What a California business has to have in writing

Tell affected California residents in the most expedient time possible without unreasonable delay, using the statutory format with headed sections covering what happened, what information was involved, what you are doing and what people can do. When a single breach reaches 500 or more California residents, file an electronic sample copy of the notice with the Attorney General, who publishes it on a public list. Businesses that only maintain data on someone else's behalf must alert the data owner immediately.

Put in place and maintain reasonable security procedures and practices appropriate to the nature of the personal information you hold, and require the same by contract from anyone you disclose it to. Dispose of customer records holding personal information by shredding, erasing or otherwise making the information unreadable. The CCPA turns a failure of reasonable security that leads to a breach into a private cause of action with statutory damages.

Publish a privacy policy that lists the categories of personal information collected, the purposes, the retention period for each category, and how to exercise rights; give a notice at or before collection; run 'Do Not Sell or Share My Personal Information' and 'Limit the Use of My Sensitive Personal Information' links and honor opt-out preference signals; put written contracts in place with service providers and third parties; and keep records of consumer requests for 24 months. Businesses whose processing presents significant risk must complete risk assessments and, under the 2025 regulations, cybersecurity audits on a phased schedule. Employees and job applicants are covered consumers, so a separate workforce privacy notice is needed.

Register with the California Privacy Protection Agency by January 31 each year, pay the fee, and disclose in the registry whether you collect minors' data, precise geolocation or reproductive health care data and where your deletion instructions live. Registered brokers must check the state's Delete Request and Opt-out Platform every 45 days, process the deletion requests it carries, and from 2028 obtain an independent third-party audit of compliance every three years and keep the audit reports for six years.

If biometric information is processed to uniquely identify a person, name it in the notice at collection as sensitive personal information, say why it is collected and how long it is kept, and run a 'Limit the Use of My Sensitive Personal Information' route unless the only uses are the ones the statute exempts. Unique biometric data such as a fingerprint, retina or iris image, and a photograph stored for facial recognition, counts as personal information for the reasonable-security duty and triggers breach notification if exposed. Employees and applicants are covered consumers, so fingerprint or face-scan timekeeping needs the same disclosures.

Write a discrimination, harassment and retaliation prevention policy that lists the protected categories, names a complaint route that does not run through the employee's own supervisor, promises a timely and impartial investigation with confidentiality to the extent possible, bans retaliation, and points to the Civil Rights Department. Distribute it by signed acknowledgment, email receipt or another traceable method, and translate it whenever ten percent or more of the workforce speaks another language. Deliver two hours of training to supervisors and one hour to every other employee within six months of hire or promotion and every two years after. Post the CRD harassment poster and hand out the sexual harassment fact sheet.

Keep a written Injury and Illness Prevention Program that names the person responsible, sets out how you check compliance and hold people accountable, how employees report hazards without fear of reprisal, how you communicate on safety, how you inspect for and correct hazards, how you investigate injuries, and how you train. Keep inspection and training records for at least one year and make the program available to employees and to Cal/OSHA on request.

Keep a written heat illness prevention plan, in English and in the language most workers understand, covering access to water and shade or cool-down areas, high-heat procedures, acclimatization for new and returning workers, and emergency response. Train supervisors and employees before they work in the heat, and keep the plan at the worksite and available to Cal/OSHA.

Write a standalone Workplace Violence Prevention Plan (or an identifiable section of the IIPP) that names who is responsible, explains how employees take part in developing it, how violence hazards are identified and corrected, how incidents are reported and responded to without retaliation, and how emergency response and post-incident debriefing work. Keep a violent incident log for every incident, train employees at rollout and annually, and retain hazard-identification and training records for five years and incident investigation records for five years. The plan must be available to employees and to Cal/OSHA on request.

Give applicants and policyholders a written notice of information practices explaining what personal and privileged information is collected, from whom, how it may be disclosed and how a person can see and correct their file; get written authorization in the prescribed form before collecting information from outside sources; give reasons in writing for an adverse underwriting decision; and honor access and correction requests within 30 business days. Financial privacy regulations add annual privacy notices and opt-in rules for sharing nonpublic personal information.

A provider must give the buying state entity a current SSAE 18 SOC 2 Type II report together with a written plan to correct any negative findings; a FedRAMP or StateRAMP authorization may be used instead as an equivalent attestation. The agency then files a California Cloud Services Assessment with the Department of Technology, which takes a cloud system security plan, a FIPS 199 classification form, an architecture and network diagram, a cloud alternative analysis and a privacy threshold analysis, and commits the solution to continuous monitoring.

Give at least 40 hours or five days of paid sick leave a year, either by accrual at one hour per 30 hours worked or by front-loading. Give each new hire the Labor Commissioner's written notice showing the sick leave terms, show the amount available on each wage statement or a separate written statement, display the paid sick leave poster, and keep accrual and use records for three years. Most employers write this into a sick leave policy so the accrual method, caps and carryover are on paper.

Post the Civil Rights Department's family care and medical leave notice and, if you publish an employee handbook, include a CFRA policy explaining eligibility, the 12 weeks of job-protected leave, how to request it and the ban on retaliation, translated where a large share of the workforce reads another language. Give every new hire the EDD State Disability Insurance and Paid Family Leave brochures, and give them again when an employee takes qualifying leave.

Display the full state posting set from the Department of Industrial Relations notice database - Industrial Welfare Commission wage order for your industry, minimum wage, payday notice, Cal/OSHA Safety and Health Protection on the Job, workers' compensation rights, paid sick leave, whistleblower rights, discrimination and harassment, family leave, emergency contacts, and the human trafficking notice where it applies - and give each new hire the written wage-theft prevention notice showing pay rate, employer identity, paid sick leave terms and the workers' compensation carrier.

Put the salary or hourly wage range you reasonably expect to pay in every job posting, including postings placed by third parties, and give the pay scale for a role to any applicant who asks after an interview and to any current employee who asks about their own position. Keep job title and wage rate history for each employee for the length of employment plus three years. Employers at the 100-employee mark file an annual pay data report with the Civil Rights Department by the second Wednesday of May, broken out by job category, race, ethnicity and sex, with median and mean hourly rates, and a separate report for labor-contractor workers.

File articles or a foreign registration through the Secretary of State's bizfile Online portal, appoint an agent for service of process, and file the Statement of Information within 90 days and then annually for corporations or every two years for LLCs. File a fictitious business name statement with the county where you do business and republish it every five years. City or county business tax certificates apply on top of the state filing.

Hold a CSLB license in the correct classification before bidding, qualify a responsible managing officer or employee by experience and exam, post the required contractor bond and workers' compensation coverage, renew every two years, and print the license number on contracts, bids, business cards and advertising. Home improvement contracts must be in writing with the state-mandated notices and payment limits.

Get a health permit from the county environmental health department before opening and renew it. Each facility must have at least one owner or employee holding an accredited food protection manager certificate, and every food handler must obtain an accredited food handler card within 30 days of hire and renew it every three years. Keep the certificates and cards on file at the facility for inspectors, along with an employee health reporting agreement.

Adopt a written lactation accommodation policy that tells employees how to request a room and break time, commits to responding to the request, and explains the right to file a complaint with the Labor Commissioner. Include it in the handbook or the policies given at hire, hand it to anyone asking about parental leave, provide a private space other than a bathroom with a surface, seating, electricity and nearby running water, and keep records of accommodation requests for three years.

Either sponsor a qualified retirement plan and certify the exemption, or register with CalSavers by the deadline for your size band, upload the employee roster, distribute the program information packet so employees have 30 days to opt out, and send payroll deductions each pay period. Penalties run per eligible employee for failing to register.