N.Y. Comp. Codes R. & Regs. tit. 9, § 166-3.9 – Access to records.

(a) Within five business days of the receipt by the division of a request for access to a record, the personal privacy protection officer shall make such record available to the data subject, deny such request in whole or in part and provide the reasons therefor in writing, or furnish a written acknowledgment of the receipt of such request and a statement of the approximate date when such request will be granted or denied, which date shall not exceed 30 days from the date of the acknowledgment.
(b) The personal privacy protection officer shall not be required to provide a data subject with access to a record if:
1. (1) the division does not have the possession of the record;
2. (2) the record cannot be retrieved by use of the data subject's description thereof, or by use of the name or other identifier of the data subject, or without the use of extraordinary search methods;
3. (3) access to the record is not required to be provided pursuant to the Public Officers Law, section 95(5), (6) or (7); or
4. (4) the record is that of a youth placed with the division.
(c) Whenever a data subject is entitled to access to a record, the record shall be made available as provided in this subdivision.
1. (1) Records shall be made available for inspection and copying in the presence of the personal privacy protection officer or his designee at the offices of the division at 84 Holland Avenue, Albany, NY 12208. Records shall be made available in printed form without any codes or symbols, unless accompanied by a full explanation of the codes and symbols. Copies of records shall be available upon payment or offer to pay the copying fee provided in section 166-2.13 of this Subpart. Upon request, copies of records shall be certified as correct and a person of the data subject's choice shall be permitted to accompany the data subject when inspecting a record, provided the data subject furnishes a written statement to the personal privacy protection officer authorizing discussion of the record in the accompanying person's presence.
2. (2) Where the request for access is made by mail and is accompanied by the copying fee provided for in section 166-3.13 of this Subpart or an offer to pay the same, the personal privacy protection officer shall mail to the data subject a copy of the record and statement of any amount owed the division. Where such a request is not accompanied by the copying fee or an offer to pay the same, the personal privacy protection officer shall mail to the data subject a notice stating that:
  1. (i) the record is available for inspection and copying as provided in paragraph (1) of this subdivision;
  2. (ii) upon payment of the copying fee, a copy of the record will be mailed to the data subject; and
  3. (iii) the amount of the copying fee.
(d) Upon denial of a request for access to records, the personal privacy protection officer shall notify the data subject of the procedures for obtaining review of such determination by the general counsel to the division. Such notice shall include the general counsel's name and business address.
(e) Nothing in this section shall impair any right of any division employee under a current collective bargaining agreement.