N.Y. Comp. Codes R. & Regs. tit. 21, § 2053.11 – Appeal.

(a) Any person denied access to a record or denied a request to amend or correct a record or personal information pursuant to section 2053.10(c) of this Part may, within 30 days of such denial, appeal to the person designated in section 2053.10 of this Part.
(b) The time for deciding an appeal shall commence upon receipt of a written appeal that identifies:
1. (1) the date and location of a request for access to, or amendment or correction of, a record or personal information;
2. (2) the record that is the subject of the appeal; and
3. (3) the name and return address of the appellant.
(c) Within seven business days after receipt of an appeal of a denial of access, or within 30 days after receipt of an appeal of a denial of a request for correction or amendment, the person determining such appeal shall:
1. (1) provide access to or correct or amend the record or personal information; or
2. (2) fully explain in writing the factual and statutory reasons for further denial and inform the data subject of his or her right to seek judicial review of such determination pursuant to article 78 of the Civil Practice Law and Rules.
(d) If, on appeal, a record or personal information is corrected or amended, the data subject shall be informed that, on request, the correction or amendment will be provided to any person or governmental unit to which the record or personal information has been or is disclosed pursuant to section 2053.4(a)(4), (9) or (12) of this Part.
(e) The corporation shall immediately upon receipt forward to the committee a copy of any appeal made pursuant to this Part, the determination thereof and the reasons therefor at the time of such determination.