The New York SHIELD Act
New York's SHIELD Act sets data-security and breach duties; there is no comprehensive state consumer-privacy statute as of our last review. We build to those duties: encryption, least-privilege access, logging, and a breach-notification path documented before launch rather than improvised after.