Personnel Files, Reopened: What Goes In, What Stays Out, and Who Can Now Demand a Copy

The email arrives at 9:07 on a Monday morning. A former employee, one you let go eight months ago, writes six polite sentences: she’s requesting a complete copy of her personnel file under New York Labor Law Section 210-b, and she’d like it within five business days.

You open the drawer. There’s the doctor’s note her manager stapled to a write-up. There’s the I-9 tucked behind her performance reviews. There’s a printout of a group text where two supervisors called her “the drama queen in billing.” There’s an investigation summary from a complaint she never even knew about.

Five business days. Everything in that folder. In her hands, and shortly after that, in her lawyer’s hands. And here’s the part that should really keep you up tonight: as of November 8, 2026, this isn’t a hypothetical. It’s the law in New York, and it took effect yesterday.

Welcome to the reopened personnel file: the folder you built for your own convenience that employees can now read on demand.

The old question was “what goes in the file?” The new question is sharper: “what happens when the employee reads what went in the file?” Because under New York’s new personnel records access law, they will. This article walks through what belongs in the file, what must stay out, how long to keep everything, how to lock it down, and how to file every document as if the employee is reading over your shoulder. Because starting now, legally speaking, they are.

The Plain English Rule

Here’s what the law actually requires, stripped of the statutory language.

First, the file itself. New York doesn’t hand you a mandatory table of contents for a personnel file, but a web of federal and state rules effectively dictates one: employment records must be accurate, complete, retained for specific periods, and certain categories (medical records, I-9s, investigation materials) must be kept separate from the general file. Get the separation wrong and you’re not just disorganized; you’re violating the Americans with Disabilities Act, inviting expanded immigration audits, or handing a plaintiff’s lawyer retaliation evidence.

Second, the access. As of November 8, 2026, NYLL Section 210-b gives every current and former employee in New York the right to demand a complete copy of their personnel file, free of charge, and you have five business days from the written request to deliver it. Employees get up to two requests per year, and a request tied to newly added negative information doesn’t count against that cap.

Third, the notice. When you add negative information to an employee’s file (a write-up, a poor review, an investigation finding), you must notify the employee within ten days, and the employee has the right to submit a written rebuttal that gets filed alongside the negative document.

Fourth, the retention. The file must be maintained complete from the date of hire through at least three years after separation. No purging the inconvenient parts, no “we shredded that when she left.”

Fifth, the teeth. The New York Attorney General enforces the law, fines run $500 to $2,500 per violation, and retaliating against an employee for exercising these rights is itself a violation.

Put simply: the personnel file used to be your private diary about the employment relationship. It’s now a shared document. File accordingly.

The Technical Breakdown: What the Statutes Actually Say

Time to get specific, because the deadlines and thresholds are where employers get hurt.

NYLL Section 210-b (Effective November 8, 2026)

Signed on September 9, 2026 as Senate Bill S3460, Section 210-b creates the first general personnel records access right in New York’s private sector. The mechanics:

• Who can ask: Current employees and former employees.

• What they get: A complete copy of the personnel record. Not a summary, not selected highlights. Complete.

• The deadline: Five business days from receipt of a written request.

• The cost: Free to the employee. You absorb the copying, compiling, and delivery.

• The frequency cap: Two requests per employee per year, except that a request prompted by your addition of negative information doesn’t count toward the cap.

• The notice obligation: You must inform an employee within ten days of placing negative information in their file.

• The rebuttal right: Employees may submit a written statement responding to negative information, and that rebuttal must be kept with the document it addresses.

• Retention: Records must be maintained complete from hire through three years after separation.

• Enforcement: The Attorney General can pursue civil fines of $500 to $2,500 per violation, and the statute prohibits retaliation against employees who exercise their rights.

The Retention Overlay You Already Had

Section 210-b doesn’t replace your existing retention obligations; it stacks on top of them:

• Payroll and wage records: Six years under the NYLL and the Wage Theft Prevention Act. This is the same six-year lookback that makes New York wage claims so expensive, covered in depth in Paper Trail Starts Here.

• Personnel records generally: Six years after termination is the safe harbor most New York employment lawyers recommend, because it matches the state’s longest relevant limitations periods.

• I-9 forms: Three years after hire or one year after termination, whichever is later, under federal immigration law.

• OSHA injury and illness records: Five years.

• Investigation files: Six to seven years minimum, longer if litigation is possible.

Notice the interaction: Section 210-b’s three-years-post-separation rule is a floor, not a ceiling. Your six-year NYLL obligations still control for wage and payroll records. The practical rule is simple: the new law added a retention requirement without subtracting a single old one.

The Federal Separation Rules

• ADA and GINA: Medical information must be kept in a separate, confidential medical file, apart from the general personnel file, with access restricted to those who genuinely need it.

• FMLA: Leave certifications and related medical documentation belong in that same separate medical file.

• I-9s: Federal regulators can inspect I-9s with three days’ notice. If your I-9s live inside personnel files, an immigration audit just became a tour of every employee’s entire history.

What Belongs in the Personnel File

The general personnel file is the folder the employee can now demand. It should contain the documents that tell the story of the employment relationship, and nothing else:

• Job application and resume

• Offer letter and signed acknowledgment

• Job description

• Signed handbook acknowledgment

• W-4 and state tax withholding forms

• Performance reviews and disciplinary records

• Promotion, transfer, and compensation change records

• Attendance and PTO records

• Signed training acknowledgments

• Separation letters and exit interview notes

• Employee rebuttals to negative information (new under Section 210-b, and mandatory)

Optional but useful additions: confidentiality agreements, rehire eligibility status, commendation letters, emergency contacts, and direct deposit authorizations.

Every document should be dated, signed where applicable, and consistently formatted. And here’s the test that changed on November 8: before any document goes in, ask whether you’d be comfortable with the employee reading it five business days from now. If the answer is no, one of two things is true. Either the document doesn’t belong in the file, or the document reflects a decision you shouldn’t have made. Both problems are worth knowing about before the request arrives.

One more addition the new law effectively requires: a request log. Track every Section 210-b request, the date received, the date fulfilled, and what was produced. When the Attorney General’s office asks whether you complied within five business days, “we think so” is not an answer.

The Fourth File: Payroll and Financial Records

Many employers maintain a separate payroll and financial file: timecards, pay stubs, garnishment orders, employee loans, 401(k) enrollments, commission agreements, expense reimbursements. Keep doing that. These records carry sensitive financial data, follow different retention clocks, and your payroll team needs them without needing access to performance reviews or discipline.

What Must Stay Out (The Compliance Bombs)

Your record-keeping should follow a three-tier structure: the general personnel file, a separate medical and confidential file, and stand-alone compliance folders. The new access law just raised the stakes on getting this right, because a misfiled document is no longer just an audit risk. It’s a document you’re legally required to hand to the employee.

Tier Two: The Medical File

Doctor’s notes, FMLA certifications, accommodation requests, return-to-work releases, workers’ compensation claims, anything revealing a diagnosis, treatment, or disability. All of it goes in a separate, confidential medical file with access limited strictly to the people who coordinate leave and accommodations.

Why the paranoia? Because when medical documents sit next to disciplinary documents, every judge, juror, and investigator draws the same inference: the people making discipline decisions knew about the medical condition. Under the new law, the employee drawing that inference is reading the file personally, with a five-day turnaround and a rebuttal right.

Tier Three: The Compliance Folders

I-9 forms go in a stand-alone binder or digital folder covering all employees, active and former, never mixed with personnel or medical records. Access is limited to audits and verification.

Investigation records (harassment and discrimination complaints, whistleblower reports, witness statements, findings, remedial actions) go in a confidential location accessible only to the head of HR, counsel, or the designated investigator. Witness statements in particular need protection: witnesses were promised discretion, and other employees’ personnel files are not the place to honor that promise.

The New Gray Zone: What Does The Employee’s “Complete Copy” Include?

Here’s the question every New York employer should be asking counsel right now: when a Section 210-b request arrives, does “complete personnel record” reach the separate medical file? The investigation folder? The manager’s desk-drawer notes?

The conservative operating assumption: anything about the employee that influences employment decisions is potentially producible, and anything about other people (witness identities, co-worker complaints, third-party references) needs careful, document-by-document handling with counsel before production. The practical lesson cuts one way regardless: stop creating documents you couldn’t defend out loud. The manager’s sarcastic sticky note, the “confidential” email thread ranking employees by attitude, the unofficial shadow file. Under the new regime, assume it all surfaces.

Shadow files are the classic version of this trap. A supervisor keeps private notes on employees “just for memory,” and those notes are sloppy, emotional, and undated. When litigation or an access dispute surfaces them, they contradict the official file and destroy your credibility. One employee, one official file, one story.

Where Employers Get Burned

The mistakes that hurt aren’t exotic. They’re the ordinary habits of busy businesses, and the new law converts each one from latent risk into a five-business-day emergency.

The convenience file. Everything about the employee goes in one folder because it’s easier. It was always a violation waiting to be noticed. Now the employee can notice it personally, twice a year, for free.

The silent write-up. A manager documents a performance problem and files it without telling the employee. Under Section 210-b, that’s now an independent violation: negative information requires notice within ten days and triggers rebuttal rights. The write-up you hid is no longer just bad management; it’s a fine.

The purge on exit. An employee leaves on bad terms and someone “tidies” the file. The new law requires the record to stay complete through three years after separation, and former employees can request copies. A file that shrinks after termination is a file that convicts you.

The vendor data trap. You switch payroll providers, time clock systems, or benefits administrators, and nobody downloads the historical data first. Two years later a wage claim hits, you call the old vendor, and you hear the sentence that has sunk a hundred employers: “We only retain former client data for 90 days.” The Department of Labor doesn’t care that your vendor deleted the records. They’re your records, your responsibility, your liability. And now a former employee’s access request can expose the hole just as fast as an audit can. Before any vendor switch: download all historical data, export in multiple formats, archive wage statements and tax forms, and verify the backup actually opens.

The access free-for-all. Every manager, and sometimes the office admin, can browse any file. Every unnecessary set of eyes is a potential privacy breach, a potential witness to what decision-makers “knew,” and a potential leak.

Case Study: Getting It Wrong. The Medical File Disaster, Reopened

^{Note: This is a hypothetical scenario based on patterns from real compliance audits. No real business is depicted.}

The company: a 40-employee dental practice group with three locations in Queens and Nassau County. The office manager, competent and chronically overloaded, kept one folder per employee. Everything went in it. Applications, write-ups, doctor’s notes, an occasional I-9 that never made it to the binder that didn’t exist.

The employee: a dental hygienist, seven years with the practice, recently diagnosed with cancer and undergoing chemotherapy. She submitted her FMLA certification, which is the medical paperwork that documents a serious health condition and supports protected leave. The office manager filed it where she filed everything: the hygienist’s one folder, directly between two attendance write-ups.

The write-ups kept coming. Late arrivals, early departures, a missed Saturday shift. Each one went in the folder. Nobody told the hygienist about most of them, because nobody had ever needed to. Then the practice terminated her for “chronic attendance issues.”

Under the old rules, the trap would have sprung at the unemployment hearing, and in this scenario it still did: the practice submitted her personnel file to prove performance problems, and the file itself showed her FMLA certification sitting between the write-ups, with every “attendance issue” falling squarely on treatment dates. The unemployment judge needed one sentence: the employer’s own documentation showed medical leave being tracked as attendance violations.

But this is 2026, and the story doesn’t end at the hearing anymore. Nine days after the new law took effect, the hygienist’s attorney sent a written Section 210-b request for her complete personnel record. Now the practice faced a five-business-day deadline to hand over the very folder that had just lost them the unemployment hearing, plus a hard choice: produce the commingled file as it existed and confirm the retaliation narrative in writing, or touch it and risk a spoliation finding. Their new counsel gave the only advice available: produce it complete, exactly as maintained.

The file went out. It showed the FMLA certification filed with discipline. It showed four write-ups the hygienist had never been told about, which after November 8 would each have been an independent notice violation. It showed no rebuttals, because she’d never been given the chance. The attorney general complaint wrote itself, and the FMLA interference and disability discrimination demand letter followed within the month.

The financial exposure:

Nearly a quarter million dollars, and the original sin wasn’t the termination. It was a filing decision: one piece of paper, placed three inches from where it belonged.

Case Study: Getting It Right. The Three-Drawer Defense, Upgraded

^{Note: This is a hypothetical scenario based on patterns from real compliance audits. No real business is depicted.}

The company: a 75-employee manufacturing facility in Rockland County. Two years earlier, the operations manager had rebuilt the record-keeping after a trade association seminar. The system was simple: three locked locations. Drawer one, personnel files: reviews, discipline, attendance, commendations. Drawer two, medical files: all FMLA, ADA, and injury records. Drawer three, the compliance binder: every I-9, active and former employees, organized by year. Each drawer had its own access log and its own designated handlers.

When OSHA arrived for a safety inspection and asked to see employee records, the review took two hours instead of weeks, found nothing, and stayed narrow, because there was nothing tangled enough to pull on.

Then came the fall of 2026, and the operations manager did what prepared employers do: she treated the new law as a stress test rather than a threat. In October, before the effective date, she ran two mock access requests, added a request log to each drawer, built a ten-day notice template for negative entries, and briefed every supervisor on one sentence: “Anything you write about an employee, assume the employee reads it within the week, because now they can.”

The first real Section 210-b request arrived in mid-November from a machine operator who’d been written up for a safety violation and wanted to see his file. The complete copy went out in two business days. It contained the write-up, the notice he’d received about it, his written rebuttal filed right behind it, and six years of solid reviews. He read it, saw a fair record fairly kept, and the matter ended there. No lawyer, no complaint, no drama. The write-up had already been delivered with notice, so the request didn’t even count against his annual cap, and nobody cared, because there was nothing left to find.

Security: Two Locks Minimum, Fewer Eyes at Every Level

Paper or pixels, the security principles are identical: multiple layers, limited access, fewer people at each level.

The Two-Lock Minimum. For physical files: a locked room (HR and executives hold keys), a locked cabinet inside it (HR director and one designated backup), and a separately locked drawer for medical and I-9 records (compliance designee only). For digital files: a password-protected system, folder-level permissions restricted to the HR team, and file-level restrictions on sensitive documents limited to named individuals.

The Shrinking Circle. As sensitivity increases, access decreases. Personnel files: full access for the HR director and HR manager; read-only for department managers, and only for their own direct reports; nothing for anyone else. Medical files: full access only for the benefits administrator or ADA coordinator; case-by-case access for the HR director; no access for managers and supervisors, period. I-9s: one designated administrator, audit-time access for the HR director, and nobody else, no exceptions.

The new law adds a wrinkle worth planning for: producing a complete copy in five business days requires someone to touch every document quickly. Designate who compiles access-request responses in advance, and make sure that person is inside the medical-file circle or paired with someone who is, so the response doesn’t turn into its own confidentiality breach.

The Takeaway Framework: The Over-the-Shoulder Standard

One test, five habits. Before any document enters, leaves, or sits in an employee file, apply the Over-the-Shoulder Standard: file every document as if the employee is reading over your shoulder, because within five business days of a written request, they can be.

1. Write it for two readers. Every document now has a guaranteed audience of at least two: the file, and eventually the employee. Facts, dates, specifics, and zero editorializing. If a write-up wouldn’t survive being read aloud by the person it describes, it won’t survive a judge either.

2. Sort it before you store it. Three tiers, every time: general personnel file, separate medical file, stand-alone compliance folders for I-9s and investigations. A document filed in the wrong tier isn’t misplaced; it’s a violation with a timestamp.

3. Notify within ten. Negative information triggers the ten-day notice clock and the rebuttal right. Build the notice into the documentation workflow itself, so telling the employee is part of writing the document, not an afterthought someone forgets.

4. Keep it complete, keep it long. Complete from hire through three years post-separation under Section 210-b, six years for anything wage-related under the NYLL, and forever if litigation looms. Nothing exits the file early, and nothing exits a departing vendor’s system without a verified backup landing in yours first.

5. Log every look. Access logs for the drawers, request logs for Section 210-b, and a named owner for the five-day response. When enforcement comes, the employer with logs explains; the employer without logs apologizes.

The Over-the-Shoulder Standard works precisely because it’s boring. It doesn’t require judgment calls under pressure; it requires the same five habits applied to every document, every employee, every time. Consistency is the whole defense. To put these habits into practice, download the Personnel File Audit Checklist. It takes you through your drawers one at a time, then tests whether your notice, logging, and retention systems would hold up to a real request.

Final Thoughts: The File Was Always Going to Be Read

Here’s the uncomfortable truth about November 8, 2026: the new law didn’t really change what a personnel file is. It just moved up the reading date.

Every personnel file was always destined for an audience. A DOL auditor, an EEOC investigator, an unemployment judge, a plaintiff’s lawyer with a document demand. Employers who filed carelessly were never actually private; they were just unlucky later instead of sooner. Section 210-b collapses that timeline from “someday, maybe, in litigation” to “five business days from Tuesday,” and in doing so it does employers a strange favor. It makes the audience impossible to forget.

Because a file built for an audience is a better file. It’s factual instead of emotional. It’s complete instead of curated. It documents the employee’s best day alongside their worst, which is what genuine management looks like. It separates what must be separated, notifies who must be notified, and keeps what must be kept. That file doesn’t just survive an access request. It survives everything.

The employers who struggle under the new law won’t be the ones with the most write-ups. They’ll be the ones whose files tell a different story than the one they told the employee. Close that gap and the reopened personnel file holds no terror at all. It’s just your own good management, in writing, available on request.

Keep fighting the good fight.

^{This article is for informational purposes only and does not constitute legal advice. Reading this article does not create an attorney-client relationship. For guidance on your specific situation, consult a qualified employment attorney. ATTORNEY ADVERTISING. Prior results do not guarantee a similar outcome.}

^{© Lee Jacobs & Associates LLC. All rights reserved.}