New York's SHIELD Act is a data security law. It is not a camera law, and it does not mention cameras by name. But a business camera system is a computer network full of video, accounts and logs, and it often sits next to systems that hold employee records, customer details and payment information. If you own or license computerized data that includes private information of New York residents, the law expects you to protect it with reasonable safeguards, with a scaled standard for small businesses. This guide translates that idea into a practical checklist for small businesses that use cameras, and it flags the questions to take to your attorney.
This is general information, not legal or compliance advice. I am not telling you what the law requires of your business. Read the statute and ask an attorney.
1. The Short Version
| Area | Checklist item |
|---|---|
| Accounts | Unique logins, strong passwords, two-factor authentication. |
| Devices | Change defaults, update firmware, remove unused features. |
| Network | Separate cameras from payment and office systems. |
| Physical | Lock the recorder. |
| Vendors | Know who has access and limit it. |
| Data | Set retention and delete on schedule. |
| People | Train staff and remove access when they leave. |
| Incidents | Have a plan and know your notice duties. |
2. What the Law Is, in Plain Terms
The SHIELD Act amended New York's General Business Law. Section 899-bb requires businesses that own or license computerized data including private information of New York residents to develop, implement and maintain reasonable safeguards to protect the security, confidentiality and integrity of that information, with scaled expectations for small businesses. You can read the text at nysenate.gov. It also deals with notifying people after a breach. Whether your camera system holds "private information" under the law is a question for your attorney. A video of a customer's face may not, on its own, qualify. But account credentials, employee records and customer data stored on the same network might. The practical approach is to secure the whole environment.
3. Why Cameras Belong in the Conversation
Camera systems are frequent weak points. They often ship with default passwords, rarely get firmware updates, sit on the same network as the cash register and may be exposed to the internet for remote viewing. Attackers use them as doors into networks and as devices to join botnets. The Cybersecurity and Infrastructure Security Agency publishes practical guidance at cisa.gov, and the Federal Trade Commission has small-business security guidance at ftc.gov. Our guide on camera hacking and small-business cyber risk explains the common failures.
4. The Checklist: Accounts
- Every person who needs access has their own login.
- No shared "admin" password.
- Passwords are long, unique and not reused.
- Two-factor authentication is on for the app, the recorder and any cloud account.
- Departing employees and vendors lose access the same day.
- Admin rights are limited to one or two people.
- Access is reviewed every quarter.
5. The Checklist: Devices
- Default usernames and passwords are changed on every camera and the recorder.
- Firmware is current. Someone is responsible for updates.
- Unused features, such as remote services nobody needs, are disabled.
- A list of devices, models and firmware versions exists.
- Outdated or unsupported devices are replaced. The FCC maintains a Covered List of equipment deemed a national security risk; see fcc.gov, and read our guide on NDAA-compliant cameras.
6. The Checklist: Network
- Cameras and the recorder are on their own network segment, separate from point-of-sale and office computers.
- The router and switch have strong passwords and current firmware.
- No port forwarding from the internet to the recorder unless an expert configures and monitors it.
- Remote access uses a secure method recommended by the manufacturer or installer.
- Wi-Fi uses modern encryption and a strong password, with a separate guest network.
Our guides on network segmentation and on VPN vs. P2P remote access explain these steps.
7. The Checklist: Physical Security
- The recorder is in a locked closet or cabinet, not under the counter.
- Network equipment is secured and labeled.
- Cabling is protected from tampering.
- Cameras near doors are mounted out of easy reach or in vandal-resistant housings.
- Backup drives are stored securely.
8. The Checklist: Vendors
- You know which installers, IT contractors and monitoring companies have access.
- Each uses a named, separate account that can be disabled.
- Contracts address confidentiality.
- You know where cloud video is stored and who can access it.
- You know what happens to your data if you stop using the service.
Never give a vendor your main admin password.
9. The Checklist: Data and Retention
- A retention period is chosen and written down. Thirty days is a common planning figure.
- Footage is overwritten or deleted on schedule.
- Exports are logged: who, what, why and where it went.
- Exported clips are stored securely.
- A procedure exists for police, insurer and attorney requests. See our guides on retention policy templates and on lawyer and insurer requests.
10. The Checklist: People and Policy
- Employees are told where cameras are and why. See our guide on employee camera notices.
- Staff who can view footage understand confidentiality.
- A short written policy covers purpose, access, retention and requests.
- New hires get the policy and sign an acknowledgment.
- The policy is reviewed annually.
11. The Checklist: Incident Response
- Staff know who to call if they suspect a problem.
- You can change passwords and isolate devices quickly.
- Logs are preserved.
- You know your obligations to notify affected people and authorities after a breach, and you know who to ask. The statute includes notice provisions; ask your attorney.
- You have an offline copy of your device list and configuration.
12. News Context
Why do owners buy cameras? Because incidents happen. In September 2026, News 12 reported that NYPD sought two suspects in 19 commercial burglaries across 16 Brooklyn neighborhoods. In August 2026, ABC7 New York reported that thieves broke into several Bay Ridge restaurants overnight, with surveillance cameras capturing a hooded figure with a flashlight in a basement. A camera system that helps catch a thief should not become another way into your business.
NYPD reported burglary down 19.5% and retail theft down 15% citywide in May 2026 compared with May 2025 (NYPD).
13. Costs
Security improvements are often inexpensive. Planning ranges in 2026: a professional review and hardening of an existing system, $200 to $900; adding a managed switch and segmenting the camera network, $300 to $1,200; a new recorder with encryption and RAID, $800 to $3,500; annual maintenance plan with firmware updates, $300 to $1,500; a small business system with four to eight cameras installed securely, $1,800 to $6,800. Legal and compliance advice is separate. These are planning ranges, not quotes.
14. Questions to Ask Your Installer
- Will you change all default passwords and give me a record?
- Can you put cameras on their own network segment?
- How do you secure remote access?
- Who at your company can access my system, and how is it logged?
- How are firmware updates handled?
- Can you provide a device list and configuration summary?
See our local pages for commercial camera installation in Manhattan, business camera installation in Staten Island, commercial installation in the Bronx and our services page.
Not sure how exposed your recorder is? Revolvis will walk the property with you and mark the spots.
15. A Quarterly Ten-Minute Routine
Set a recurring reminder. Every quarter: review the user list and remove anyone who has left; confirm two-factor authentication is on; check for firmware updates; verify the recorder is locked and recording; play back a clip from two weeks ago; and review the export log. Write the date and your initials on a sheet. That page, kept with your policy, is simple evidence that you take reasonable care.
16. Documenting What You Did
Compliance is easier to explain when you can show a paper trail. Keep a folder with your device list, the dates passwords were changed, screenshots showing two-factor authentication turned on, your retention policy, vendor contact list and the quarterly review sheet. If an auditor, insurer or customer ever asks how you protect video and related data, you can hand it over in minutes. Store a copy off the recorder, and update it whenever the system changes.
More From Revolvis
Cameras are one layer of a secure property. The same in-house crew also handles the rest:
- Keyless entry installation and smart lock installation
- Access control systems and commercial access control
- Video doorbells and intercoms
- Alarm system installation
- Complete unified security
Learn more about Revolvis, meet the team, see all services, browse the blog or contact us.
Areas We Serve
Revolvis installs residential and commercial camera systems across the New York metro area. Every borough and county has its own building stock, rules and wiring challenges, so the plan for a Queens two-family is not the plan for a Manhattan co-op.
- Staten Island: houses, detached garages and shop fronts. See security camera installation in Staten Island.
- Brooklyn: brownstones, row houses and storefronts. See security camera installation in Brooklyn.
- Queens: attached brick homes, two-families and busy commercial strips. See security camera installation in Queens.
- The Bronx: pre-war buildings, bodegas and warehouses. See security camera installation in the Bronx.
- Manhattan: co-ops, condos, offices and retail. See security camera installation in Manhattan.
- Long Island: Nassau County and Suffolk County.
- New Jersey: Jersey City, Newark, Hoboken and nearby towns.
The full list is on the service areas page.
Get a Custom Quote After a Site Visit
Revolvis prices every job after a site visit, because the building sets the cost as much as the equipment does. A few things make the estimate faster and more accurate:
- The address and property type: house, apartment, co-op, condo, storefront or warehouse.
- Which doors, sides and areas you want covered, and what worries you most.
- Photos of those spots and any spots where you already have cabling or power.
- How many days of footage you want to keep and whether you want to watch on your phone.
- Any landlord, board, lender or insurer requirement.
Call 347-258-9165 or use the contact page to book a site visit. The quote you receive is written and itemized, so you can compare it line by line.
Frequently Asked Questions
Does the SHIELD Act apply to security cameras? It is a data security law. Whether your camera data counts as private information is a question for your attorney. Securing the whole environment is the safe approach.
What does reasonable safeguards mean for a small business? The statute scales expectations for small businesses. Ask counsel what it means for you.
What is the first thing I should do? Change default passwords, turn on two-factor authentication and lock the recorder.
Should cameras be on a separate network? Yes, ideally separate from payment and office systems.
What if my camera system is hacked? Change passwords, isolate devices, preserve logs, notify your installer and ask your attorney about notice duties.
Where can I read the law? The text of General Business Law section 899-bb is on the New York State Senate website.
Ready for a custom quote? Call Revolvis at 347-258-9165 for a site visit and a written, itemized estimate.
Safety note: A camera system supports, but does not replace, good locks, lighting, alarms and everyday habits. If you are in danger or witnessing a crime, call 911. Prices and legal summaries in this guide are general information for the New York metro area, not an offer or legal advice. A written quote after a site visit governs your actual price, and for legal questions you should confirm with the agencies linked in the article or a licensed attorney.