Get help →
Home›Obligations›United States›By state›District of Columbia

What a District of Columbia business has to have in writing

The District writes more employment obligations per employee than almost any state. Every employer posts four Office of Human Rights notices plus the DOES Labor Law Universal Notice, publishes pay ranges and healthcare-benefit information in job ads, posts a sick and safe leave notice, pays the Universal Paid Leave payroll contribution quarterly, and hands employees written copies of any policy that limits outside work.

Restaurants and bars paying the tip credit sit under the heaviest single rule in the city: a written sexual harassment policy distributed, posted and filed with OHR each year, plus certified-trainer harassment training every two years.

On data, the 2020 Security Breach Protection Amendment Act added an affirmative reasonable-safeguards duty, vendor contract terms, secure destruction and 18 months of free identity theft protection after a Social Security number breach. The District has no OSHA State Plan, so federal OSHA covers private employers.

District of Columbia has a rule of its own in 9 of the 14 areas, listed below. In 1 more we searched the state's own site and found nothing beyond the federal rule, but we have not finished writing up where we looked, so that one is not shown yet. The remaining 4 areas we have not checked yet.

Headcount

Industry  General is always on

Share
Ad from the publisher
Policy  Acknowledgment  Proof
District of ColumbiaHandbook 2026acknowledged by name
District of Columbia on Recordwith AllyMatter
Cover District of Columbia the Modern WayEvery policy District of Columbia makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in District of Columbia on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
See how it works →Pricing →

District of Columbia rules for a 15–19 person general business

We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether District of Columbia has a rule of its own on top. The federal rules every employer carries follow the District of Columbia rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by
Consumer security breach notificationD.C. Code §§ 28-3852, [28-3852.02] (as amended by D.C. Law 23-98, effective June 17, 2020) #Any person or entity conducting business in the District that owns or licenses computerised or other electronic data containing personal information about a District residentDistribute
Notice
Notify affected District residents promptly and without unreasonable delay, in a notice that names the categories and elements of information taken, gives the business's contact details, lists the credit bureaus with the free security freeze right, and gives contact details for the FTC and the DC Attorney General. Where 50 or more residents are affected, send the Attorney General a written report covering eleven specified points, including the cause, remedial action, corporate headquarters, any foreign involvement and a sample consumer notice, no later than when consumers are told. Above 1,000 residents, also notify the nationwide consumer reporting agencies. If Social Security or taxpayer identification numbers were exposed, offer every affected resident free identity theft protection services for at least 18 months and give them the information needed to enroll.
From the first employee
Office of the Attorney General for the District of Columbia; a violation is an unfair or deceptive trade practice under D.C. Code § 28-3904(kk)
AuthorityD.C. Law Library - § 28-3852 Notification of security breachD.C. Law Library - § [28-3852.02] RemediesD.C. Law Library - § 28-3853 EnforcementReport an error

Data Security Program 1A written safeguards program the state requires before anything goes wrong

LawProduceWhat it requiresTriggerEnforced by
Security requirements for personal informationD.C. Code § [28-3852.01] (D.C. Law 23-98, effective June 17, 2020) #Any person or entity that owns, licenses, maintains, handles or otherwise possesses personal information of a District resident, of any sizeWrite
Written program
Implement and maintain reasonable security safeguards, including written procedures and practices, sized to the sensitivity of the personal information and the nature and size of the operation. Where personal information is shared with a non-affiliated service provider, the written agreement must require that provider to keep equivalent safeguards. When destroying records or devices holding personal information about a consumer, employee or former employee, take reasonable steps against unauthorised access, weighing sensitivity, business size, cost and available technology. GLBA, HIPAA and HITECH compliance is deemed compliance.
From the first employee
Office of the Attorney General for the District of Columbia (unfair or deceptive trade practice)
AuthorityD.C. Law Library - § [28-3852.01] Security requirementsD.C. Law Library - Chapter 38 Subchapter IIReport an error

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by
Federal OSHA jurisdiction (no District State Plan)29 U.S.C. § 651 et seq. #All private-sector employers in the DistrictPost
Posting
The District does not run an OSHA-approved State Plan, so private employers follow federal OSHA directly: display the federal Job Safety and Health poster, keep OSHA 300 injury and illness records and post the 300A summary from February to April, and report fatalities within 8 hours and hospitalisations, amputations or eye losses within 24 hours to federal OSHA.
From the first employee
Federal OSHA (Washington DC Area Office)
AuthorityOSHA - State Plans (Washington, D.C. is under federal OSHA)OSHA - Injury and illness recordkeeping and reporting requirementsReport an error

Paid Leave Policies 2Sick and family leave laws that come with a written policy or notice

LawProduceWhat it requiresTriggerEnforced by
Accrued Sick and Safe Leave ActD.C. Code § 32-531.01 et seq.; posting duty at § 32-531.09 #Every District employer; accrual rates step up with headcount (under 25, 25 to 99, and 100 or more employees)Post
Posting
Give employees paid sick and safe leave at the accrual rate set for the employer's size, keep records of accrual and use, and post and maintain the Mayor's sick and safe leave notice in a conspicuous place in English and in every language spoken by employees with limited or no English proficiency. Employers typically capture the accrual, carryover, notice and certification rules in a written leave policy.
From the first employee
DC Department of Employment Services, Office of Wage-Hour; Office of the Attorney General
AuthorityD.C. Law Library - § 32-531.09 Posting requirementD.C. Law Library - § 32-531.07 Encouragement of more generous paid leave policiesDC Department of Employment Services - DC Worker Labor and Anti-Discrimination RightsReport an error
Universal Paid Leave (DC Paid Family Leave)D.C. Code § 32-541.01 et seq.; contribution at § 32-541.03 #Covered employers, meaning employers who pay unemployment insurance tax on behalf of employees working in the District; self-employed individuals may opt inFile
Filing / record
Set up an account on the DOES employer portal, file quarterly wage reports and pay the Universal Paid Leave contribution on the gross wages of covered employees at the rate set in statute, complete the employer part of a worker's claim, and display the DOES Paid Family Leave notice with the other required workplace notices.
From the first employee
DC Department of Employment Services, Office of Paid Family Leave
AuthorityDC Paid Family Leave - Information for EmployersD.C. Law Library - § 32-541.03 Contributions to the Universal Paid Leave FundD.C. Law Library - § 32-541.04 Duration and amount of benefitsReport an error

Required Postings 1The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by
Required workplace postersD.C. Code §§ 32-531.09, 32-1453.02, 32-509; D.C. Human Rights Act (D.C. Code § 2-1401.01 et seq.) #Every District employerPost
Posting
Display the four Office of Human Rights posters (DC Family and Medical Leave Act, Equal Employment Opportunity, Parental Leave Act, and The Right to Breastfeed) where employees can easily see them, and post the DOES Labor Law Universal Notice in a conspicuous place at each breakroom or time clock, along with the wage law posters. The sick and safe leave notice must appear in English and every language spoken by limited-English-proficiency employees, at up to $100 a day for failing to post it.
From the first employee
DC Office of Human Rights; DC Department of Employment Services, Office of Wage-Hour
AuthorityDC Office of Human Rights - Workplace and Business PostersDC Department of Employment Services - DC Worker Labor and Anti-Discrimination Rights (Labor Law Universal Notice)D.C. Law Library - § 32-531.09 Posting requirementReport an error

Pay Transparency 1Salary ranges in job posts and pay disclosure on request

LawProduceWhat it requiresTriggerEnforced by
Wage Transparency Act, as amended in 2024D.C. Code §§ 32-1451 to 32-1454 (Wage Transparency Omnibus Amendment Act of 2023, D.C. Law 25-138, effective June 30, 2024) #Every District employerDistribute
Notice
Put the good-faith minimum and maximum projected salary or hourly pay in every advertised job listing and position description, running from the lowest to the highest the employer would actually pay for that job, promotion or transfer; tell candidates about the healthcare benefits available before the first interview; stop asking for or screening on wage history; and post a notice in a conspicuous place where employees congregate telling them their rights under the chapter. Employers may not stop staff discussing their own or each other's pay.
From the first employee
Office of the Attorney General for the District of Columbia
AuthorityD.C. Law Library - § 32-1453.01 Employer disclosuresD.C. Law Library - § 32-1453.02 NoticeD.C. Law Library - § 32-1452 Prohibited actions of employerReport an error

Licensing and Certifications 1Registrations, licenses and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by
Basic Business License and Clean Hands certificationD.C. Code § 47-2851.01 et seq. (licensure); D.C. Code § 47-2862 (Clean Hands) #Anyone providing or offering goods or services to the public for compensation in the District, in the category matching the activity (restaurant, convenience store, home improvement contractor, residential rental, and so on)File
Filing / record
Register the entity, get a tax registration and Clean Hands certification from the Office of Tax and Revenue, secure a Certificate of Occupancy or Home Occupation Permit, and apply for the Basic Business License online through BOSS in the right category, then renew it. Clean Hands fails if more than $100 in District fees, fines, taxes or penalties is owed or a required District tax return is unfiled.
From the first employee
DC Department of Licensing and Consumer Protection, Business Licensing Division; DC Office of Tax and Revenue
AuthorityDC Department of Licensing and Consumer Protection - Business Licensing DivisionDLCP - Steps to Obtaining a Basic Business LicenseDLCP - Tax Registration and Clean Hands Certification DetailsReport an error

Other Written Policies 2Any other document the state makes an employer write or hand out

LawProduceWhat it requiresTriggerEnforced by
Ban on Non-Compete Agreements Amendment Act - written disclosuresD.C. Code §§ 32-581.03, 32-581.03a (applicable from October 1, 2022) #Every District employer that has a workplace policy limiting outside work, and any employer proposing a non-compete to a highly compensated employeeDistribute + ack
Notice
If a workplace policy uses any of the statutory exceptions to the non-compete ban, such as confidentiality or conflict-of-interest restrictions, hand every employee a written copy within 30 days of them accepting the job and again every time the policy changes. Where a non-compete is proposed to a highly compensated employee, give the exact statutory notice paragraph naming DOES, and give the written provision at least 14 days before employment starts or before the employee must sign; the agreement itself must state the functional scope, the geographic limits and a term no longer than 365 days (730 for medical specialists).
From the first employee
Mayor (DOES) and Office of the Attorney General; administrative penalties from $350 to $1,000 per violation, with a $1,000 minimum for disclosure failures
AuthorityD.C. Law Library - § 32-581.03a Disclosures to employeesD.C. Law Library - § 32-581.03 Limitations on non-compete provisions for highly compensated employeesD.C. Law Library - § 32-581.04 Relief and penaltiesReport an error
Employer wage records and itemised pay statementsD.C. Code § 32-1008 #Every District employer subject to the minimum wage lawDistribute + ack
Notice
Keep, for at least three years or the federal period if longer, each employee's name, address and occupation, the date of birth of anyone under 19, pay rates and amounts paid each period, and the precise times worked each day and week; produce the records to the Mayor or Attorney General on demand with a sworn statement. Give every employee an itemised statement with each payment showing the payment date, gross wages, additions and deductions with gratuities on a separate line, net wages and hours worked. Employers paying tipped workers under § 32-1003(f), other than hotels, must run payroll through a third-party payroll business.
From the first employee
DC Department of Employment Services, Office of Wage-Hour; Office of the Attorney General
AuthorityD.C. Law Library - § 32-1008 Duties of employers; open recordsDC Department of Employment Services - DC Worker Labor and Anti-Discrimination RightsReport an error

Because You Are in Food & Beverage 2Industry layer

LawProduceWhat it requiresTriggerEnforced by
Tipped Wage Workers Fairness Amendment Act - sexual harassment policy and trainingD.C. Law 22-196 (Tipped Wage Workers Fairness Amendment Act of 2018) #Businesses that employ workers paid the tip credit, chiefly restaurants, bars and hotelsWrite
Written policy
Maintain an up-to-date written sexual harassment policy that tells employees how to report harassment both to management and to the Office of Human Rights; give it to every employee and post it where all employees can see it; and submit the policy, the required certifications and a report on harassment complaints received to OHR each year. Train owners, operators, managers and employees through an OHR-certified trainer every two years, with new employees trained within 90 days of hire, and file the training compliance report with OHR within 30 business days of each session. DOES separately requires annual wages and workplace fraud training.
From the first employee
DC Office of Human Rights (harassment policy and training); Department of Employment Services (wage provisions)
AuthorityDC Office of Human Rights - Tipped Wage Workers Fairness ActDC Department of Employment Services - DC Worker Labor and Anti-Discrimination RightsDC OHR - Sexual Harassment Prevention Training and Documentation FAQ (PDF)Report an error
Food establishment license and Certified Food Protection ManagerD.C. Code § 47-2851.03(b)(4); 25-A DCMR (District of Columbia Food Code) #Delicatessens, bakeries, candy manufacturers, grocery stores, retail markets, ice cream manufacturers, restaurants, wholesale markets, mobile vendors and hotelsCertify
Certification
Apply online for the food establishment license with supporting documents and fees, go through facility plan review, and file a HACCP plan or variance request where the operation requires one. Keep a Certified Food Protection Manager present during all hours of operation, credentialed by an accepted national testing organization and valid for three years from the exam date. DC Health inspects on a pass-fail basis and publishes the reports.
From the first employee
DC Health, Food Safety and Hygiene Inspection Services Division; DLCP issues the license
AuthorityDC Health - Food EstablishmentsDC Health - Certified Food Protection Manager (CFPM) CertificateDC Health - Acceptable Organizations for CFPM ExaminationReport an error

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Your business type, with District of Columbia on top

Small businessFederal + industry, with District of Columbia on topConstruction contractorsFederal + industry, with District of Columbia on topHealthcare practicesFederal + industry, with District of Columbia on topFood and beverage businessesFederal + industry, with District of Columbia on topTax and accounting firmsFederal + industry, with District of Columbia on topRegistered investment advisersFederal + industry, with District of Columbia on topInsurance agenciesFederal + industry, with District of Columbia on topRetail and e-commerceFederal + industry, with District of Columbia on topTrucking and logistics carriersFederal + industry, with District of Columbia on topNonprofitsFederal + industry, with District of Columbia on topFederal contractorsFederal + industry, with District of Columbia on top

For another state

Alabama12Alaska12Arizona11Arkansas14California24Colorado18Connecticut17Delaware17Florida15Georgia13Hawaii16Idaho13Illinois19Indiana16Iowa13Kansas11Kentucky14Louisiana13Maine15Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

Sources

D.C. Law Library - § 28-3852 Notification of security breachD.C. Law Library - § [28-3852.02] RemediesD.C. Law Library - § 28-3853 EnforcementD.C. Law Library - § [28-3852.01] Security requirementsD.C. Law Library - Chapter 38 Subchapter IIDC Office of Human Rights - Tipped Wage Workers Fairness ActDC Department of Employment Services - DC Worker Labor and Anti-Discrimination RightsDC OHR - Sexual Harassment Prevention Training and Documentation FAQ (PDF)DC Office of Human Rights - Workplace and Business PostersD.C. Law Library - § 32-531.09 Posting requirementD.C. Law Library - § 32-1453.01 Employer disclosuresD.C. Law Library - § 32-1453.02 NoticeD.C. Law Library - § 32-1452 Prohibited actions of employerD.C. Law Library - § 32-531.07 Encouragement of more generous paid leave policiesDC Paid Family Leave - Information for EmployersD.C. Law Library - § 32-541.03 Contributions to the Universal Paid Leave FundD.C. Law Library - § 32-541.04 Duration and amount of benefitsD.C. Law Library - § 32-581.03a Disclosures to employeesD.C. Law Library - § 32-581.03 Limitations on non-compete provisions for highly compensated employeesD.C. Law Library - § 32-581.04 Relief and penaltiesD.C. Law Library - § 32-1008 Duties of employers; open recordsOSHA - State Plans (Washington, D.C. is under federal OSHA)OSHA - Injury and illness recordkeeping and reporting requirementsDC Department of Licensing and Consumer Protection - Business Licensing DivisionDLCP - Steps to Obtaining a Basic Business LicenseDLCP - Tax Registration and Clean Hands Certification DetailsDC Health - Food EstablishmentsDC Health - Certified Food Protection Manager (CFPM) CertificateDC Health - Acceptable Organizations for CFPM Examination

About this data

Pages on this site are compiled by AllyMatter and checked against one or more sources, two or more where available. Each record shows its stage and date. Nothing here is legal, audit or tax advice, and policyandcompliance.com and AllyMatter, Inc. accept no responsibility for errors or for decisions made on it. Read the source, then decide.
How we compile and verify →

Think something is wrong?

[email protected]
Tell us the page and what you found. We check it against the source and fix it.

Want to advertise here?

[email protected]
Consultant listings, tool listings, press releases and the primary spot, flat fee, paid in advance. Prices and rules · Design examples · Press releases.