---
title: Are You SHIELD Compliant?
description: Are you compliant with the New York State SHIELD Act?  Here's how to get in line, protect your customer data, and to avoid penalties.
image: https://info.bitxbit.com/hubfs/new-york-shield-act-comes-into-focus-for-businesses-showcase_image-7-a-13564.jpg
---

# Are You SHIELD Compliant?

 March 20th, 2020 [Eleanor Boschert](https://info.bitxbit.com/blog/author/eleanor-boschert)

![new-york-shield-act-comes-into-focus-for-businesses-showcase_image-7-a-13564](https://info.bitxbit.com/hs-fs/hubfs/new-york-shield-act-comes-into-focus-for-businesses-showcase_image-7-a-13564.jpg?width=417&name=new-york-shield-act-comes-into-focus-for-businesses-showcase_image-7-a-13564.jpg)

***The New York State SHIELD Act is in place. Are you compliant?  If not, there will be fiscal penalties, so here's what you need to know to meet requirements. ***

At our webinar in January, [**Bit by Bit**](https://www.bitxbit.com/?utm_campaign=SHIELD%20Act%20Cybersecurity%202020&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_8xWfv6WS3_3Wrw6uQDiJkWFqjHDbxSti-f8-AKPl_X1CNIFV9df3d7oOLbe0oXkrIZyvB) and [**Arctic Wolf**](https://arcticwolf.com/?utm_campaign=SHIELD%20Act%20Cybersecurity%202020&utm_source=hs_email&utm_medium=email&_hsenc=p2ANqtz-_8xWfv6WS3_3Wrw6uQDiJkWFqjHDbxSti-f8-AKPl_X1CNIFV9df3d7oOLbe0oXkrIZyvB) brought you up to speed on the recently-passed New York state SHIELD Act that strengthens protection against data breaches affecting private information.  It imposes more expansive data security and updates data breach notification requirements.

Here's what is considered **private information** and the **new definition of a breach:**

- Personal information + private information, or
- Credit/debit card information, with or without identifying information, or
- Username/email + password/security question

In the event of a breach,  if you notify according to the Gramm-Leach-Bliley Act, HIPAA or the HITECH Act, the NY Department of Financial Services Cybersecurity Regulation, the SHIELD Act does not require additional notice.  But you will still have to notify the NY Attorney General, the NY Department of State, and NY State Police.

You'll also need to adopt safeguards for information security, confidentiality, and integrity while implementing a data security program encompassing:

- Risk assessments
- Employee training
- Vendor contracts
- Timely data disposal

These fall into these categories:

**Administrative Safeguards:**

- Dedicated cybersecurity staff
- Identify internal / external risks
- Assess sufficiency of safeguards
- Train employees on security
- Third party vendor management

**Technical Safeguards:**

- Risk Assessment
- Prevention
- Detection & Response

**Physical Safeguards:**

- Information Storage/Disposal
- Unauthorized Access
- Data Destruction

** Read more about the SHIELD Act here:**

[![National Law Review](https://info.bitxbit.com/hs-fs/hubfs/National%20Law%20Review.png?width=206&name=National%20Law%20Review.png)](https://www.natlawreview.com/article/new-york-shield-act-faqs)

**If you are scrambling to make sure you are compliant, just ask us.  We can help!**

[![Contact Us Now](https://no-cache.hubspot.com/cta/default/4331745/726df234-f89f-4df8-a6c5-5d300d16f08d.png)](https://cta-redirect.hubspot.com/cta/redirect/4331745/726df234-f89f-4df8-a6c5-5d300d16f08d)

 

 

 

- [← Older](https://info.bitxbit.com/blog/email-vs-fax)
- [Next →](https://info.bitxbit.com/blog/five-signs-you-need-to-outsource-your-it)

### Recent Posts