1. Definitions. (a) "Compliant regulated entity" shall mean any person or business that is subject to, and in compliance with, any of the following data security requirements:

1. (i) regulations promulgated pursuant to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. 6801 to 6809), as amended from time to time;
2. (ii) regulations implementing the Health Insurance Portability and Accountability Act of 1996 (45 C.F.R. parts 160 and 164), as amended from time to time, and the Health Information Technology for Economic and Clinical Health Act, as amended from time to time;
3. (iii) part five hundred of title twenty-three of the official compilation of codes, rules and regulations of the state of New York, as amended from time to time; or
4. (iv) any other data security rules and regulations of, and the statutes administered by, any official department, division, commission or agency of the federal or New York state government as such rules, regulations or statutes are interpreted by such department, division, commission or agency or by the federal or New York state courts.
5. (b) "Private information" shall have the same meaning as defined in section eight hundred ninety-nine-aa of this article.
6. (c) "Small business" shall mean any person or business with (i) fewer than fifty employees; (ii) less than three million dollars in gross annual revenue in each of the last three fiscal years; or (iii) less than five million dollars in year-end total assets, calculated in accordance with generally accepted accounting principles.

(b) A person or business shall be deemed to be in compliance with paragraph (a) of this subdivision if it either:

1. (i) is a compliant regulated entity as defined in subdivision one of this section; or

2. (ii) implements a data security program that includes the following:

   1. (A) reasonable administrative safeguards such as the following, in which the person or business:
   2. (1) designates one or more employees to coordinate the security program;
   3. (2) identifies reasonably foreseeable internal and external risks;
   4. (3) assesses the sufficiency of safeguards in place to control the identified risks;
   5. (4) trains and manages employees in the security program practices and procedures;
   6. (5) selects service providers capable of maintaining appropriate safeguards, and requires those safeguards by contract; and
   7. (6) adjusts the security program in light of business changes or new circumstances; and
   8. (B) reasonable technical safeguards such as the following, in which the person or business:
   9. (1) assesses risks in network and software design;
   10. (2) assesses risks in information processing, transmission and storage;
   11. (3) detects, prevents and responds to attacks or system failures; and
   12. (4) regularly tests and monitors the effectiveness of key controls, systems and procedures; and
   13. (C) reasonable physical safeguards such as the following, in which the person or business:
   14. (1) assesses risks of information storage and disposal;
   15. (2) detects, prevents and responds to intrusions;
   16. (3) protects against unauthorized access to or use of private information during or after the collection, transportation and destruction or disposal of the information; and
   17. (4) disposes of private information within a reasonable amount of time after it is no longer needed for business purposes by erasing electronic media so that the information cannot be read or reconstructed.