New York State Grants Employees the Right to Access Personnel Files

New York State has enacted a law granting employees the right to access their personnel records, receive notice when negative information is added, and submit written rebuttals. The law, which is expressly modeled on Massachusetts’s Personnel Record Law, takes effect on Nov. 8, 2026.

On Sept. 9, 2026, Governor Kathy Hochul signed Senate Bill S3460, adding new Section 210-b to the New York Labor Law. The law applies to both private- and public-sector employers and extends access rights to current and former employees alike. According to the governor’s office, New York now joins at least seventeen other states with a personnel-file access requirement.

Governor Hochul signed S3460 at the state’s annual Labor Appreciation Reception at the City University of New York’s (CUNY) School of Labor and Urban Studies, underscoring the labor-friendly legislative environment in Albany ahead of the upcoming gubernatorial election. The law takes effect on the sixtieth day after signing, or Nov. 8, 2026.

Sample Policy: Access to Employee Personnel File Policy

What Counts as a Personnel Record

The statute defines a “personnel record” broadly as “a record kept by an employer that identifies an employee, to the extent that the record is used, has been used, or may affect or be used relative to that employee’s qualifications for employment, promotion, transfer, additional compensation, or disciplinary action.”

That definition is not limited to a physical or single folder maintained by human resources (HR). The law specifically requires that personnel records include, without limitation, the following written information or documents prepared by the employer:

• The employee’s name, address, and date of birth.
• The employee’s job title and description.
• The employee’s rate of pay and other compensation.
• The employee’s starting date of employment.
• The employee’s job application and resume.
• All performance evaluations of the employee.
• Written warnings of substandard performance.
• Lists of probationary periods.
• Waivers signed by the employee.
• Copies of dated termination notices.
• Any other documents relating to disciplinary action.

The definition also extends to records held by third-party vendors who have a contractual agreement with the employer to keep or supply personnel records. The one limitation is that a personnel record does “not include information of a personal nature about a person other than the employee if disclosure would constitute a clearly unwarranted invasion of [that] other person’s privacy.”

Notably, the statute’s use of “without limiting the applicability or generality of the foregoing” suggests that the enumerated list is expansive. Emails, investigation notes, informal disciplinary memos, and records maintained outside a traditional HR file may qualify if they are used or could be used in connection with employment decisions. The precise boundaries of this definition will likely be shaped by future guidance or litigation.

Sample Policy: Record-Keeping Policy — Record Maintenance, Retention and Destruction 

The Five-Business-Day Clock and Limits on Requests

Once the law takes effect, an employer that receives a written request from an employee must provide a complete copy of the employee’s personnel record, at no cost, within five business days. Employers may limit employees to two requests per calendar year, but a request triggered by the placement of negative information in the file does not count toward that cap.

The right to access personnel records extends to former employees as well. The statute defines “employee” as “a person currently employed or formerly employed by an employer.” However, employers are required to retain a complete personnel record (without deletions or expungement) only from the date of hire through three years after separation. Former employees who make a request after that three-year window may find that the employer is no longer obligated to maintain the record, though the statute does not impose a deadline on the former employee’s right to make a request.

For employers with decentralized HR operations, multiple worksites, or a mix of paper and electronic recordkeeping systems, operationalizing a five-business-day turnaround may require significant resources.

HR Q&A: What should, and should not, be included in the personnel file?

Notice of Negative Information and the Right to Respond

Perhaps the most significant and ambiguous aspect of the new law is the notice-and-rebuttal requirement. The statute requires employers to notify an employee within ten days of placing in the employee’s personnel record any information that is, has been used, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or the possibility that the employee will be subject to disciplinary action.

The breadth of this language raises practical questions. A written warning or a performance improvement plan would almost certainly trigger the notice obligation. But what about a mediocre but not overtly negative performance review? Or an email from a manager documenting a performance conversation? The statute does not clearly define what it means to “negatively affect” an employee’s qualifications, and the word “may” suggests the obligation could be interpreted very broadly. These questions are likely to remain unresolved until the Attorney General’s office issues guidance or litigation tests the boundaries.

Once notice is given, the employee has the right to respond. If the employee disagrees with any information in the file, the employer and employee may mutually agree to remove or correct it. If they cannot reach agreement, the employee may submit a written statement explaining the employee’s position, which then becomes a permanent part of the personnel record. That statement must be included whenever the underlying information is transmitted to a third party, so long as the original information is retained in the file.

The law also provides employees with a remedy for false information: if an employer places information in a personnel record that the employer “knew or should have known to be false,” the employee may seek expungement through a collective bargaining agreement, other personnel procedures, or the judicial process.

Enforcement and Penalties

The statute provides that any violation “shall be punished” by a fine of between $500 to $2,500. Enforcement authority rests exclusively with the Office of the New York Attorney General.

Notably, the statute does not appear to create an express private right of action for violations of the access, notice, or response provisions. The enforcement language mirrors the structure of the Massachusetts statute, which similarly channels enforcement through the state’s attorney general rather than through individual lawsuits for statutory violations. That said, the statute does create a separate right of action for employees seeking to expunge false information from their personnel records.

Whether the absence of a broader private right of action will limit the statute’s practical enforcement remains to be seen. Under the Massachusetts model, the limited enforcement mechanism provided for criminal fines enforceable by the attorney general ultimately left a gap that the courts ultimately filled through the common law, as discussed below.

Toolkit: Complying with Employment Record Requirements 

Anti-Retaliation Protections

The statute includes an express anti-retaliation provision that goes beyond its Massachusetts counterpart. Section 210-b(8) provides that no employer “shall discharge, threaten, penalize, or in any other manner discriminate or retaliate against any employee who exercises such employee’s rights under this section.”

The statute further defines prohibited retaliation to include, but not be limited to, “threatening to contact or contacting United States immigration authorities or otherwise reporting or threatening to report an employee’s suspected citizenship or immigration status or the suspected citizenship or immigration status of an employee’s family or household member.”

This anti-retaliation language is significant for several reasons. First, it establishes an explicit statutory prohibition on retaliation that the Massachusetts statute does not contain (though under Massachusetts law, an employee discharged for submitting a written rebuttal in response to the placement of negative information in his personnel file can state a claim against the employer for wrongful termination in violation of public policy). Second, it sweeps broadly: the phrase “in any other manner discriminate or retaliate” could encompass a wide range of adverse employment actions, from termination and demotion to less obvious forms of retaliation such as schedule changes, reassignments, or exclusion from opportunities. Third, the immigration-specific language reflects the legislature’s awareness of vulnerable worker populations and is consistent with a trend in recent New York employment legislation.

However, the statute does not specify the enforcement mechanism for the anti-retaliation provision. It is not clear whether the “enforced by the attorney general” language in Section 210-b(7) is meant to apply to retaliation claims under Section 210-b(8), or whether the retaliation provision creates an independent basis for an employee to bring a private claim. This ambiguity is likely to generate future litigation.

What Employers Can Do Now

With an effective date of Nov. 8, 2026, employers operating in New York should consider taking the following steps:

• Auditing existing records and storage practices. Determine what is currently maintained in personnel files, where those files reside, and whether they align with the statute’s broad definition of “personnel record.”
• Building a request-response process. Establish a clear intake process for written requests, designate responsibility for compiling records, and create a workflow that can consistently produce a complete copy within the five-business-day window.
• Developing a negative-information protocol. Create procedures for identifying when information that may negatively affect an employee is added to a file, issuing the required ten-day notice, and receiving and filing employee rebuttal statements.

Given the ambiguities in the statute’s enforcement provisions, the potential for additional retaliation claims, and the short compliance windows, employers will want to ensure that their policies, practices, and training programs are aligned with the new law.

Aaron Warshaw is an attorney with Ogletree Deakins in New York City. © 2026 Ogletree Deakins. All rights reserved. Reposted with permission.