New York Consolidated Laws, General Business Law - GBS § 899-gg. Processors

(a) process the personal data of covered users only pursuant to the instructions of the operator, unless otherwise required by federal, state, or local laws, rules, or regulations;

(b) assist the operator in meeting the operator's obligations under this article.  The processor shall, taking into account the nature of processing and the information available to them, assist the operator by taking appropriate technical and organizational measures, to the extent practicable, for the fulfillment of the operator's obligation to delete personal data pursuant to section eight hundred ninety-nine-ff of this article;

(c) upon reasonable request of the operator, make available to the operator all information in its possession necessary to demonstrate the processor's compliance with the obligations in this section;

(d) allow, and cooperate with, reasonable assessments by the operator or the operator's designated assessor for purposes of evaluating compliance with the obligations of this article.  Alternatively, the processor may arrange for a qualified and independent assessor to conduct an assessment of the processor's policies and technical and organizational measures in support of the obligations under this article using an appropriate and accepted control standard or framework and assessment procedure for such assessments.  The processor shall provide a report of such assessment to the operator upon request;  and

(e) notify the operator a reasonable time in advance before disclosing or transferring the personal data of covered users to any further processors, which may be in the form of a regularly updated list of further processors that may access personal data of covered users.