Personnel Records, New Rules: What NY Employers Need To Know

New York has entered the world of mandating access to personnel records.  Governor Kathy Hochul signed new legislation that grants employees and former employees a statutory right to inspect, copy, and dispute the contents of their personnel files. Senate Bill S3460 creates Section 210-b of the New York Labor Law—a comprehensive personnel-records-access framework that imposes significant new obligations on employers across the state. With an effective date of November 8, 2026, the clock is already running: employers have roughly 60 days from enactment to bring their recordkeeping operations into compliance. Jurisdictions like Massachusetts, California, and Illinois adopted personnel-file-access requirements long ago, leaving New York as a conspicuous holdout among the country’s largest (and employee-friendly) employment markets.

Who Is Covered

Coverage is sweeping. The law reaches every public- and private-sector employer in New York, and it defines “employee” to include both current workers and anyone who has separated from employment. The law places a three-year lookback window for former employees to  seek access to their records.  On the employer side, the statute captures individuals, corporations, partnerships, labor organizations, and all other commercial entities—together with their agents. One feature that warrants particular attention: the law’s reach extends to employee records that a third-party service provider holds under contract on an employer’s behalf. In practical terms, that means farming out personnel-file storage to an outside payroll company or HR technology platform leaves untouched an employer’s compliance obligations.

What Qualifies as a “Personnel Record”

A “personnel record” is any employer-maintained record that identifies an employee and bears on—or could bear on—decisions about that employee’s hiring, advancement, pay, or discipline. Beyond this broad functional test, the law lists specific categories of documents that must appear in every personnel file:

• Name, address, and date of birth
• Job title and description
• Rate of pay and other compensation
• Starting date of employment
• Job applications and resumes
• Performance evaluations and related documentation
• Written warnings of substandard performance
• Probationary period records
• Employee-signed waivers
• Dated termination notices and other disciplinary action documents

Information about someone other than the employee is carved out when its release would amount to an unwarranted invasion of that other person’s privacy. Employers should also bear in mind that separate federal, state, and local requirements—governing records like medical documentation or accommodation requests—may prohibit storing certain materials inside the personnel file at all.

Key Obligations

• Five-Business-Day Production Requirement. Once an employee or former employee submits a written request, the employer has five business days to deliver a full copy of the personnel file at no charge. An employer may cap routine access at two requests per calendar year—but any inspection triggered by the employer’s own addition of adverse material to the file falls outside that annual limit.
• Ten-Day Notice for Negative Information. Whenever an employer places material in the file that could adversely affect the employee’s standing—whether related to hiring, promotion, compensation, transfer, or discipline—it must notify the employee within 10 days. Notably, the law leaves “negative” undefined and says nothing about how notice should be delivered. Given that ambiguity, the safer course is to interpret the trigger broadly. Even informal written performance commentary that documents substandard work could fall within the statute’s scope.
• Employee Rebuttal Rights. The law builds in a dispute mechanism. When an employee objects to something in the file, the two sides may negotiate to amend or strike the contested entry. If they cannot reach agreement, the employee is entitled to file a written rebuttal setting out their own account. That rebuttal becomes a fixed part of the record going forward and must travel with the disputed material any time it is shared outside the organization.
• Three-Year Retention Obligation. Personnel files must be preserved intact—no deletions, no purges—from the employee’s start date through three full years after the employment relationship ends. Keep in mind that other federal, state, or local retention mandates may impose even longer preservation windows for particular categories of records.
• Anti-Retaliation Protections. Employers are barred from taking any adverse action—termination, threats, penalties, discrimination, or any form of reprisal—against workers who invoke their rights under the new law. The statute singles out immigration-related intimidation as a prohibited category, covering threats to report (or actual reporting of) an employee’s or family member’s immigration or citizenship status to federal, state, or local authorities.

Enforcement and Penalties

The New York Attorney General has exclusive enforcement authority, with civil fines running from $500 to $2,500 for each violation. Employees cannot bring private lawsuits under the statute. Separately, an employer that deliberately inserts false information into a personnel file may be exposed to additional remedial measures.

One important carve-out: the new law will not override a collective bargaining agreement that already provides unionized employees with personnel-file access rights that are at least as broad as those provided by the law. In other words, where a CBA already provides comparable or greater access to personnel records, the CBA’s existing provisions will continue to govern…

Anticipated Clarifications

In a memorandum accompanying her signature, Governor Hochul acknowledged that the bill’s text contains unresolved ambiguities and announced that she and legislative leaders have agreed to a Chapter Amendment—a follow-up bill the legislature commits to passing in a subsequent session. Two corrections are expected: (i) a clarification that the law does not require employers to build a personnel file from scratch or generate documents they have not previously maintained, and (ii) a tighter definition of “covered records,” limited to materials that have actually informed employment decisions such as hiring, retention, advancement, compensation, or discipline

The next legislative session begins in January 2027, at which point the Chapter Amendment is expected to move.

Takeaways

• Map your records landscape. Catalog every location where employee information currently lives—HRIS systems, individual manager desks, outsourced vendor databases, filing cabinets—and pressure-test whether a complete file can realistically be assembled and delivered within the five-day statutory window.
• Consolidate into a single source of truth. Build one organized file per employee that houses every document category the statute requires. Where paper records still predominate, digitization will make production faster and more reliable.
• Confirm vendor readiness. Touch base with payroll companies, staffing firms, PEOs, and HR technology providers that hold employee data on your behalf. Confirm they can locate and transmit responsive records on a timeline that lets you meet the five-business-day deadline.  Build this requirement into the vendor agreement.
• Stand up an intake-and-tracking protocol. Designate the people and systems responsible for receiving written access requests, logging them, and shepherding responses through to delivery—all within the statutory timeframe.
• Wire the 10-day adverse-notice requirement into existing workflows. Performance reviews, disciplinary write-ups, and corrective-action processes should each include a step confirming that the employee has been notified whenever adverse material enters the file. Assign clear ownership for issuing and documenting those notices.
• Design a rebuttal pathway. Employees who contest file entries are entitled to submit a written response. Build a process for accepting those statements, appending them to the record, and ensuring they accompany any future third-party disclosures of the disputed material.
• Revisit document-retention schedules. Verify that personnel files are preserved without deletions for at least three years after an employee’s departure, and update your retention policies and destruction calendars to reflect the new floor.  Consider the interplay of other laws with longer retention periods.
• Train employees before November 8. Managers, supervisors, and HR staff all need to understand the new rules—especially the adverse-notice obligation and the anti-retaliation protections—before the law goes live.

Looking Ahead

November 8, 2026 is the deadline for implementation, and the roughly 60-day runway between enactment and effectiveness leaves little room for delay. While the anticipated Chapter Amendment may refine the statute, none of the headline obligations—the five-day production period, the adverse-notice requirement, the three-year retention mandate, or the anti-retaliation safeguards—are expected to disappear. We will continue tracking legislative and regulatory developments as they emerge.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.