Labor and Employment

New York Joins Growing List of States Requiring Employee Access to Personnel Records

September 11, 2026

By Joseph "Joe" Flanagan

New York Joins Growing List of States Requiring Employee Access to Personnel Records

After Governor Kathy Hochul signed S.3460 into law on September 9, 2026, New York is now one of 18 states that  require employers to provide employees access to their personnel records. The statute will apply in both public and private sectors employees and former employees, effective November 8, 2026.

Expanded Definition of “Personnel Record,” Record Retention Requirement

The new law defines "personnel record" as records that are used, have been used, or may be used in connection with decisions concerning an employee's qualifications for employment, promotion, transfer, compensation, or discipline. The definition also extends to records maintained by third-party vendors acting on behalf of an employer.

As a result, employers may need to evaluate not only the contents of formal personnel files, but also records maintained through payroll providers, HR platforms, and other personnel administration services. Employers will also have to determine whether manager working notes, internal communications regarding employee performance, draft evaluations, or portions of investigative files are subject to disclosure. Although the law excludes certain information that would constitute an “unwarranted invasion” of another individual's privacy, it provides limited guidance on how that exclusion should operate in practice when employers are balancing employee access rights against confidentiality concerns.

Employers must retain complete personnel records during an employee's employment and for three years following separation.

When Access and Notice Requirements are Triggered

The statute has a straightforward requirement for scenarios where an employee requests access to their file. Upon receiving a written request, employers will be required to furnish personnel records within five business days at no cost to the employee. Employees are entitled to review their personnel records twice in a calendar year.

But the statute creates an unclear requirement for scenarios where an employer adds items into the personnel file that could “negatively affect” the employee. Specifically, if there is any item added to the personnel file that could “negatively affect the employee's qualification for employment, promotion, transfer, additional compensation or the possibility that the employee will be subject to disciplinary action,” it must notify employees within 10 days.

In its current form, the law does not define what constitutes “negative” information, which will likely create substantial compliance questions. For example, it is unclear whether routine coaching memoranda, attendance records, customer complaints, investigatory materials, manager notes, performance improvement plans, or preliminary performance concerns trigger the notice obligation. Similarly, employers may struggle to determine whether information becomes "negative" only after a disciplinary decision has been made or whether notice is required whenever a document could potentially influence a future employment decision.

Right to Respond to Information in File

The new law allows employees to submit written statements contesting information contained in their personnel records. If the employer and employee cannot agree on whether the challenged information should be removed from the personnel file, the employer will be required to include the employee’s contention in their personnel file. The statute also provides employees with an avenue to expunge contested information through the “judicial process” with relatively little guidance regarding how disputes involving subjective performance evaluations or disputed factual conclusions should be resolved.

Government Entity in Charge of Enforcing Statute

The New York State Attorney General’s Office is responsible for enforcing this new law. Violations of the statute may result in civil penalties ranging from $500 to $2,500. The law also prohibits retaliation against employees who exercise their rights under the statute.

As a result of the ambiguities surrounding what information constitutes a “personnel record,” when information added to a personnel file “negatively affects” an employee, and the particular process an employee needs to follow in order to successfully “expunge” an item in their personnel record, the New York State Attorney General’s Office may weigh in to provide guidance on how it plans to enforce this law. In the meantime, employers will be required to make judgment calls regarding the scope of the notice requirement until courts or regulators provide guidance.

Conclusion

With the November 8, 2026, effective date rapidly approaching, employers should begin reviewing personnel record practices, assessing the records maintained by third-party vendors, updating retention protocols, and developing procedures for responding to employee requests within the statute's five-business-day deadline. Employers should also consider training human resources personnel and managers regarding the law's notice requirements, particularly given the uncertainty surrounding what information may be considered "negative."

While the law clearly reflects New York's intent to expand employee access to personnel information, many of its most consequential provisions remain open to interpretation. As employers prepare for implementation, the greatest compliance challenge may not be producing personnel records, but determining when the statute requires notice of information that could be viewed as having a negative impact on an employee's career. Until additional guidance emerges, employers should take a cautious approach and closely monitor developments surrounding this significant change to New York employment law.

Related People

Related Services

  • Overview
  • People
  • Labor and Employment Law Blog
  • Publications & News
  • Events

Firm Highlights

  • Events
    AIA Tri-State Conference
    Princeton will serve as the backdrop for three days of connection, learning, and design leadership. From keynotes to tours to the Tri-State Design Awards, this year’s conference is designed to go far beyond education sessions. Kick off the week with pre-conference intensives and individual state component Design Award celebrations, followed by three days of education, inspiration, networking, and design excellence at the 2026 AIA Tri-State Conference—featuring pre-conference intensives, three keynote speakers, 25 education sessions, curated tours, an expo, spec academies, and the AIA Tri-State Design Awards—bringing together architects and design professionals from New Jersey, New York, and Pennsylvania to connect, learn, and celebrate the best of the profession. G2. Designing Secure Practices: Cybersecurity, Data Privacy, Contractual Provisions, and Insurance Risks for Architects (4:00 PM - 5:30 PM) Architects and design professionals increasingly rely on cloud platforms, BIM software, and digital tools to manage sensitive data, creating cybersecurity and privacy risks. A single incident can trigger liability claims, regulatory obligations, reputational harm, and insurance challenges. Yet many firms underestimate how contracts, insurance, and internal practices intersect during a breach. This program offers legal and insurance perspectives on cyber risk in architecture, examining liability exposure, risky contract provisions, and mitigation strategies. A cyber insurance expert will explain policy responses, coverage gaps, coordination with professional liability, and best practices for aligning insurance with contractual risk and protecting firms from evolving cyber threats. Learning Objectives: Identify key cybersecurity and data privacy risks faced by architecture firms and explain how these risks can impact professional liability and project outcomes. Analyze common contractual provisions to determine which clauses may increase exposure to cyber incidents and propose strategies to mitigate these risks. Evaluate the scope and limitations of cyber insurance policies, including coordination with professional liability coverage, to determine how a policy would respond in a breach scenario. Develop actionable risk management strategies by integrating legal, contractual, and insurance considerations to protect sensitive client and project data.
  • Events
    The 2026 Economic, Tax, and Accounting Updates
    We are looking forward to the Mid-Atlantic CFO Roundtable's next event on November 13, 2026. This is a program with topics built for Finance Executives. We are extremely fortunate to have three excellent speakers: Dr. Daraius Irani, Vice President of Business and Public Engagement at Towson University; Mike Stankus, Tax Office Managing Principal at BDO; and Daniel Wahlberg, Managing Partner of Acclare Solutions. The economy is rapidly changing with various factors driving it. The November 3rd midterm elections may also have an impact. Our three expert presenters will discuss the ramifications of the election, and the current year updates to GAAP financial reporting and Federal and State income taxes. Please join us for what will surely be an informative and timely discussion. Meet Our Speakers: Daraius Irani, Ph.D. • Towson University Vice President, Business & Public Engagement Dr. Daraius Irani serves as Vice President of Business and Public Engagement at Towson University as well as the chief economist for the Regional Economic Studies Institute (RESI) at Towson University, a policy group providing economic, fiscal impact, and policy analysis to public and private entities.  Dr. Irani is often called upon to provide economic presentations to organizations across Maryland. He has appeared on numerous television programs and in local and regional print media. Dr. Irani holds a Ph.D. in economics from University of California, Santa Barbara. Dan Wahlberg • Acclare Solutions Managing Partner With over 28 years of experience, Dan Wahlberg is a recognized leader in audit and assurance for the Mid-Atlantic’s middle market business community. As a licensed CPA in Maryland and Virginia, Dan has led assurance practices at top regional firms, including serving as Baltimore Audit Managing Partner and Assurance Practice Leader at BDO USA in Baltimore and as Partner and member of the Management Committee at Hertzbach & Company P.A which merged into BDO in 2020. His expertise centers on delivering clarity, strategic guidance, and proactive solutions to middle-market businesses across Baltimore and beyond. His entrepreneurial spirit has led him to begin a new CPA firm this year with four other CPAs serving the business community. Dan holds a Bachelor of Science in Accounting from Rutgers University and began his career at PWC in New York. He is also deeply engaged in the community, previously serving as President of ACG Maryland and current Board member and as Audit Committee Member for The Associated: Jewish Federation of Baltimore.  Mike Stankus • BDO USA LLP Tax Office Managing Principal Mike Stankus is the Tax Office Managing Principal for the firm’s Baltimore office. He has more than 16 years of experience providing tax planning and preparation and management advisory services for his clients. Mike focuses on advising privately held businesses and their owners on effective growth and tax strategies. He also performs various engagements for mergers and acquisitions and complex cost accounting projects and projections. In addition, he represents various government contracting clients before the DCAA and assists with FAR compliance. Mike’s areas of concentration include working with government contractors, professional service firms, construction companies, and homebuilders.