Obligations United States New York
What a New York business has to have in writing
New York layers a lot of mandatory written documents on top of federal law: the SHIELD Act makes a reasonable data security program a legal duty for anyone holding a New Yorker's private information, every employer must adopt a sexual harassment policy and train staff annually, retail employers with ten or more workers must adopt a workplace violence prevention policy, and every private employer must keep an airborne infectious disease exposure prevention plan on the shelf.
Financial and insurance licensees file an annual cybersecurity certification with DFS under 23 NYCRR 500, and general hospitals have run under their own cybersecurity regulation since October 2025. New York's OSHA State Plan (PESH) covers only state and local government workplaces, so private employers answer to federal OSHA.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
New YorkHandbook 2026acknowledged by name
New York on Recordwith AllyMatter
Cover New York the Modern WayEvery policy New York makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in New York on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
New York rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Information Security Breach and Notification Act (SHIELD Act amendments)AI-compiledN.Y. Gen. Bus. Law § 899-aaAny person or business that owns or licenses computerized data containing the private information of a New York resident, wherever the business is locatedDistribute
Notice
Notify affected New York residents in the most expedient time possible without unreasonable delay, and separately notify the Attorney General, the Department of State Division of Consumer Protection and the State Police through the AG's breach reporting portal; when more than 500 residents are affected, file the written determination and template notice with the AG within ten days. If the business concludes an inadvertent disclosure is unlikely to cause harm, document that determination in writing and keep it for five years.
From the first employee
New York Attorney General
Data Security Program 2A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
SHIELD Act data security program requirementAI-compiledN.Y. Gen. Bus. Law § 899-bbAny person or business that owns or licenses computerized data containing the private information of a New York resident; a scaled-down duty applies to small businesses (under 50 employees, or under $3M average gross annual revenue over three fiscal years, or under $5M year-end total assets)Write
Written program
Develop, implement and maintain a data security program with administrative, technical and physical safeguards: name a security coordinator, run risk assessments, train staff on security practices, put security terms into vendor contracts, test and monitor controls, and dispose of private information securely. Small businesses may size the program to their operations and the sensitivity of the data.
From the first employee
New York Attorney General
Hospital Cybersecurity RequirementsAI-compiled10 NYCRR § 405.46 (adopted October 2, 2024; compliance due October 2, 2025)All general hospitals licensed under Article 28 of the Public Health LawWrite
Written program
Run a written cybersecurity program built on an annual risk assessment, with documented policies approved by the governing body, a designated Chief Information Security Officer, secure development and third-party vendor security procedures, identity and access management, audit trails, staff training, and a tested incident response plan. Report a cybersecurity incident to the Department of Health no later than 72 hours after determining one has occurred.
From the first employee
New York State Department of Health (hospital licensure)
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
New York Child Data Protection ActAI-compiledN.Y. Gen. Bus. Law art. 44-A; effective June 20, 2025Operators of websites, online services and applications that are primarily directed to minors under 18, or that have actual knowledge they are processing a minor's data. New York has no comprehensive all-consumer privacy law.Write
Written policy
Stop collecting, using, sharing or selling the personal data of anyone under 18 for advertising unless the processing is strictly necessary for a permitted purpose or informed consent is obtained (parental consent for users 12 and under, where the COPPA standard applies); document the permitted purpose relied on, build a compliant consent flow, and impose written data protection terms on processors.
From the first employee
New York Attorney General (civil penalties up to $5,000 per violation)
Harassment Prevention 1A written policy, and in some states annual training, on harassment
LawProduceWhat it requiresTriggerEnforced by
Sexual harassment prevention policy and annual trainingAI-compiledN.Y. Labor Law § 201-g; N.Y. Exec. Law § 296Every employer in New York State, with no minimum headcountWrite + ack
Written policy
Adopt a written sexual harassment prevention policy that meets or exceeds the state model: examples of prohibited conduct, the complaint form, the internal investigation procedure, external forums for redress, and a statement that retaliation is unlawful. Give every employee the policy in writing at hire and at each annual training, in English and in the employee's primary language, and run interactive sexual harassment prevention training every year with extra content for supervisors.
From the first employee
New York State Division of Human Rights; New York State Department of Labor
Workplace Safety Programs 2Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
NY HERO Act - Airborne Infectious Disease Exposure Prevention PlanAI-compiledN.Y. Labor Law § 218-b (signed May 5, 2021)All private-sector employers with worksites in New York StateWrite + ack
Written program
Adopt a written airborne infectious disease exposure prevention plan, either the Department of Labor's industry model or an equivalent one covering health screening, face coverings, employer-paid PPE, a designated supervisor to enforce it, and notification duties. The plan sits dormant until the Commissioner of Health designates a highly contagious airborne disease; on designation it must be activated, distributed to employees within 30 days and to new hires at hire, and posted at each worksite.
From the first employee
New York State Department of Labor, Safety, Health and Essential Rights Program
Public Employee Safety and Health (PESH) Bureau - New York State PlanAI-compiledN.Y. Labor Law § 27-a; 29 CFR 1956 (New York State Plan)State and local government employers only. New York's OSHA-approved State Plan does not cover private-sector workplaces, which remain under federal OSHA.Write
Written program
Public employers must follow the OSHA standards PESH adopts, post the state Public Employees Safety Rights notice, keep injury and illness records, and report fatalities and hospitalizations to PESH. Private employers in New York meet federal OSHA recordkeeping and posting duties instead.
From the first employee
New York State Department of Labor, Division of Safety and Health (PESH)
Workplace Violence Prevention 1A written plan for preventing and responding to workplace violence
LawProduceWhat it requiresTriggerEnforced by
Retail Worker Safety ActAI-compiledN.Y. Labor Law § 27-e (effective June 2, 2025)Employers with 10 or more employees working at a retail store in New York State; food service establishments are excludedWrite
Written policy
Adopt a retail workplace violence prevention policy, either the Department of Labor model or an equal one, covering the risk factors retail staff face, prevention methods, the federal and state laws on violence against retail workers and the remedies available, and a statement that retaliation is unlawful; give it to every employee in writing at hire and at each training. Train employees on workplace violence prevention every year at 50 or more retail employees, every two years below that. From January 1, 2027 retailers with 500 or more employees statewide must install silent response buttons and train staff on them.
10+ employees
New York State Department of Labor, Safety, Health and Essential Rights Program; Attorney General
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
DFS Cybersecurity Requirements for Financial Services CompaniesAI-compiled23 NYCRR Part 500 (Second Amendment adopted November 1, 2023)Covered entities operating under a licence, registration or charter under the New York Banking Law, Insurance Law or Financial Services Law, including insurers, agents and brokers; smaller licensees may qualify for a limited exemption but still owe core dutiesCertify + ack
Certification
Maintain a written cybersecurity policy and program approved by the board or a senior officer, based on periodic risk assessment; appoint a CISO who reports to the board at least annually; run penetration testing, vulnerability management, access reviews, multi-factor authentication, an incident response plan and a business continuity plan; file a written Certification of Material Compliance or an Acknowledgement of Non-Compliance with the Superintendent by April 15 each year and keep five years of supporting records; report a cybersecurity incident to DFS within 72 hours and a ransom payment within 24 hours.
From the first employee
New York State Department of Financial Services
Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice
LawProduceWhat it requiresTriggerEnforced by
New York State Paid Sick LeaveAI-compiledN.Y. Labor Law § 196-bEvery private-sector employer in New York State; the amount of leave and whether it is paid depends on headcount and net incomeWrite
Written policy
Let employees accrue at least one hour of sick leave for every 30 hours worked and give the annual entitlement the statute sets for the employer's size (56 paid hours at 100+ employees, 40 paid hours at 5-99 employees or at 4 or fewer with over $1M net income, 40 unpaid hours at 4 or fewer with $1M or less net income). Employers commonly document this in a written sick leave policy, must keep accrual and use records for six years, and must give an employee a summary of accrued and used leave within three business days of a request.
From the first employee
New York State Department of Labor, Division of Labor Standards
New York Paid Family LeaveAI-compiledN.Y. Workers' Comp. Law art. 9Most private employers with one or more employees working in New York StateWrite
Written policy
Buy Paid Family Leave insurance (usually as a rider on the disability policy), collect the employee payroll contribution, and either add Paid Family Leave language to the employee handbook or issue written guidance explaining the benefit and how to file a claim. Post and keep in plain view the carrier's Notice of Compliance, and complete the employer part of each leave request.
From the first employee
New York State Workers' Compensation Board; Paid Family Leave program
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Posting requirements under New York State Labor LawAI-compiledN.Y. Labor Law §§ 193, 195.1, 195.5, 196-d, 201-g, 206-c, 740; Exec. Law art. 15; Workers' Comp. LawEvery New York employer; a few notices (veterans' benefits) start at 50 employeesPost
Posting
Display the Department of Labor's required notices where employees can see them: minimum wage, wage payment and pay notice, tip deductions and appropriation, job safety and health, sexual harassment prevention, breast milk expression rights, equal pay, whistleblower retaliation protections, criminal conviction records, no-smoking signs, minor work schedules, and the veterans' benefits poster at 50 or more employees; add the workers' compensation, disability and Paid Family Leave notices from the insurance carrier and the Division of Human Rights discrimination poster.
From the first employee
New York State Department of Labor
Pay Transparency 1Salary ranges in job posts and pay disclosure on request
LawProduceWhat it requiresTriggerEnforced by
Pay transparency in job advertisementsAI-compiledN.Y. Labor Law § 194-b (effective September 17, 2023)Employers with four or more employees, and employment agencies and recruiters, advertising jobs, promotions or transfers that will be performed at least partly in New York StateDistribute
Notice
State a good-faith minimum and maximum pay range, and the job description if one exists, in every advertisement for a job, promotion or transfer; say when a role is commission-based. Employers must keep records of the ranges and job descriptions they advertised, and may not retaliate against anyone who asks about pay.
4+ employees
New York State Department of Labor, Division of Labor Standards
Licensing and Certifications 2Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity formation and biennial statementAI-compiledN.Y. Bus. Corp. Law § 408; N.Y. Ltd. Liab. Co. Law § 301-A; Gen. Bus. Law § 130 (assumed names)Any corporation, LLC, limited partnership or foreign entity doing business in New York, and sole proprietors and partnerships operating under an assumed nameFile
Filing / record
File a certificate of incorporation or articles of organization (or an application for authority for an out-of-state entity) with the Department of State, name the Secretary of State as agent for service of process, file an assumed name certificate where a DBA is used, and file a biennial statement every two years in the anniversary month of the original filing.
From the first employee
New York Department of State, Division of Corporations, State Records and Uniform Commercial Code
Food service establishment permit (State Sanitary Code Part 14)AI-compiled10 NYCRR Part 14, Subparts 14-1, 14-2, 14-4, 14-5Restaurants, takeaway food businesses, caterers, schools, temporary and mobile food service operations, pushcarts and vending machine operatorsFile
Filing / record
Get a permit to operate from the local health department (or the Department of Health district office) before opening, and show proof of New York workers' compensation, disability and Paid Family Leave coverage before the permit is issued; then operate to the Subpart 14-1 standards on food handling, temperature control and facility condition and pass routine inspections. New York City runs its own food protection certificate rules on top of the state code.
From the first employee
New York State Department of Health, Bureau of Community Environmental Health and Food Protection; local health departments
Other Written Policies 2Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Lactation accommodation policy and paid break timeAI-compiledN.Y. Labor Law § 206-c (paid break time effective June 19, 2024)Every New York employer, of any size and in any industryWrite
Written policy
Give employees 30 minutes of paid break time to express breast milk as often as reasonably needed for three years after a child's birth, plus unpaid time, and make reasonable efforts to provide a private, non-bathroom room close to the work area. Hand every employee the Department of Labor written policy on the rights of employees to express breast milk at hire and once a year after that, and give written notice of the section to employees returning to work after a birth.
From the first employee
New York State Department of Labor, Division of Labor Standards
Notice of electronic monitoring of employeesAI-compiledN.Y. Civ. Rights Law § 52-c (added by ch. 583 of 2021, effective May 7, 2022)Any private employer with a place of business in New York that monitors employee telephone calls, email or internet use; state and local government are excludedDistribute + ack
Notice
Give every new hire written or electronic notice, acknowledged in writing or electronically, that phone calls, email and internet activity may be monitored at any time, and post the same notice conspicuously for existing employees. Purely automated systems for managing message volume or protecting the network are exempt.
From the first employee
New York Attorney General ($500 first violation, $1,000 second, $3,000 each after)
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with New York on top
Small businessFederal + industry, with New York on topConstruction contractorsFederal + industry, with New York on topHealthcare practicesFederal + industry, with New York on topFood and beverage businessesFederal + industry, with New York on topTax and accounting firmsFederal + industry, with New York on topRegistered investment advisersFederal + industry, with New York on topInsurance agenciesFederal + industry, with New York on topRetail and e-commerceFederal + industry, with New York on topTrucking and logistics carriersFederal + industry, with New York on topNonprofitsFederal + industry, with New York on topFederal contractorsFederal + industry, with New York on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
New York Attorney General - SHIELD ActNew York Attorney General - Data Breach ReportingNY Senate - Gen. Bus. Law § 899-aaNY Senate - Gen. Bus. Law § 899-bbNew York Attorney General - Child Data Protection Act Implementation GuidanceNew York Attorney General - NYCDPA guidance (PDF)NY Senate - S7695A (Child Data Protection Act)NY DFS - Cybersecurity Resource CenterNY DFS - 23 NYCRR Part 500 text (PDF)NY DFS - Part 500 Requirement ChecklistNYS Department of Health - Hospital Cybersecurity RequirementsNYS DOH - Section 405.46 adopted regulation (PDF)NYS DOH - Dear Hospital Administrator Letter 24-10NY Senate - Labor Law § 201-gNew York State - Combating Sexual Harassment in the Workplace: EmployersNYS Department of Labor - Posting RequirementsNYS Department of Labor - Retail Worker SafetyNYS Department of Labor - Retail Workplace Violence Prevention PolicyNY Senate - Labor Law § 27-eNYS Department of Labor - Airborne Infectious Disease Exposure Prevention PlanNYS Department of Labor - NY HERO ActNYS Department of Labor - Model Airborne Exposure Prevention Plan (PDF)OSHA - New York State PlanNYS Department of Labor - Reference Material for Public Employee Safety and Health InspectionsNY Senate - Labor Law § 27-aNew York State - New York Paid Sick LeaveNY Senate - Labor Law § 196-bNYS Department of Labor - Paid Sick LeaveNew York Paid Family Leave - Employer Responsibilities and ResourcesNew York Paid Family Leave - EmployersNY Senate - Workers' Comp. Law art. 9NYS Department of Labor - Pay TransparencyNY Senate - Labor Law § 194-bNYS Department of Labor - Required Posters (LS 205)NYS Department of Labor - Breast Milk Expression in the WorkplaceNYS Department of Labor - Policy on the Rights of Employees to Express Breast Milk (P705)NY Senate - Labor Law § 206-cNY Senate - Civil Rights Law § 52-c (electronic monitoring)NY Senate - S2628 (2021) bill statusNY Department of State - Division of Corporations, State Records and UCCNY Department of State - Biennial Statements for Business Corporations and LLCsNY Department of State - Form a Corporation or BusinessNYS Department of Health - Regulations and Permit RequirementsNYS Department of Health - Food SafetyNY Codes, Rules and Regulations - Subpart 14-1 Food Service Establishments