What a Alabama business has to have in writing

Written notices to affected residents within 45 days of deciding a breach is likely to cause substantial harm; a notice to the Attorney General when more than 1,000 residents are notified, with a summary of the event, the number affected, services offered, and a contact person.

A documented set of safeguards sized to the business: someone named to run security, a risk assessment, employee controls, contractor oversight, and periodic review of the measures in light of changes.

A clear public privacy notice describing data collected, purposes, sharing and consumer rights; a working process to answer access, correction, deletion, portability and opt-out requests; consent records for sensitive data.

A written information security program built on a risk assessment, a written incident response plan, third-party provider oversight, notice to the Commissioner within three business days of a cybersecurity event, and a yearly compliance certification for Alabama-domiciled licensees.

Post the state set in a place employees can see: Your Job Insurance (unemployment), Workers' Compensation notice, and the Child Labor Law poster, alongside the federal posters.

Do not pay an employee at a wage rate less than employees of another sex or race for equal work in the same establishment on jobs requiring equal skill, effort, education, experience and responsibility under similar working conditions, unless the difference comes from a seniority system, a merit system, a system measuring earnings by quantity or quality of production, or a factor other than sex or race. Do not refuse to interview, hire, promote or employ an applicant, or retaliate against one, because the applicant declines to provide wage history. Employers with more than 50 employees keep records of wages and wage rates, job classifications and other terms and conditions of employment on file for three years; employers otherwise follow the FLSA record-keeping rules at 29 C.F.R. part 516. Alabama has no salary-range disclosure law.

File formation documents (or a foreign registration) with the Secretary of State's Business Entity Division; corporations no longer file an annual report there, though business privilege tax filings continue with the Department of Revenue.

Hold a license from the Licensing Board for General Contractors before bidding or working above the threshold, with the license number shown on bids and renewed yearly.

A permit from the county health department before opening, and a person in charge holding an accredited food protection manager certification (renewed every five years) on site during operating hours.

Enroll in E-Verify (directly or through the state Employer Agent service for firms under 25 staff) and run every new hire through it; businesses seeking state contracts or incentives also sign an E-Verify affidavit.

Buy a Class I (ages 14-15) or Class II (ages 16-17) certificate for each location, display it, and keep an employee information form, proof of age and daily time records for every worker 18 or younger.

A written substance abuse policy given to employees, a testing program, employee assistance provisions, employee education, supervisor training, and an application for certification each year for up to four years.