Employers and employment agencies must disclose the data collected and their retention policy for the tool

Practical action

Publish a short data notice for the tool covering data types, sources and retention, or set up a 30-day response process for written requests.

Who does it apply to?

Employers and employment agencies using an automated employment decision tool for New York City residents.

Actors

Deployer / user organisation

Sectors

Employment and HR

Use cases

AI in hiring and employment

Applies from: 5 July 2023

Which controls meet this duty?

Satisfies: the control, operated properly, does the work the duty asks for. Supports: it contributes but the duty needs more. Each control page lists every other duty it serves, so work done once can be counted once.

• satisfiesProcessData protection officer · once per ai system
  Privacy and data-protection controls for AI

  Serves 13 recorded duties · evidence: Data protection impact assessment for an AI system, AI data-flow and legal-basis record, Privacy notice section on AI use

  Data notice with types, sources and retention.

• supportsProcessData governance lead · once per ai system
  Data governance and dataset documentation

  Serves 8 recorded duties · evidence: Dataset documentation sheet, Data quality and bias check report, Dataset approval for use

  Source of the data inventory disclosed.

Templates that cover this duty

Generated from the records. Free · no account · links emailed to your work address. This duty is cited in each file with its source reference and a link back here.

• ISO/IEC 42001 Gap Assessment and Statement of Applicability

  Assessment · XLSX · v3

• NIST AI RMF ↔ EU AI Act ↔ ISO/IEC 42001 Crosswalk

  Crosswalk · XLSX · v5

• AI Data Governance Register

  Register · XLSX and DOCX · v3

• AI Audit Evidence Tracker

  Register · XLSX · v1

All 6 templates that cover it →

What evidence would a reviewer expect?

Framework mappings

Original editorial crosswalks. They cite clause numbers only and reproduce no standard text; confidence reflects how direct the mapping is.

See every New York (United States) duty mapped this way →

Frequently asked questions

Cite this record

AIPolicyTracker (2026). “Employers and employment agencies must disclose the data collected and their retention policy for the tool (NYC Local Law 144 (automated employment decision tools))” [AIPT-OBL-0103, verified 26 September 2026 by Bhaskar Bhatt]. https://aipolicytracker.org/id/AIPT-OBL-0103 (accessed 8 November 2026). Data licensed CC BY 4.0.

Permanent id AIPT-OBL-0103: it never changes or gets reused, and its address keeps working if this page moves.

Cite the official text alongside it: Automated Employment Decision Tools (AEDT), NYC Department of Consumer and Worker Protection, https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page.

@misc{aipolicytracker2026_employersandemploymentag,
  author       = {{AIPolicyTracker}},
  title        = {{Employers and employment agencies must disclose the data collected and their retention policy for the tool (NYC Local Law 144 (automated employment decision tools))}},
  year         = {2026},
  howpublished = {\url{https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure}},
  url          = {https://aipolicytracker.org/obligations/us-new-york-city-local-law-144-data-policy-disclosure},
  urldate      = {2026-11-08},
  note         = {Data licensed CC BY 4.0. Accessed 8 November 2026}
}

Change history

Similar obligations in other instruments

• Deployers must use the provider's transparency information in their data protection impact assessment — EU AI Act, European Union
• Collect and use personal information only with consent and for the stated purpose — Nepal Privacy Act 2075, Nepal
• Process personal data only with valid consent or a legitimate use, after notice — India DPDP Act, India
• Identify consent or an applicable PDPA exception before using personal data in AI — PDPC AI advisory guidelines, Singapore