N.Y. State Technology Law § 209

§ 209. Notification of data breach or network security breach; shared\ndata. 1. The office shall, within twenty-four hours following the\ndiscovery of a data breach or network security breach or receiving\nnotice of a data breach or network security breach, notify the chief\ninformation officer, and where appropriate, the chief information\nsecurity officer, of any state entity with which it shares data,\nprovides networked services or shares a network connection whose data,\nservices or connection is or may have been the subject of such breach\nwhether or not such data was, or is reasonably believed to have been,\nacquired or used by an unauthorized person.\n 2. The office shall, in addition to the provisions of subdivision one\nof this section, notify the chief information officer, and where\nappropriate, the chief information security officer, of such state\nentity with which it shares data, provides networked services or shares\na network connection and whose data is or may have been the subject of\nsuch breach, of its plan for remediation of the breach and future\nprotection of such data and network.\n 3. For purposes of this section:\n (a) "Data breach" shall mean an intentional or unintentional incident\nwhere data is disclosed, released, stolen, or taken without the\nknowledge or authorization of the data's owner or steward.\n (b) "Network security breach" shall mean an intentional or\nunintentional incident where an unauthorized party has gained access to\nan organization's network without the knowledge or authorization of the\nnetwork owner or steward.\n (c) "State entity" shall mean any state board, bureau, division,\ncommittee, commission, council, department, public authority, public\nbenefit corporation, office or other governmental entity performing a\ngovernmental or proprietary function for the state of New York,\nincluding the state legislature and the judiciary.\n