N.Y. Comp. Codes R. & Regs. tit. 21, § 505.9 – Appeal of a denial of a request for access to a record or a denial of a request for correction of a record.

(a) Any data subject denied access to a record or personal information or denied a request to amend or correct a record or personal information may, within 30 days of such denial, appeal in writing to the president and chief executive officer of the authority.
(b) The time for deciding an appeal shall commence upon receipt of an appeal that identifies:
1. (1) the date the request for a record or personal information or amendment or correction of a record or personal information was denied and a copy of the denial;
2. (2) the record or personal information that is the subject of the appeal; and
3. (3) the name and return address of the appellant.
(c) Within seven business days of an appeal of a denial of access, or within 30 days of an appeal concerning a denial of a request for correction or amendment, the president and chief executive officer shall:
1. (1) provide access to or correct or amend the record or personal information; or
  1. (i) fully explain in writing the reasons for further denial and inform the data subject of the right to seek judicial review of such determination pursuant to article 78 of the Civil Practice Law and Rules;
  2. (ii) inform the data subject of the right to file with the authority a statement of reasonable length setting forth the data subject's reasons for disagreement with the determination; and
  3. (iii) inform the data subject of the right to request that such a statement of disagreement be provided to any person or governmental unit to which the record or personal information has been or is disclosed.
  (2)
(d) With respect to any personal information about which a data subject has filed a statement of disagreement, the authority shall clearly note any portions of the record which are disputed, and shall attach the data subject's statement of disagreement as part of the record. When providing the data subject's statement of disagreement to other persons or governmental units pursuant to paragraph (c) of subdivision 3 of section 94 of the Public Officers Law, the authority may, if it deems appropriate, also include in the record a concise statement of the authority's reasons for not making the requested amendment.
(e) If, on appeal, a record or personal information is corrected or amended, the data subject shall be informed that, on request, a correction or amendment will be provided to any person or governmental unit to which the record or personal information has been or is disclosed.
(f) The authority shall immediately forward to the committee a copy of any appeal made pursuant to these regulations upon receipt and a copy of the determination thereof.