehensive consumer act. The SHIELD Act, the breach law, the monitoring notice rule and federal law all apply.
Does SHIELD apply to a company based outside New York?
Yes, if it holds private information of New York residents.
Can we license employee email?
Only after de-identification and a check that the monitoring notice was given, since the notice shaped what staff expected.
Didn't find your question? Ask us directly.