New York SaaS Agreement Review
New York has no comprehensive privacy act yet, but it has something unusual for business buyers: General Obligations Law 5-903, a decades-old rule that can make an automatic renewal unenforceable against a customer who did not get a written reminder. Add the SHIELD Act's security and 30-day breach rules and sales tax on remotely accessed software, and a Manhattan agency or Buffalo manufacturer has plenty to check in a SaaS agreement.
Consumer privacy law in New York
No comprehensive state privacy law yet
Data rights in New York
As of October 2026, New York has not enacted a comprehensive consumer privacy law. Federal rules and sector-specific laws still apply, but there is less of a statutory backstop, which means the SaaS contract itself is your main protection. Read the data-use, security, and deletion terms closely, because they carry more weight here.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
Can a New York business escape an auto-renewal?
GOL 5-903 covers contracts for servicing, maintaining or repairing real or personal property that renew automatically for more than one month. The renewal clause cannot be enforced unless the provider sends written notice, personally or by certified mail, 15 to 30 days before the customer's cancellation deadline. New York courts have applied the rule to business customers, though whether a given SaaS contract counts as a "service" contract depends on its terms.
For consumers, GBL 527-a goes further: annual plans need a reminder 15 to 45 days before the cancellation deadline, price increases need affirmative consent, and cancellation must be as easy as signing up.
What does the SHIELD Act require of vendors?
GBL 899-bb requires reasonable safeguards, including choosing service providers capable of protecting data and requiring those safeguards by contract. Under GBL 899-aa, affected residents must be notified within 30 days of discovering a breach, with notice to the attorney general, the Department of State and the State Police, and to DFS for entities it regulates. Consumer reporting agencies are told when more than 5,000 residents are notified.
Is SaaS taxable in New York?
Yes. New York treats remotely accessed prewritten software as a taxable sale of software, so expect state and local sales tax on most SaaS invoices. Ask the vendor to show the tax separately on the invoice.
New York sources checked 2026-10-09: N.Y. GOL 5-903 · N.Y. GBL 527-a · N.Y. GBL 899-aa. Laws change; confirm the current rule before relying on it.
New York SaaS agreement FAQ
Does New York have a data privacy law that affects SaaS contracts?
As of October 2026, New York has not enacted a comprehensive consumer privacy law, so there is less statutory backstop. That makes the SaaS contract itself your main protection, the data-use, security, and deletion terms carry more weight, so read them closely.
Can a SaaS vendor use my New York business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of New York law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in New York?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against New York law in about a minute.
What notice does a New York SaaS vendor owe before auto-renewing an annual plan for a consumer?
Under GBL 527-a, for an initial term of a year or more that renews for six months or more, the business must send a notice 15 to 45 days before the cancellation deadline, with instructions for cancelling. A material change such as a price increase needs separate advance notice, and an increase generally needs the consumer's affirmative consent.
How long does a vendor have to report a breach affecting New Yorkers?
The data owner must notify affected residents within 30 days of discovering the breach under GBL 899-aa, and a vendor holding data for someone else must tell the owner immediately. Put a short incident-reporting deadline in the SaaS contract so you can meet the 30-day limit and file the required state notices.
Reviewing a SaaS contract in New York?
Upload it and get the data, liability, and renewal terms checked against New York law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current New York law when you run your agreement, and you should confirm anything critical with a qualified attorney.