Establishes the "secure our data act"

Latest action Feb 25, 2026

Establishes the "secure our data act"; relates to cybersecurity protection by state entities; requires the office of information technology services to develop standards for data protection of state entity-maintained information.

Not chosen yet

Where it stands

Passed one of the two chambers; it still needs the other.

Introduced
In committee
Up for a vote
Passed one chamber
Passed
Enacted

New York State Senate

Amends the State Technology Law.

Committee

Governmental Operations · New York State Assembly

Also referred to Internet And Technology · New York State Senate.

Purpose, from the sponsor's memo

Section one of this bill provides the title, which is the "secure our data act." Section two of this bill provides the legislative intent. Section three of this bill amends the State Technology Law by adding a new section 211. New section 211: (1) provides definitions that will be used in this section. These defi- nitions include "breach of the security of the system," "data vali- dation," "immutable," and "information system." (2) requires the Office of Information Technology Services to promulgate regulations that include standards for: *protection against breaches of the security of the system for mission critical information systems and personal information, *data backup, *information system recovery *data retention policies, and *workforce training regarding protection against breaches of the securi- ty of the system. These regulations may be promulgated on an emergency basis after at least one public hearing has been held. (3) requires state entities to engage in vulnerability testing of their critical information systems and to annually have their entire informa- tion system network subjected to vulnerability testing. (4) requires each state entity to create an, or update an existing, inventory of the personal information and information systems maintained by the state entity. (5) requires each state entity to develop an incident response plan for breaches of the security of the system. On an annual basis, each state entity shall complete one exercise of its incident response plan. (6) provides that this bill does not create a private cause of action. Section 4 of this bill contains the severability clause. Section 5 of this bill provides that this act shall take effect imme- diately.

Filed with the bill. Read it on nysenate.gov (opens in a new tab)

Recorded votes

Vote: Committee vote · Internet And Technology
Senate Internet And TechnologyFeb 25, 2026Result: passed
(7) (0) (0) (0)
Vote: Floor vote
NY SenateMay 28, 2025Result: passed
(61) (0) (0) (2)
Vote: Committee vote · Finance
Senate FinanceMay 20, 2025Result: passed
(22) (0) (0) (0)
Vote: Committee vote · Internet And Technology
Senate Internet And TechnologyFeb 10, 2025Result: passed
(7) (0) (0) (0)

The sponsor's argument

Why Kristen Gonzalez says this is needed

Our state's information systems are under attack every day. The emer- gence of generative AI tools has enabled these attacks to grow in sophistication. While we cannot eradicate all cyberattacks or halt the behavior of all bad actors, we must fortify defense of New York's infor- mation systems and the personal information stored therein. Personal information about New York residents is stored in each govern- mental entity's information systems. In fact, these governmental enti- ties need the collected and maintained personal information to properly function and provide services to New York residents. In its role as protector, government must take affirmative steps to protect the personal information that it has collected and maintains from cyberat- tacks. This legislation is an important step in ensuring that the government is taking steps to protect the personal information that it has collected and maintains. New Yorkers trust that their government is protecting their personal information. We need to ensure that this trust is not misplaced.

This is the sponsor's own case for the bill, quoted from their memorandum. It is not Agora's description of what the bill does.

Full history

Feb 25, 2026
Reported out of committee
REPORTED AND COMMITTED TO FINANCE
NY Senate
Feb 18, 2026
Amend and Recommit to Internet and Technology
AMEND AND RECOMMIT TO INTERNET AND TECHNOLOGY
NY Senate
Jan 7, 2026
Died in Assembly
DIED IN ASSEMBLY
NY Assembly
Jan 7, 2026
Referred to committee
REFERRED TO INTERNET AND TECHNOLOGY
NY Senate
May 28, 2025
Sent to the executive
DELIVERED TO ASSEMBLY
NY Senate

Show full history (7 earlier events)

May 28, 2025
Passed a chamber
PASSED SENATE
NY Senate
May 28, 2025
Referred to committee
REFERRED TO GOVERNMENTAL OPERATIONS
NY Assembly
May 22, 2025
Advanced to Third Reading
ADVANCED TO THIRD READING
NY Senate
May 21, 2025
2ND Report CAL.
2ND REPORT CAL.
NY Senate
May 20, 2025
1ST Report CAL.1218
1ST REPORT CAL.1218
NY Senate
Feb 10, 2025
Reported out of committee
REPORTED AND COMMITTED TO FINANCE
NY Senate
Jan 14, 2025
Referred to committee
REFERRED TO INTERNET AND TECHNOLOGY
NY Senate

About this record

Summary: The summary comes from NY Open Legislation, the New York State Senate's public record. For more, see How we handle summaries.
Source: From NY Open Legislation, the NY Senate and Assembly, and official rosters. This record was last updated Oct 31, 2026. About our data

Read the record

Read on NY Senate (opens in a new tab) The official record on nysenate.gov.

Your position