For many organizations, New York’s newly passed SHIELD Act is the first legal obligation to implement security protections. Any business that maintains private information of New York state residents is now required to report the unauthorized access or viewing of personal information to the NY Attorney General. By March 2020, the SHIELD Act requires that a comprehensive security program be in place, or risk penalties.