Skip to main content
  • Foundation
  • Executive network
  • CEO Circle
  • SHRM Business
  • Linkage Logo
  • Store
  • Sign In
  • Account
    • My Account
    • Logout
    • Global
    • India
    • MENA
SHRM
About
Book a Speaker
Join Today
Renew
Rejoin Now
Renew
  • Membership
  • Certification
    Certification

    Smiling asian student studying in library with laptop books doing online research for coursework, making notes for essay homework assignment, online education e-learning concept
    Get Certified!

    Be recognized as an HR leader with your SHRM-CP or SHRM-SCP credential.

    • How to Get Certified

      Demonstrate your ability to apply HR principles to real-life situations. No other HR certification compares.

      • How to Get Certified
      • Eligibility Criteria
      • Exam Details and Fees
      • SHRM-CP
      • SHRM-SCP
      • Which Certification is Best for Me
      • Certification FAQs
    • Prepare for the Exam

      Give yourself the best chance to pass your SHRM certification exam.

      • Exam Preparation
      • SHRM BASK
      • SHRM Learning System
      • Instructor-Led Learning
      • Self-Study
      • Study Aids & Add-ons
    • Recertification

      Recertify your SHRM Credentials before your end date!

      • Specialty Credentials
      • Qualifications
      Certification Portal
  • Topics & Tools
    Topics & Tools

    Stay up to date with workplace news and leverage our vast library of resources to streamline day-to-day HR tasks.

    The white house in washington, dc.
    Executive Order Impact Zone

    Do not abandon, but evaluate and evolve. It is about legal, equal opportunity for all.

    • News & Trends

      Follow breaking news and emerging workplace trends.

      Legal & Compliance

      Stay informed on workplace legal updates and their impacts.

      From the Workplace

      Explore diverse perspectives from your peers on today's workplaces.

      Flagships

      Get curated collections of podcasts, videos, articles, and more produced by SHRM.

    • HR Topics
      • AI in the Workplace
      • Civility at Work
      • Compensation & Benefits
      • Inclusion & Diversity
      • Talent Acquisition
      • Workplace Technology
      • Workplace Violence Prevention
      SEE ALL
      SHRM Research
    • Tools & Samples

      Access member resources and tools to streamline HR tasks.

      • Forms & Checklists
      • How-To Guides
      • Interactive Tools
      • Job Descriptions
      • Policies
      • Toolkits
      SEE ALL
      Ask an Advisor
  • Events & Education
    Events & Education

    SHRM25 in San Diego, June 29 - July 2, 2025
    Join us for SHRM25 in San Diego

    Register for the World’s Largest HR Conference being held on June 29 - July 2, 2025

    • Events
      • SHRM25
      • The AI+HI Project 2025
      • INCLUSION 2025
      • Talent 2026
      • Linkage Institute 2025
      SEE ALL
      Webinars
    • Educational Programs

      Designed and delivered by HR experts to empower you with the knowledge and tools you need to drive lasting change in the workplace.

      Specialty Credentials

      Demonstrate targeted competence and enhance credibility among peers and employers.

      Qualifications

      Gain a deeper understanding and develop critical skills.

    • Team Training & Development

      Customized training programs unique to your organization’s needs.

  • Business Solutions
  • Advocacy
    Advocacy

    Make your voice heard on public policy issues impacting the workplace.

    Advocacy
    SHRM's President & CEO testifies to Congress on "The State of American Education"
    • Policy Areas
      • Workforce Development
      • Workplace Inclusion
      • Workplace Flexibility & Leave
      • Workplace Governance
      • Workplace Health Care
      • Workplace Immigration
      State Affairs

      SHRM advances policy solutions in state legislatures nationwide.

      Global Policy

      SHRM is the go-to for global HR leaders and businesses on workplace matters.

    • Advocacy Team (A-Team)

      SHRM’s A-Team is a key member benefit, giving you the tools, insights, and opportunities to shape workplace policy and drive real impact.

      Take Action

      Urge lawmakers to support policies that create lasting, positive change.

      Advocacy & Legislative Resources

      Access SHRM’s curated policy materials and content.

    • SHRM-Led Coalitions
      • Generation Cares
      • The Section 127 Coalition
      • Learn More & Partner with SHRM Government Affairs
  • Community
    Community

    Woman raising hand in group
    Find a SHRM Chapter

    Easily find a local professional or student chapter in your area.

    • Chapters

      Find local connections from over 607 chapters and state councils and create your personalized HR network.

      SHRM Connect

      Post polls, get crowdsourced answers to your questions and network with other HR professionals online.

      SHRM Northern California

      Join SHRM members in the greater San Francisco Bay area for local events and networking.

    • Membership Councils

      Learn about SHRM's five regional councils and the Membership Advisory Council (MAC).

      • Membership Advisory Council
      • Regional Councils
    • Volunteers

      Learn about volunteer opportunities with SHRM.

      • Volunteer Leader Resource Center
Close
  • Membership
  • Certification
    back
    Certification
    Smiling asian student studying in library with laptop books doing online research for coursework, making notes for essay homework assignment, online education e-learning concept
    Get Certified!

    Be recognized as an HR leader with your SHRM-CP or SHRM-SCP credential.

    • How to Get Certified

      Demonstrate your ability to apply HR principles to real-life situations. No other HR certification compares.

      • How to Get Certified
      • Eligibility Criteria
      • Exam Details and Fees
      • SHRM-CP
      • SHRM-SCP
      • Which Certification is Best for Me
      • Certification FAQs
    • Prepare for the Exam

      Give yourself the best chance to pass your SHRM certification exam.

      • Exam Preparation
      • SHRM BASK
      • SHRM Learning System
      • Instructor-Led Learning
      • Self-Study
      • Study Aids & Add-ons
    • Recertification

      Recertify your SHRM Credentials before your end date!

      • Specialty Credentials
      • Qualifications
      Certification Portal
  • Topics & Tools
    back
    Topics & Tools

    Stay up to date with workplace news and leverage our vast library of resources to streamline day-to-day HR tasks.

    The white house in washington, dc.
    Executive Order Impact Zone

    Do not abandon, but evaluate and evolve. It is about legal, equal opportunity for all.

    • News & Trends

      Follow breaking news and emerging workplace trends.

      Legal & Compliance

      Stay informed on workplace legal updates and their impacts.

      From the Workplace

      Explore diverse perspectives from your peers on today's workplaces.

      Flagships

      Get curated collections of podcasts, videos, articles, and more produced by SHRM.

    • HR Topics
      • AI in the Workplace
      • Civility at Work
      • Compensation & Benefits
      • Inclusion & Diversity
      • Talent Acquisition
      • Workplace Technology
      • Workplace Violence Prevention
      SEE ALL
      SHRM Research
    • Tools & Samples

      Access member resources and tools to streamline HR tasks.

      • Forms & Checklists
      • How-To Guides
      • Interactive Tools
      • Job Descriptions
      • Policies
      • Toolkits
      SEE ALL
      Ask an Advisor
  • Events & Education
    back
    Events & Education
    SHRM25 in San Diego, June 29 - July 2, 2025
    Join us for SHRM25 in San Diego

    Register for the World’s Largest HR Conference being held on June 29 - July 2, 2025

    • Events
      • SHRM25
      • The AI+HI Project 2025
      • INCLUSION 2025
      • Talent 2026
      • Linkage Institute 2025
      SEE ALL
      Webinars
    • Educational Programs

      Designed and delivered by HR experts to empower you with the knowledge and tools you need to drive lasting change in the workplace.

      Specialty Credentials

      Demonstrate targeted competence and enhance credibility among peers and employers.

      Qualifications

      Gain a deeper understanding and develop critical skills.

    • Team Training & Development

      Customized training programs unique to your organization’s needs.

  • Business Solutions
  • Advocacy
    back
    Advocacy

    Make your voice heard on public policy issues impacting the workplace.

    Advocacy
    SHRM's President & CEO testifies to Congress on "The State of American Education"
    • Policy Areas
      • Workforce Development
      • Workplace Inclusion
      • Workplace Flexibility & Leave
      • Workplace Governance
      • Workplace Health Care
      • Workplace Immigration
      State Affairs

      SHRM advances policy solutions in state legislatures nationwide.

      Global Policy

      SHRM is the go-to for global HR leaders and businesses on workplace matters.

    • Advocacy Team (A-Team)

      SHRM’s A-Team is a key member benefit, giving you the tools, insights, and opportunities to shape workplace policy and drive real impact.

      Take Action

      Urge lawmakers to support policies that create lasting, positive change.

      Advocacy & Legislative Resources

      Access SHRM’s curated policy materials and content.

    • SHRM-Led Coalitions
      • Generation Cares
      • The Section 127 Coalition
      • Learn More & Partner with SHRM Government Affairs
  • Community
    back
    Community
    Woman raising hand in group
    Find a SHRM Chapter

    Easily find a local professional or student chapter in your area.

    • Chapters

      Find local connections from over 607 chapters and state councils and create your personalized HR network.

      SHRM Connect

      Post polls, get crowdsourced answers to your questions and network with other HR professionals online.

      SHRM Northern California

      Join SHRM members in the greater San Francisco Bay area for local events and networking.

    • Membership Councils

      Learn about SHRM's five regional councils and the Membership Advisory Council (MAC).

      • Membership Advisory Council
      • Regional Councils
    • Volunteers

      Learn about volunteer opportunities with SHRM.

      • Volunteer Leader Resource Center
Join Today
Renew
Rejoin Now
Renew
  • Store
    • Global
    • India
    • MENA
  • About
  • Book a Speaker
  • Foundation
  • Executive network
  • CEO Circle
  • SHRM Business
  • Linkage Logo
SHRM
Sign In
  • Account
    • My Account
    • Logout
Close

  1. Topics & Tools
  2. Employment Law & Compliance
  3. The New York SHIELD Act: What Employers Need to Know
Share
  • Linked In
  • Facebook
  • Twitter
  • Email

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Vivamus convallis sem tellus, vitae egestas felis vestibule ut.


Error message details.

Copy button
Reuse Permissions

Request permission to republish or redistribute SHRM content and materials.


Learn More
News

The New York SHIELD Act: What Employers Need to Know

August 28, 2019 | Philip Gordon and Jennifer Taiwo © Littler

A group of padlocks on a blue background.


As mega-breaches heighten concern about the security of personal information and a federal solution does not appear forthcoming, New York recently joined the growing list of states imposing their own security obligations on businesses. 

On July 26, New York's governor signed the "Stop Hacks and Improve Electronic Data Security" (SHIELD) Act, requiring businesses to implement safeguards for the "private information" of New York residents and broadening New York's security breach notification requirements. 

Every employer with employees in New York must comply with the SHIELD Act because "private information" includes an individual's name and Social Security number.

Beyond that, many businesses without a New York presence may be required to comply as the law applies to any business that maintains the private information of New York residents. "Private information" includes—in addition to a Social Security number—a driver's license number, credit or debit card number, financial account number (with or without security code, as long as an unauthorized person could gain access to the account), biometric information, and username or e-mail address with a password that permits access to an online account. 

Given the SHIELD Act's breadth and the fact that it imposes requirements directly relevant to human resources professionals and in-house employment counsel, every employer needs to understand and address the SHIELD Act's implications for employers.

HR's Role

The SHIELD Act requires employers in possession of New York residents' private information to "develop, implement, and maintain reasonable safeguards to protect the security, confidentiality and integrity of the private information." 

The SHIELD Act does not mandate specific safeguards but instead provides that a business will "be deemed to be in compliance with" this standard if it implements a "data security program" that includes all of the elements enumerated in the SHIELD Act. Some key elements with relevance to HR stakeholders include the following:

  • Designating an employee or employees to coordinate the data security program.
  • Training and managing employees in the security program practices and procedures.
  • Assessing internal and external risks and implementing controls to reduce those risks.
  • Vetting service providers and binding them contractually to safeguard private information.
  • Securely destroying private information within a reasonable amount of time after it is no longer needed for business purposes.

The human resources team can play an important role in each of these elements of a data security program. HR may need to ensure that employees designated to implement the data security program have the bandwidth to perform these responsibilities in addition to other assigned responsibilities. 

Employee training typically is an HR responsibility, and information security training for line employees should focus on properly handling sensitive information, a natural topic for HR professionals. 

While risk assessments may focus heavily on technical threats, they also need to assess threats raised by negligent and malicious insiders. HR departments routinely outsource functions involving private information. HR professionals should ensure that those vendors' data security programs are properly vetted, and that legal counsel has included adequate information security terms in vendor agreements.

Finally, HR needs to ensure that records containing the private information of New York employees are securely destroyed promptly after the applicable retention period expires.

Two types of businesses can satisfy the "reasonable safeguards" requirement other than by implementing a data security program as defined by the SHIELD Act. Small businesses—those with fewer than 50 employees or less than $3 million in gross annual revenue—need only ensure that their data security safeguards are appropriate for the size and complexity of the small business, the nature and scope of the small businesses' activities, and the sensitivity of the personal information the small business handles. 

Businesses, large or small, that are in compliance with other regulatory schemes requiring information security, such as the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act Security Rule, or the New York State Department of Financial Services' Cybersecurity Requirements for Financial Services Companies, are deemed compliant with the SHIELD Act.

Critically, the SHIELD Act specifically states that it does not confer a private right of action but rather provides for enforcement by the state's attorney general. The SHIELD Act's data security requirements take effect on March 21, 2020.

Expanded Breach Notification Requirements

The SHIELD Act also amends New York's existing security breach notification law to broaden notification obligations. HR professionals and in-house employment counsel at organizations with New York employees need to be familiar with these changes.

The SHIELD Act substantially expands the definition of "private information," which, if compromised, could trigger notification obligations.

Private information now includes—in addition to a Social Security number, a driver's license number, credit or debit card number, or financial account number with any required security code—the following: 

  • Biometric information.
  • E-mail addresses and corresponding passwords or security questions and answers.
  • Financial account number without a required security code if an unauthorized person, nonetheless, could access the account.

The addition of biometric information is significant for employers, as many now rely on biometric time clocks to record employee time. E-mail address and password also is a notable addition for employers as they move increasingly to web-based e-mail accounts for corporate e-mail.

The SHIELD Act also expands the definition of "breach," another significant change for employers. "Breach" now includes unauthorized access, rather than solely unauthorized acquisition.

This addition is critical for employers that have moved to web-based e-mail accounts for corporate e-mail.  When these accounts are hacked, which can occur when employees are duped into disclosing their account credentials in response to a phishing e-mail, an employer often can establish that no information was exfiltrated or acquired from the account. However, employers typically cannot establish that the hacker did not access private information that may be stored within the account.  Consequently, the training required for a compliant data security program should educate employees on how to identify and avoid responding to phishing e-mail.

The SHIELD Act adds an important carve-out from the breach notification requirement for inadvertent disclosures of private information that are not likely to result in misuse of information. Human resources professionals might, for example, accidentally e-mail documents or spreadsheets containing Social Security numbers to the wrong employee. To benefit from this exception, the employer must:

  • Document its determination that the inadvertent disclosure is not likely to result in misuse.
  • Maintain that documentation for five years. 

Moreover, if the incident were to involve the private information of more than 500 New York residents, the employer would be required to submit the documentation to the state's attorney general within 10 days of that determination.

While the SHIELD Act, as noted above, does not permit a private right of action, it doubles the penalty recoverable by the attorney general from $10 to $20 per failed notification and increases the maximum penalty from $100,000 to $250,000.

The breach notification amendments take effect on Oct. 23, 2019.

Implications for Employers

The SHIELD Act highlights the importance of HR professionals' and in-house employment counsel's involvement in their organization's information security efforts. These stakeholders are ideally situated to support an organization's data security program by considering the following steps:

  • Ensuring that designated employees are able to fulfill their responsibilities to implement and maintain the data security program.
  • Helping to train employees on data security.
  • Assisting IT in assessing information security risk posed by negligent or malicious insiders.
  • Negotiating information security provisions in agreements with vendors that handle private information.
  • Helping to ensure that HR information is securely destroyed promptly after data retention periods expire (assuming a legal hold has not been implemented).

When a security incident occurs involving HR data, these stakeholders can play a critical role. For example, they can evaluate whether an authorized employee's disclosure of private information was inadvertent and, if so, the likelihood that the information will be misused. 

They also will be critical to investigations into whether a hacked, web-based corporate e-mail account contains private information because of their knowledge of the victimized employee's job responsibilities. 

In short, the SHIELD Act highlights why and how HR should support an organization's information security or IT team to enhance the organization's data security program.

Philip Gordon is an attorney with Littler in Denver. Jennifer Taiwo is an attorney with Littler in New York City. © 2019 Littler. All rights reserved. Reposted with permission. 

Business Acumen
Employment Law & Compliance
Risk Management
Technology
Workplace Security

Artificial Intelligence in the Workplace

​An organization run by AI is not a futuristic concept. Such technology is already a part of many workplaces and will continue to shape the labor market and HR. Here's how employers and employees can successfully manage generative AI and other AI-powered systems.



Related Content

Kelly Dobbs Bunting speaks onstage at SHRM24
(opens in a new tab)
News
Why AI+HI Is Essential to Compliance

HR must always include human intelligence and oversight of AI in decision-making in hiring and firing, a legal expert said at SHRM24. She added that HR can ensure compliance by meeting the strictest AI standards, which will be in Colorado’s upcoming AI law.

(opens in a new tab)
News
A 4-Day Workweek? AI-Fueled Efficiencies Could Make It Happen

The proliferation of artificial intelligence in the workplace, and the ensuing expected increase in productivity and efficiency, could help usher in the four-day workweek, some experts predict.

(opens in a new tab)
News
How One Company Uses Digital Tools to Boost Employee Well-Being

Learn how Marsh McLennan successfully boosts staff well-being with digital tools, improving productivity and work satisfaction for more than 20,000 employees.

Workplace Compliance Newsletter

Summaries of legal decisions, legislative news and regulatory news, delivered Friday afternoons.

Success title

Success caption

Manage Subscriptions
  • About SHRM
  • Careers at SHRM
  • Press Room
  • Contact SHRM
  • Book a SHRM Executive Speaker
  • Advertise with Us
  • Partner with Us
  • Copyright & Permissions
  • Post a Job
  • Find an HR Job
Follow Us
  • LinkedIn
  • Facebook
  • Twitter
  • Instagram
  • YouTube
  • SHRM Newsletters
  • Ask An Advisor

© 2025 SHRM. All Rights Reserved

SHRM provides content as a service to its readers and members. It does not offer legal advice, and cannot guarantee the accuracy or suitability of its content for a particular purpose. Disclaimer


  1. Privacy Policy

  2. Terms of Use

  3. Accessibility

Join SHRM for Exclusive Access to Member Content

SHRM Members enjoy unlimited access to articles and exclusive member resources.

Already a member?
Free Article
Limit Reached

Get unlimited access to articles and member-exclusive resources.

You've reached the limit of 1 free article this month. Join to access unlimited articles and member-only resources.

Already a member?
Free Article
Exclusive Executive-Level Content

This content is for the SHRM Executive Network and Executive Content Subscription members only.

You've reached the limit of 1 free article this month. Join the Executive Network and enjoy unlimited content.

Already a member?
Free Article
Exclusive Executive-Level Content

This content is for the SHRM Executive Network and Executive Content Subscription members only.

You've reached the limit of 1 free article this month. Join and enjoy unlimited access to SHRM Executive Network Content.

Already a member?
Unlock Your Career with SHRM Membership

Please enjoy this free resource! Join SHRM for unlimited access to exclusive articles and tools.

Already a member?

Your membership is almost expired! Renew today for unlimited access to member content.

Renew now

Your membership has expired. Renew today for unlimited access to member content.

Renew Now

Your Executive Network membership is nearing its expiration. Renew now to maintain access.

Renew Now

Your membership has expired. Renew your Executive Network benefits today.

Renew Now