National Trends in Data Privacy & Cybersecurity for Businesses: What Pennsylvania and New York Companies Need to Know

Disclaimer: This article is for informational purposes only and is not legal advice. Reading it does not create an attorney–client relationship. Todd Nurick and Nurick Law Group are not your attorneys unless and until there is a fully executed written fee agreement with Todd Nurick or Nurick Law Group.

Introduction

Data privacy and cybersecurity are no longer just IT issues—they are core legal and business risks. Regulators across the country are tightening standards for how companies collect, store, and protect personal information. Todd Nurick of Nurick Law Group, a Pennsylvania and New York business attorney, helps companies navigate these fast-moving compliance requirements to avoid liability and maintain customer trust.

The Expanding Patchwork of Privacy Laws

Federal Landscape

While there is still no single federal privacy law equivalent to the EU’s GDPR, several federal statutes impose sector-specific requirements:

• Gramm-Leach-Bliley Act (GLBA): governs financial institutions’ handling of consumer data.

• Health Insurance Portability and Accountability Act (HIPAA): covers healthcare providers, insurers, and business associates.

• Federal Trade Commission Act (FTC Act): prohibits deceptive or unfair data-handling practices.

• Children’s Online Privacy Protection Act (COPPA): regulates online data collection from children under 13.

Companies subject to multiple frameworks must harmonize compliance programs to meet overlapping obligations.

State Developments: Pennsylvania & New York

Pennsylvania:

• Pennsylvania currently enforces privacy protections through its Breach of Personal Information Notification Act (73 P.S. § 2301 et seq.), which requires prompt notice to individuals whose unencrypted personal information is compromised.

• In 2024, legislators introduced the Consumer Data Privacy Act, modeled after California’s CCPA; while not yet enacted, Pennsylvania companies should prepare for comprehensive data-rights laws in the near future.

New York:

• New York’s SHIELD Act (Stop Hacks and Improve Electronic Data Security Act) already imposes robust obligations on businesses that collect data from NY residents. It requires reasonable safeguards—administrative, technical, and physical—to protect private information.

• The New York Department of Financial Services (NYDFS) Cybersecurity Regulation (23 NYCRR Part 500) applies to banks, insurers, and financial institutions, mandating risk assessments, incident response plans, and annual certifications of compliance.

National Momentum Toward Comprehensive Privacy Laws

As of 2025, more than 15 states have enacted their own comprehensive consumer privacy statutes (including California, Virginia, Colorado, and Texas). Each law grants individuals rights to access, delete, and restrict use of their personal data.

This fragmented environment means multi-state businesses—including those based in Pennsylvania or New York—must assess which state laws apply to their operations, customers, and vendors.

Cybersecurity: Beyond Compliance

Compliance alone is not enough. Courts and regulators increasingly treat data security as a duty of care. Failure to implement reasonable safeguards can expose businesses to negligence claims and enforcement actions.

Best practices include:

• Conducting periodic data-security risk assessments

• Maintaining incident response and breach-notification plans

• Training employees on phishing and social-engineering risks

• Encrypting sensitive data at rest and in transit

• Reviewing vendor contracts for cybersecurity and indemnity provisions

The Role of Outside General Counsel

For most small and mid-sized companies, cybersecurity oversight cannot rest solely with IT. Outside general counsel provides the missing link between technology and compliance—advising on breach-response obligations, vendor management, and cross-state privacy requirements.

Todd Nurick and Nurick Law Group assist businesses in developing data-governance policies, evaluating incident-response readiness, and coordinating with technical experts when breaches occur.

Conclusion

Data privacy and cybersecurity are now integral to sound corporate governance. Pennsylvania and New York businesses—and those operating nationally—must stay ahead of rapidly changing regulations. Partnering with knowledgeable counsel ensures your company protects its data, reputation, and future.

Todd Nurick and Nurick Law Group stand ready to guide clients through evolving privacy and cybersecurity compliance challenges.

Sources

• Federal Trade Commission, “Privacy & Data Security” (FTC.gov)

• U.S. Dept. of Health & Human Services, “HIPAA Privacy Rule”

• Pennsylvania Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq.

• New York SHIELD Act, General Business Law § 899-aa & § 899-bb

• NYDFS Cybersecurity Regulation, 23 NYCRR Part 500

• National Conference of State Legislatures (NCSL), “State Privacy Legislation Tracker 2025”