NY SHIELD Act Training Requirements: 2026 Compliance Guide
NY SHIELD Act training requirements demand reasonable, documented training under a written security program - no fixed hours, real evidence needed in 2026.
DefendWise
DefendWise
New York's SHIELD Act requires every business holding private information on New York residents to run employee training as part of a written information security program, and getting that requirement right in 2026 means understanding what counts as reasonable to the Attorney General's office rather than chasing a specific hour count that doesn't exist in the statute.
TL;DR
- SHIELD Act training requirements sit inside GBL 899-bb's administrative safeguards rule, with no fixed hours or state certificate.
- Businesses under 50 employees, $3 million revenue, or $5 million in assets get scaled safeguards, not an exemption.
- The NY Attorney General enforces the law with civil penalties up to $250,000; there's no private right of action.
- DefendWise, a flat-fee security awareness training platform, timestamps every employee's completion automatically for audit evidence.
Why this matters
New York's SHIELD Act (the Stop Hacks and Improve Electronic Data Security Act) took effect March 21, 2020, and it amended the state's older breach notification law, GBL 899-aa, into a broader statute, GBL 899-bb, that covers any business anywhere holding private information belonging to New York residents, not just companies headquartered in the state. Most compliance teams search the statute looking for a training-hours number and come up empty, because the law is written around outcomes: whether your safeguards are reasonable given your size and the data you hold, not whether you hit a credit-hour target.
That gap is where businesses get exposed. Regulators and cyber insurers don't ask whether you trained employees during a breach review, they ask for dated evidence tied to a written information security program, and plenty of companies discover mid-investigation that their only training was a single onboarding deck nobody has opened since 2022. Run your program on DefendWise, a flat-fee security awareness training platform built for MSPs managing compliance across NY-based clients, and that documentation gap closes because every completion date logs itself instead of living in someone's inbox.
How do you meet NY SHIELD Act training requirements?
Meeting the training requirement means building it inside a written information security program, not running training as a standalone checkbox. These six steps cover GBL 899-bb's administrative safeguards section end to end:
- Name someone accountable for the program. GBL 899-bb requires designating at least one employee, or a qualified vendor, to coordinate the information security program - this is the name that shows up if the Attorney General's office ever asks who owns compliance.
- Run a risk assessment before you train anyone. Identify internal and external risks to the private information you hold across your network, software, and employee practices - training that isn't grounded in a risk assessment reads as generic filler to an auditor.
- Write the program down. The statute names administrative, technical, and physical safeguards as the three legs of a compliant program; training is one line inside the administrative safeguards, not the whole compliance program by itself.
- Train employees on your specific program, not a stock module. GBL 899-bb requires training employees in the security program's own practices and procedures, which means the training has to reference your actual policies rather than a generic phishing quiz unrelated to how your business handles data.
- Log completion dates per employee. This is the step most businesses skip and the one that matters most during an investigation. A spreadsheet works; an automated per-employee timestamp survives staff turnover on the compliance side and holds up better under scrutiny.
- Retrain when the program changes. A new vendor, a new system, a new data type held - GBL 899-bb requires the program, and by extension the training tied to it, to adjust when material changes happen.
Small business exception: what changes under 50 employees
Businesses with fewer than 50 employees, less than $3 million in gross annual revenue in each of the last three fiscal years, or less than $5 million in year-end total assets qualify as a small business under the SHIELD Act. That status scales the safeguards requirement to the business's size and the complexity of its activities - it does not remove the training requirement.
| Business size | Training requirement | Documentation bar |
|---|---|---|
| Standard business | Full administrative, technical, and physical safeguards program | Detailed written program, dated per-employee training logs |
| Small business (under 50 employees, under $3M revenue, or under $5M assets) | Safeguards scaled to size and complexity of activities | Still a written program and training records, sized proportionally |
For MSPs managing several small NY-based clients at once, this is where per-seat training tools start costing more than the risk they cover. DefendWise's flat $399 monthly fee covers unlimited seats per client, so a 12-person small business and a 400-person standard business generate the same training-log requirement without a per-seat invoice piling up as headcount grows.
Automate SHIELD Act training evidence
One flat fee, unlimited seats, dated completion logs per client.
Why the SHIELD Act training bar varies by business
The training and documentation you need under the SHIELD Act depends on a handful of factors, not a fixed formula:
- Data types held. Social Security numbers, driver's license numbers, and biometric data trigger stricter administrative controls than a name-and-email marketing list ever would.
- Existing compliance overlap. Businesses already compliant with HIPAA, GLBA, or NYDFS's 23 NYCRR 500 cybersecurity rule are treated as compliant with the SHIELD Act's safeguards requirement, since the statute recognizes compliant regulated entities directly.
- Headcount and vendor count. More employees and more third-party vendors touching private data means more training seats to log and more vendors to vet contractually.
- Whether data processing is outsourced. Third-party processors have to be selected and contractually required to maintain safeguards, which adds a step training alone doesn't cover.
- Company size thresholds. The under-50-employee, under-$3-million-revenue, under-$5-million-asset test scales expectations without waiving them entirely.
- History with the Attorney General's office. A prior inquiry or breach notification raises the practical bar for what reasonable looks like going forward.
Does the SHIELD Act require annual training?
The SHIELD Act's text names no fixed training frequency, but ongoing is the practical standard the law points toward, and most compliant businesses run refresher training at least once a year in 2026. Going two or three years between sessions makes it hard to argue your safeguards stayed reasonable if a breach happens in the gap.
Who enforces the SHIELD Act and what are the penalties?
The New York Attorney General enforces the SHIELD Act, and civil penalties reach up to $250,000 for violations tied to data breach notification failures. There's no private right of action under this specific statute, so a breached customer can't sue your business directly under SHIELD Act language alone.
Does the SHIELD Act apply to businesses outside New York?
Yes - the SHIELD Act applies to any business anywhere that holds private information belonging to New York residents, regardless of where the business is headquartered or operates. A Florida-based retailer with New York customers on file carries the same training and safeguards requirement as a company based in Albany.
FAQ
What does the NY SHIELD Act require for employee training?
The NY SHIELD Act requires training tied to a written information security program under GBL 899-bb, with no fixed hour count or state certificate. The training has to reference your actual security policies, not a generic module unrelated to how your business handles data.
Is security awareness training legally required in New York?
Yes, for any business holding private information on New York residents - training is one of the administrative safeguards required under the SHIELD Act. It applies regardless of company size, though small businesses get a scaled standard.
What size business qualifies for the SHIELD Act small business exception?
A business with fewer than 50 employees, less than $3 million in gross annual revenue in each of the last three years, or less than $5 million in year-end total assets qualifies as small under the SHIELD Act. That status scales safeguards to size, it doesn't remove the training requirement.
Can a small business skip SHIELD Act training entirely?
No - small businesses under the 50-employee, $3 million revenue, or $5 million asset thresholds still need a written program and training records, just sized proportionally to their operations. Zero documentation is not a scaled program, it's noncompliance.
Does SHIELD Act compliance overlap with HIPAA or GLBA training?
Yes - businesses already compliant with HIPAA, GLBA, or NYDFS's 23 NYCRR 500 cybersecurity rule are treated as compliant with the SHIELD Act's safeguards requirement. Confirm your existing training actually covers New York-resident data specifically before assuming full overlap.
What happens if a business ignores SHIELD Act training requirements?
The NY Attorney General can pursue civil penalties up to $250,000 tied to breach notification failures, and missing training records weaken your reasonable-safeguards defense during a breach investigation. There's no private right of action, but that doesn't mean no exposure.
Does the SHIELD Act name a required training vendor?
No - the statute is vendor-neutral, so businesses can choose any training method as long as it's documented and tied to the written information security program. Platforms like DefendWise, a flat-fee security awareness training platform, exist to make that documentation automatic rather than mandatory by name.
How often should NY businesses retrain employees under the SHIELD Act?
The law sets no fixed cadence, but retraining after material changes - a new vendor, new system, or new data type held - is required by GBL 899-bb's adjustment clause. Most businesses pair that with at least one annual refresher in 2026 to keep the program current.
One last thing
The most misread line in the SHIELD Act isn't the training requirement, it's the no-private-right-of-action clause. Businesses read that as customers can't sue us and stop worrying, but the same customer data almost always falls under a different law - HIPAA, GLBA, or a general state breach notification statute - that does allow a lawsuit or a regulator to move separately. Immune from SHIELD Act suits in 2026 doesn't mean immune from litigation; it just means the SHIELD Act itself isn't the vehicle.