1. Lock the Discovery Date before the Notice Deadline
GBL § 899-aa requires notice to affected residents without unreasonable delay and within 30 days after discovery. Notice may be delayed if law enforcement finds that notice would impede a criminal investigation.
Confirm Whether the Incident Triggers Notice
| Issue | Defense Question |
|---|---|
| Data involved | Does it meet the definition of private information? |
| Access or acquisition | What evidence shows unauthorized access or acquisition? |
| Discovery date | When did the company discover the breach? |
| Notice | Were the required notices timely and complete? |
Data involved
- Defense QuestionDoes it meet the definition of private information?
Access or acquisition
- Defense QuestionWhat evidence shows unauthorized access or acquisition?
Discovery date
- Defense QuestionWhen did the company discover the breach?
Notice
- Defense QuestionWere the required notices timely and complete?
Document a Decision Not to Notify
An inadvertent disclosure by an authorized person may qualify for an exception when the statutory harm assessment supports that conclusion.
- Document the determination in writing and retain it for at least five years.
- If the incident affects more than 500 residents, provide the determination to the Attorney General within 10 days.
- Keep the facts, affected data types, and decision date with the incident record.
2. Build a Notification Record That Can Survive Review
When resident notice is required, § 899-aa also requires agency notifications about timing, content, distribution, and the approximate number affected. Those filings should closely match the facts known at the time and should not delay resident notice.
Keep Resident and Agency Notices Consistent
A Cybersecurity and Data Privacy review can help organize overlapping duties.
- Prepare resident notice with the required contact information and affected data categories.
- Make the required filings with the Attorney General, Department of State, and Division of State Police.
- If more than 5,000 residents receive notice at one time, address the consumer reporting agency requirement.
Separate the 30-Day and 72-Hour Rules
The 72-hour rule is not the general resident-notice deadline. A Part 500 covered entity has a separate DFS duty after determining that a reportable cybersecurity incident has occurred.
| Rule | Trigger | Deadline |
|---|---|---|
| GBL § 899-aa | Covered breach affecting residents | Within 30 days after discovery, subject to law-enforcement delay |
| 23 NYCRR § 500.17 | Reportable incident for a covered entity | No later than 72 hours after determination |
GBL § 899-aa
- TriggerCovered breach affecting residents
- DeadlineWithin 30 days after discovery, subject to law-enforcement delay
23 NYCRR § 500.17
- TriggerReportable incident for a covered entity
- DeadlineNo later than 72 hours after determination
3. Keep Forensic Work Tied to the Notice Decision
Forensic work may later matter to regulators and plaintiffs. Attorney involvement does not automatically make routine technical work privileged, so legal and operational tasks should be kept distinct.
Give the Forensic Team a Focused Assignment
- Identify the intrusion path, affected systems, data categories, and key dates.
- Preserve logs and evidence that support the full notice analysis.
- Record when findings change so each notice can be tied to the facts known when the company made its decision.
Treat Privilege As a Legal Issue, Not a Label
Data Breach Litigation may develop while technical work is still underway.
- Define when forensic work assists attorneys in giving legal advice.
- Limit unnecessary circulation of legal communications and attorney work product.
- Do not assume that copying an attorney on a technical email creates privilege.
4. Prepare for a Regulatory Inquiry from the Existing Record
A regulator may test the discovery date, notice timing, data affected, and consistency of the company's explanations. Section 899-aa permits Attorney General enforcement, so the response should begin with records created before the inquiry arrived.
Reconstruct the Timeline before Responding
A Regulatory Investigations review may help frame a response to formal agency process.
- Map key detection, discovery, forensic milestones, notice decisions, and filings.
- Match factual statements to logs, emails, tickets, and approved notices.
- Identify gaps or changed findings before sending a regulatory response.
Keep Regulatory and Litigation Positions Aligned
- Keep factual descriptions consistent across agency responses, public statements, and court filings.
- Avoid describing disputed access, acquisition, causation, or harm as established fact.
- Preserve available privilege and objections rather than producing protected material reflexively.
5. Keep Private Claims Separate from the Notice Defense
Notification defense and private litigation can overlap, but they ask different questions. A lawsuit may proceed in state or federal court depending on the claims, parties, and jurisdictional basis. The notice record may later become evidence.
Preserve Defenses That Depend on the Breach Record
Cybersecurity Class Action issues may arise after notice.
- Keep evidence showing what information was actually accessed or acquired.
- Preserve notice, mitigation, and affected-person communication records.
- Separate security allegations from proof of injury, causation, and damages.
Do Not Assume the Forum from the Number of Plaintiffs
- Multiple plaintiffs alone do not create federal jurisdiction.
- Federal jurisdiction requires an independent basis, such as federal-question, diversity, or applicable class-action jurisdiction.
- Commercial Division assignment depends on the case category and procedural requirements.
6. Frequently Asked Questions
Can a company wait for its forensic investigation to finish before sending notice?
Not simply because technical work continues. Section 899-aa requires notice without unreasonable delay and within 30 days after discovery, subject to its law-enforcement delay provision.
Does a vendor breach create notification duties for the company?
It can. The answer depends on who owns or licenses the affected information and each party's role. A business maintaining covered data for another entity also must notify the owner or licensee after discovery.
Is another Attorney General notice required after a HIPAA breach report to HHS?
For a covered entity subject to § 899-aa(9), yes. The required Attorney General notice is due within five business days after notifying the HHS Secretary.
Does reporting a breach mean the company admits liability?
No. Required notification does not by itself resolve negligence, causation, damages, standing, or other disputed issues in later litigation.
7. Prepare the Record before the Regulator Defines It
A data breach notification defense attorney in Manhattan can connect the discovery timeline, forensic evidence, notices, and regulatory response. SJKP's attorneys can review the notification record, preserve available defenses, and coordinate regulatory and litigation work without turning developing facts into unsupported admissions.
11 Sep, 2026
