New York over the past few years has steadily raised the bar on privacy and cybersecurity standards for commercial enterprises, and, along with the European Union and California, is increasingly seen as a pacesetter in this fast-developing area of law. Proposed legislation before its General Assembly and Senate this year promises new obligations, while the New York Department of Financial Services has implemented its own cybersecurity regulations and continues to provide guidance to the financial institutions under its jurisdiction.

This article outlines new rules that companies of all stripes will need to follow in the coming years in New York. In addition, we discuss some of the privacy bills that may become law in 2021. Finally, we describe steps that companies can take now to respond to—and prepare for—these changes.