National Trends in Data Privacy & Cybersecurity for Businesses: What Pennsylvania and New York Companies Need to Know
Updated: 6 hours ago
Introduction
Data privacy and cybersecurity are no longer just IT issues—they are core legal and business risks. Regulators across the country are tightening standards for how companies collect, store, and protect personal information. Todd B. Nurick, a Pennsylvania and New York business attorney, helps companies navigate these fast-moving compliance requirements to avoid liability and maintain customer trust.
The Expanding Patchwork of Privacy Laws
Key Data Privacy and Cybersecurity Trends for Businesses
While there is still no single federal privacy law equivalent to the EU’s GDPR, several federal statutes impose sector-specific requirements:
Gramm-Leach-Bliley Act (GLBA): governs financial institutions’ handling of consumer data.
Health Insurance Portability and Accountability Act (HIPAA): covers healthcare providers, insurers, and business associates.
Federal Trade Commission Act (FTC Act): prohibits deceptive or unfair data-handling practices.
Children’s Online Privacy Protection Act (COPPA): regulates online data collection from children under 13.
Companies subject to multiple frameworks must harmonize compliance programs to meet overlapping obligations.
State Developments: Pennsylvania & New York
Pennsylvania:
Pennsylvania currently enforces privacy protections through its Breach of Personal Information Notification Act (73 P.S. § 2301 et seq.), which requires prompt notice to individuals whose unencrypted personal information is compromised.
In 2024, legislators introduced the Consumer Data Privacy Act, modeled after California’s CCPA; while not yet enacted, Pennsylvania companies should prepare for comprehensive data-rights laws in the near future.
New York:
New York’s SHIELD Act (Stop Hacks and Improve Electronic Data Security Act) already imposes robust obligations on businesses that collect data from NY residents. It requires reasonable safeguards—administrative, technical, and physical—to protect private information.
The New York Department of Financial Services (NYDFS) Cybersecurity Regulation (23 NYCRR Part 500) applies to banks, insurers, and financial institutions, mandating risk assessments, incident response plans, and annual certifications of compliance.
National Momentum Toward Comprehensive Privacy Laws
As of 2025, more than 15 states have enacted their own comprehensive consumer privacy statutes (including California, Virginia, Colorado, and Texas). Each law grants individuals rights to access, delete, and restrict use of their personal data.
This fragmented environment means multi-state businesses—including those based in Pennsylvania or New York—must assess which state laws apply to their operations, customers, and vendors.
Cybersecurity: Beyond Compliance
Compliance alone is not enough. Courts and regulators increasingly treat data security as a duty of care. Failure to implement reasonable safeguards can expose businesses to negligence claims and enforcement actions.
Best practices include:
Conducting periodic data-security risk assessments
Maintaining incident response and breach-notification plans
Training employees on phishing and social-engineering risks
Encrypting sensitive data at rest and in transit
Reviewing vendor contracts for cybersecurity and indemnity provisions
The Role of Outside General Counsel
For most small and mid-sized companies, cybersecurity oversight cannot rest solely with IT. Outside general counsel provides the missing link between technology and compliance—advising on breach-response obligations, vendor management, and cross-state privacy requirements.
Todd B. Nurick and the Law Office of Todd B. Nurick assist businesses in developing data-governance policies, evaluating incident-response readiness, and coordinating with technical experts when breaches occur.
Conclusion
Data privacy and cybersecurity are now integral to sound corporate governance. Pennsylvania and New York businesses must stay ahead of rapidly changing regulations. Partnering with knowledgeable counsel ensures your company protects its data, reputation, and future.
Todd B. Nurick and the Law Office of Todd B. Nurick stand ready to guide clients through evolving privacy and cybersecurity compliance challenges.
About Todd B. Nurick
Todd B. Nurick is a business attorney admitted in Pennsylvania since 1996 and New York since 2010, with approximately 30 years of experience advising businesses on contracts, transactions, corporate governance, investigations, compliance, employment-related business issues, risk management, and disputes. Through the Law Office of Todd B. Nurick, he also serves businesses as Fractional General Counsel/Outside General Counsel, providing experienced legal oversight without requiring a full-time in-house legal department.
Sources
Federal Trade Commission, “Privacy & Data Security” (FTC.gov)
Pennsylvania Breach of Personal Information Notification Act, 73 P.S. § 2301 et seq.
New York SHIELD Act, General Business Law § 899-aa & § 899-bb
National Conference of State Legislatures (NCSL), “State Privacy Legislation Tracker 2025”
This article is for general informational purposes only and does not constitute legal advice or create an attorney-client relationship. Businesses should obtain legal advice concerning their particular circumstances.
