Open Book: New York’s New Personnel Records Access Law (NYLL 210-b)

It’s a Tuesday morning in mid-November. Your office manager hands you a letter. It’s from an employee you terminated two months ago, and it’s exactly one sentence long: a written request for a complete copy of her personnel record.

You have five business days to hand over everything. Every evaluation. Every write-up. Every warning. That email chain where her supervisor vented about her attitude. The note a manager scribbled after a tense meeting and tossed in the file. All of it, free of charge, delivered to the one former employee you least want reading it, and quite possibly to the plaintiff’s attorney standing right behind her.

You pull the file. You start reading it the way she’ll read it. The way a jury might read it. And somewhere around page four, your stomach drops.

Welcome to the open book era of New York employment law.

On September 9, 2026, Governor Hochul signed Senate Bill S3460, adding a brand new Section 210-b to the New York Labor Law. It takes effect November 8, 2026, sixty days after signing. That’s three weeks from the date this article publishes. For decades, New York private employers enjoyed something rare in employment law: near-total discretion over personnel files. No general statute forced you to show employees what you’d written about them. That era ends in twenty-one days.

The Plain English Rule

Here’s what the new law says, stripped of the legislative formatting:

If a current or former employee sends you a written request, you must give them a complete, free copy of their personnel record within five business days. Not a summary. Not the highlights. The record.

You can limit employees to two requests per calendar year, with one important exception covered below. You must tell an employee within ten days whenever you put negative information into their file. If the employee disagrees with something in the file and you won’t remove or correct it, they get to write a rebuttal, and that rebuttal becomes a permanent part of the record that travels with the disputed information wherever it goes.

You also can’t clean up the file after the fact. The law requires you to maintain the complete record, without deletions or expungement, from the date of hire through three years after separation. And if you retaliate against anyone for using these rights, you’ve violated the statute separately.

That’s the whole architecture: access, notice, rebuttal, retention, anti-retaliation. Five pillars, each with its own trap doors.

Want the five pillars on one page? Our New Employee Onboarding Compliance Checklist puts every deadline, cap, and fine on a single printable sheet, plus the steps to build each new hire’s file right from day one.

The Technical Breakdown: What Section 210-b Actually Requires

Time to walk through the statute the way a compliance officer, or an Attorney General investigator, will.

Who’s covered

Everyone. The statute reaches all employers regardless of size, private and public alike, and extends to their agents. It covers current employees and former employees. That last part deserves a beat of silence. The people most motivated to request their files are the ones you’ve already let go, and the statute hands them a right that survives the end of the employment relationship.

What counts as a “personnel record”

The definition is broad, and broad is doing heavy lifting in that sentence. The record includes, at minimum:

• Name, address, and date of birth

• Job title and description

• Rate of pay and compensation history

• Starting date of employment

• The application and resume

• All performance evaluations

• Written warnings and disciplinary documents

• Probation lists

• Signed waivers

• Notices of termination

And here’s the part that should reorganize your thinking: the record isn’t defined by which folder a document sits in. It’s defined by function. Anything that is, has been, or may be used to affect the employee’s qualifications for employment, promotion, transfer, compensation, or discipline is fair game. Emails between managers about an employee’s performance may qualify. Investigation notes may qualify. The informal memo a supervisor wrote “just to have something on file” may qualify. If it could touch an employment decision, treat it as part of the record.

The statute even reaches records held by third-party vendors under contract with you. Outsourcing your HR files doesn’t outsource your obligation.

There’s one meaningful carve-out: information about other people whose disclosure would constitute a clearly unwarranted invasion of their personal privacy. So the co-worker who complained confidentially about your employee doesn’t automatically get outed. But that exclusion is narrow, and it protects the other person’s privacy, not your convenience.

The access right: five days, free, complete

Upon written request, you must provide a complete copy of the personnel record within five business days, at no cost to the employee. Read that timeline again. Five business days is one payroll cycle. It’s not enough time to reconstruct a filing system, chase down documents from three managers’ desk drawers, and get counsel to review the production. It’s only enough time to execute a process you built in advance.

Employers may cap requests at two per calendar year. But there’s an exception with teeth: a request triggered by the placement of negative information in the file doesn’t count against the cap. So an employee who’s been written up three times in a year can, as a practical matter, see the file after each write-up, on top of the standard two requests.

The notice duty: ten days for negative information

This is the provision most employers will miss, because it’s not triggered by anything the employee does. It’s triggered by you.

Whenever you place negative information in a personnel record, you must notify the employee within ten days. “Negative information” means anything that is, has been, or may be used to negatively affect the employee’s qualifications for employment, promotion, transfer, additional compensation, or disciplinary action.

Think about what that covers in a normal week at a normal business. A written warning, obviously. But also a performance improvement plan. A customer complaint added to the file. A manager’s email documenting a missed deadline, if it lands somewhere it could influence a future decision. The quiet note that says “do not consider for promotion.”

For a deeper look at why sloppy, emotional, or off-the-cuff documentation blows up in litigation, revisit Discipline Disasters. Every principle in that article now has a statutory enforcement mechanism, because under 210-b, the employee will actually read what you wrote, and read it soon.

The rebuttal right: the employee gets the last word, permanently

If an employee disagrees with information in the file and you can’t reach an agreement to remove or correct it, the employee may submit a written statement explaining their position. That statement becomes a permanent part of the personnel record. And whenever the disputed information is transmitted to a third party, the rebuttal must go with it.

Sit with the implications. That reference check where you fax over the disciplinary history? The rebuttal rides along. The file produced in litigation? Rebuttal included. You no longer control the narrative inside your own filing cabinet. The file becomes a dialogue, and the employee’s side of the conversation can’t be edited out.

The retention duty: three years, no deletions

You must maintain the complete personnel record from hire through three years after separation, with no deletions and no expungement. The cleanup instinct, the one that says “let’s purge the old write-ups” or “that memo was harsh, pull it,” is now itself a violation. The file is a permanent ledger for the statutory period.

There’s one sanctioned path to removing information: expungement of information the employer knew or should have known was false. That remedy runs through a collective bargaining agreement’s procedures, the employer’s own personnel procedures, or the courts. It’s a corrective tool for falsehoods, not a shredder for embarrassments.

Enforcement: the Attorney General, fines, and the retaliation trap

Section 210-b is enforced by the New York Attorney General, with civil fines of $500 to $2,500 per violation. Notice the phrase “per violation.” A late production is a violation. A missing ten-day notice is a violation. Multiply across employees and across incidents, and the math compounds quickly.

The statute doesn’t contain an express general private right of action, meaning employees can’t obviously sue directly for a botched records request by itself. But don’t relax yet. Subsection 210-b(8) contains an express anti-retaliation provision, and it’s muscular. Employers can’t discharge, threaten, penalize, or in any other manner discriminate or retaliate against an employee for exercising rights under the section. The provision explicitly reaches threats to contact immigration authorities. Retaliation claims are where “no private right of action” statutes grow teeth, and New York juries don’t like retaliators.

One more piece of context that tells you where this is heading: the statute is modeled on the Massachusetts Personnel Record Law (MGL c. 149, s. 52C), which has been on the books for decades. Massachusetts practice offers a preview of the disputes to come: fights over what counts as the “record,” fights over completeness, and fights over notice timing. New York didn’t invent this framework. It imported one with a litigation track record.

Where Employers Get Burned

The statute’s requirements are clear enough on paper. The burns come from the gap between how the law defines a personnel record and how your business actually stores information.

Burn one: the file that lives in six places. Most businesses don’t have a personnel file. They have a personnel diaspora: the official folder in HR, the manager’s desk drawer, the email archive, the shared drive, the group chat, and the third-party HRIS platform. Five business days is not enough time to take a census. Employers will produce the official folder, certify it as complete, and discover in litigation that the record also included forty emails nobody gathered. Now the problem isn’t just a statutory fine; it’s an incomplete production that looks like concealment.

Burn two: the ten-day notice nobody sends. The access right at least waits for an employee to ask. The notice duty fires automatically, every time negative information enters the file, in every department, all year long. Businesses without a centralized documentation workflow will violate this provision constantly and invisibly. Every unsent notice is a $500 to $2,500 problem waiting for an Attorney General inquiry to find it.

Burn three: the purge reflex. Some well-meaning manager will read about the new law, panic about what’s in the files, and start cleaning. Under 210-b’s retention rule, that cleanup is itself unlawful. Worse, if litigation follows, deleted documents become a spoliation story, and spoliation (the legal term for destroying evidence you had a duty to preserve) lets a jury assume the missing documents said whatever the employee claims they said.

Burn four: the vendor blind spot. Records held by third-party vendors under contract are part of the record. Your PEO’s files, your background check vendor’s reports in your custody, the performance data in your cloud HR platform: if it fits the definition, it’s in scope. Most vendor contracts signed before 2026 say nothing about five-day turnarounds. Yours needs to, now.

Burn five: the retaliation reflex. An employee requests their file, and a manager mutters “why, are you lawyering up?” Two weeks later that employee’s hours get cut. Congratulations, you’ve converted a paperwork statute into a retaliation claim with an express statutory hook. The request is protected activity. Treat every requester exactly as you treated them the day before the request arrived.

Case Study: Getting It Wrong

^{Note: This is a hypothetical scenario based on patterns from real compliance audits. No real business is depicted.}

Meet Brightside Dental & Medical Group, a mid-size practice group with four locations across Queens and Nassau County: two dental offices, a pediatrics practice, and a multi-specialty clinic. Ninety-two employees. A practice administrator named Dana runs HR for all four sites out of the flagship office, assisted by a spreadsheet, a wall of filing cabinets, and heroic amounts of coffee.

In early October 2026, Brightside terminates Marisol, the office manager at the Nassau dental location. The stated reason: chronic scheduling errors and two patient complaints. The real story is messier. Marisol had clashed for a year with the location’s senior dentist, who documented their conflicts in long, heated emails to Dana with subject lines like “MARISOL. AGAIN.” None of those emails ever made it into the official file. Neither did the write-up the dentist drafted in August, which he kept in his desk because “HR takes forever.”

On November 10, two days after Section 210-b takes effect, Dana receives a certified letter. Marisol requests a complete copy of her personnel record. Dana, who has vaguely heard about the new law from a payroll newsletter, figures it works like a subpoena: surely there’s time, surely a lawyer gets involved first. She sets the letter aside for the following week’s file room day.

Mistake one: the five-business-day clock started when the request arrived. Nobody calendared it.

On day nine, Dana photocopies the official file, thirty-one pages, and mails it. The production is late, and it’s incomplete. It doesn’t include the dentist’s write-up, the email war, or the note in the practice’s cloud HR platform flagging Marisol as “ineligible for rehire,” a designation nobody ever told her about.

Mistake two: no ten-day notice had ever been sent for any of the negative information placed in Marisol’s file that fall, including the rehire flag entered the day after her termination.

Marisol’s attorney, meanwhile, sends her own letter: a litigation hold notice hinting at a discrimination claim, and a second records request. The senior dentist, panicking, deletes his email folder about Marisol and shreds the desk-drawer write-up. “It wasn’t in the file anyway,” he tells Dana.

Mistake three: the retention provision prohibits deletions and expungement, and the practice was on notice of potential litigation. This isn’t housekeeping. It’s spoliation with a statutory violation attached.

When Marisol receives the thirty-one-page production, she notices what’s missing, because the dentist had once forwarded her one of his rant emails by mistake. Her attorney now has the perfect narrative: the employer hid the real file, never gave the required notices, produced late, and destroyed documents. She submits a written rebuttal statement disputing the two patient complaints, which Brightside must now attach to the disputed documents forever, including in the reference responses two prospective employers request that winter.

The Attorney General’s office, responding to a complaint Marisol’s attorney files, opens an inquiry. It doesn’t stop at Marisol. It samples ten personnel files across all four locations and finds the same pattern everywhere: shadow files, unsent notices, no request-response procedure at all.

Here’s what Brightside’s counsel presents to the partners at the year-end meeting:

The discrimination claim itself was arguably defensible. Marisol’s scheduling errors were real. But Brightside never got to litigate the merits, because the records violations poisoned everything around them. The file didn’t tell the story. The missing file did.

An investigator who finds one shadow file assumes there are more, and samples accordingly. The fine structure is per violation, and violations multiply across employees, entries, and locations. A single-employee dispute becomes an organization-wide audit fast.

Case Study: Getting It Right

^{Note: This is a hypothetical scenario based on patterns from real compliance audits. No real business is depicted.}

Now meet Meridian Advisory Partners, a forty-person accounting and consulting firm in White Plains. Meridian’s operations director, Priya, reads about S3460 in mid-September 2026, the week after the signing. She doesn’t panic. She schedules a two-hour meeting with the firm’s employment counsel and walks out with a project plan and a hard deadline of November 1, one week ahead of the effective date.

October becomes file month. Priya consolidates every location where employee information lives: the HR drive, the partners’ email folders, the performance review platform, and the payroll vendor’s portal. Anything that fits the statutory definition gets indexed into a single digital personnel record per employee. Shadow documentation is either filed properly or, where it’s stale duplicative scratch material that never influenced any decision, evaluated with counsel before anything is touched. Nothing is deleted after the review flags it as part of a record.

She builds three one-page protocols. A request-response workflow: requests go to a single inbox, the clock is logged same day, production goes out by day four with counsel review built in. A negative-information notice: a standard form that goes to the employee within ten days of any adverse entry, with a copy filed in the record. A rebuttal procedure: disagreements get a meeting first, and if no agreement is reached, the employee’s statement is attached to the disputed document with a metadata flag so it travels with any transmission.

Then she trains the partners, which is the hard part. One senior partner objects that the notice requirement will “start arguments.” Priya’s answer is the right one: “The argument already exists. The notice just means we have it now, while she still works here, instead of in a deposition.”

The system gets its first live test in January 2027. A senior associate who was passed over for promotion requests his file. The production goes out in three business days, complete, with every evaluation and the promotion committee’s documented criteria. He reads it, sees a consistent, specific, factual record, two strong years followed by a documented dip that his own self-reviews acknowledged, and requests a meeting instead of a lawyer. He’s promoted eighteen months later. No claim is ever filed, so there’s nothing to be withdrawn; the dispute simply never becomes one.

Total cost of Meridian’s entire readiness project: about $9,000 in counsel time and roughly sixty internal hours. Less than three percent of Brightside’s exposure.

The Takeaway Framework: The Open Book Protocol

Three weeks. That’s the runway between this article and November 8. Here’s the readiness checklist to run before the law goes live, five steps, in order. Call it the Open Book Protocol, because that’s what your files are about to become.

Step 1: Find the whole book (this week). Inventory every place employee information lives: official files, manager desk drawers, email folders, shared drives, HR platforms, and third-party vendors. The statutory record is defined by function, not filing location, so the inventory is the foundation everything else stands on. You can’t produce in five days what you can’t find in thirty.

Step 2: Bind the book (week two). Consolidate into one complete record per employee, current and former, and freeze it. No deletions, no purges, no “cleanup,” from hire through three years after separation. If something in a file is genuinely false, use the lawful expungement path with counsel; don’t reach for the shredder. While you’re in the files, add what’s missing too: a record that’s all warnings and no praise reads like a prosecution brief, not a management history.

Step 3: Build the five-day machine (week two). One intake point for written requests, a same-day logging rule, a day-five deadline calendared automatically, counsel review slotted inside the window, and free, complete production every time. Decide now how you’ll apply the two-per-year cap and how you’ll recognize the exception for requests triggered by negative entries. A workflow invented during your first request is a workflow that fails.

Step 4: Wire the ten-day alarm (week three). Create a standard negative-information notice and make it fire automatically whenever an adverse entry hits a file: warnings, PIPs, complaints, flags, anything that may affect employment decisions. Pair it with the rebuttal procedure, so disagreement has a channel that isn’t a courtroom. This is the step that runs forever, so make it boring, routine, and impossible to skip.

Step 5: Brief every reader and writer (before November 8). Train managers on two truths: everything they write may be read by the employee within days, and every request must be forwarded to HR the hour it arrives. Then deliver the anti-retaliation message in plain terms: a records request changes nothing about how that employee is treated, and threats of any kind, including immigration-related threats, are radioactive under 210-b(8). While you’re gathering the team, hand new managers this month’s downloadable, the New Employee Onboarding Compliance Checklist (NY), so files are built right from day one instead of repaired later.

Final Thoughts

Every so often a statute comes along that doesn’t create a new obligation so much as it removes a hiding place. Section 210-b is one of those. Nothing in this law requires you to document differently than good management always demanded: factually, promptly, fairly, and completely. It just guarantees an audience.

For years, the personnel file was a one-way mirror. The employer watched, recorded, and judged, and the employee saw nothing until a lawsuit cracked the glass. New York has now replaced the mirror with a window, and windows have a way of improving behavior on both sides. Managers write more carefully when they know they’re being read. Employees trust more readily when nothing is hidden. The employers who suffer under transparency laws are, almost without exception, the ones whose files couldn’t survive daylight.

So the real question this law asks isn’t “how do we comply by November 8?” It’s the older, harder question underneath: if every employee read every word you’ve written about them, would the record show fair management or a story you’d rather not tell? If it’s the first, this statute costs you a few weeks of process work. If it’s the second, the statute isn’t your problem. The file is.

Build files you’d be proud to hand over. Then handing them over is just paperwork.

Keep fighting the good fight.

^{This article is for informational purposes only and does not constitute legal advice. For guidance on your specific situation, consult a qualified employment attorney. ATTORNEY ADVERTISING. Prior results do not guarantee a similar outcome.}

^{© 2026 Jacobs & Associates LLC. All rights reserved.}