Bill > A08101

This bill establishes the New York Data Protection Act, which creates comprehensive regulations for how government entities and contractors handle personal information of New York state residents. The bill defines personal information broadly, including identifiers like names, addresses, social security numbers, and various categories of personal data, and gives individuals several key rights. These rights include the ability to request disclosure of what personal information has been collected about them, request deletion of their personal information, and be informed about how their data is collected and shared. Government entities and contractors must provide at least two methods for individuals to submit information requests, respond to these requests within 45 days, and are limited in how they can share or sell personal information. The bill also prohibits discrimination against individuals who exercise these data privacy rights and includes provisions to protect sensitive information. Importantly, the law includes some limitations, such as allowing government entities to comply with legal investigations and not requiring the retention of one-time transaction data. The bill will take effect one year after becoming law, giving government entities and contractors time to prepare for the new requirements. While the bill provides robust data protection mechanisms, it does not create a private right of action for individuals, meaning enforcement would primarily be through the Attorney General's office.

Government Affairs

https://www.nysenate.gov/legislation/bills/2025/A8101