N.Y. Comp. Codes R. & Regs. tit. 21, § 462.10 – Appeal.

(a) Any data subject denied access to a record or personal information or denied a request to amend or correct a record or personal information may, within 30 days of such denial, appeal in writing to the person designated in section 462.9(c) of this Part.
(b) The time for deciding an appeal shall commence upon receipt of an appeal that identifies:
1. (1) the date and location of a request for a record or personal information or amendment or correction of a record or personal information;
2. (2) the record or personal information that is the subject of the appeal; and
3. (3) the name and return address of the appellant.
(c) Within seven business days of an appeal of a denial of access, or within 30 days of an appeal concerning a denial of a request for correction or amendment, the person determining such appeals shall:
1. (1) provide access to or correct or amend the record or personal information; or
2. (2) fully explain in writing the factual and statutory reasons for further denial and inform the data subject of the right to seek judicial review of such determination pursuant to article 78 of the Civil Practice Law and Rules.
(d) If, on appeal, a record or personal information is corrected or amended, the data subject shall be informed that, on request, a correction or amendment will be provided to any person or governmental unit to which the record or personal information has been or is disclosed.
(e) The Power Authority shall immediately forward to the committee a copy of any appeal made pursuant to these regulations upon receipt and a copy of the determination thereof.