New York SHIELD Act
Since March 2020, any business that owns or licenses private information on New York residents must maintain reasonable data safeguards and follow state breach-notification rules. Small businesses (fewer than 50 employees, or below set revenue or asset levels) can scale safeguards to their size. Your attorney confirms whether it applies to you.