What a Michigan business has to have in writing

After discovering a breach, determine whether it is likely to cause substantial loss or injury or identity theft; if so, notify each affected Michigan resident without unreasonable delay by mail, email or, for large or costly incidents, by substitute notice. The notice must describe the breach in general terms, say what data was involved, list what the business is doing about it, give a contact phone number and tell people to watch their credit reports. Michigan does not require a state agency filing, but breaches affecting more than 1,000 residents must be reported to the national consumer reporting agencies.

When data containing personal information is removed from a database and the business is not keeping it elsewhere for another purpose, destroy it by shredding, erasing or otherwise changing it so it cannot be read, deciphered or reconstructed. The duty covers personal information held about individuals in a database, not only customer and employee records. A knowing violation is a misdemeanor punishable by a fine of up to $250 per violation. Many businesses use a written retention and destruction schedule to meet this; the statute itself does not require one.

Write a privacy policy for the social security numbers you hold. It has to keep them confidential so far as practicable, forbid unlawful disclosure, limit who can reach the information or documents that contain them, describe how to dispose of those documents properly, and set penalties for breaking the policy. Publish that policy in an employee handbook, a procedures manual or a similar document, which may be electronic.

Follow the MIOSHA standards, which adopt the federal standards plus Michigan-only parts, display the MIOSHA required poster set, keep the injury and illness log and report fatalities and serious hospitalizations to MIOSHA. Written programs are required wherever the applicable MIOSHA part calls for one, including hazard communication, bloodborne infectious diseases, respiratory protection, lockout and confined space, and construction employers must run an accident prevention program.

Keep a written hazard communication program covering container labeling, safety data sheets and employee training, hold a current chemical inventory for each workplace, make the safety data sheets available on every shift, post the Employee Right to Know notice, and train employees before their first exposure and whenever a new hazard arrives.

Let employees accrue at least one hour of earned sick time for every 30 hours worked, up to 72 hours a year for most employers and 40 for small businesses, and allow carryover or frontloading. Display the state ESTA poster where employees can read it and give each employee written notice of their rights at hire, and keep hours-worked and sick-time records for at least three years.

Display the state's required notices where employees gather: MIOSHA safety and health protection, Right to Know, the new-or-revised SDS notice, the annual summary of injuries and illnesses (Form 300A, posted February to April), minimum wage and overtime, earned sick time, youth employment, whistleblower protection, unemployment insurance and the workers' compensation carrier notice. MIOSHA and the Wage and Hour Division publish the posters free.

Do not make nondisclosure of wages a condition of employment, do not ask an employee to sign any waiver or document purporting to deny the right to disclose their wages, and do not discharge, formally discipline or hold back for job advancement an employee who discloses their wages. So any handbook, offer letter or confidentiality agreement that gags pay talk has to be rewritten. Separately, do not pay one sex less than the other within an establishment for equal work needing equal skill, effort and responsibility under similar conditions, unless the gap runs off a seniority system, a merit system, a system measuring earnings by quantity or quality of production, or a factor other than sex, and never fix a gap by cutting anyone's pay. Michigan sets no salary-range disclosure duty.

File formation or foreign-qualification documents with the LARA Corporations Division, keep a resident agent and registered office on record, and file the annual report or annual statement every year to stay in good standing: corporations by May 15 (MCL 450.1911) and LLCs by February 15 (MCL 450.4207); since June 2025 those filings are online only, through the MiBusiness Registry Portal. Employers register separately for withholding and unemployment insurance.

Post at every work site, or otherwise make available to employees in writing, a notice of the regular paydays and the time and place of payment, together with the employer's written policy on fringe benefits such as vacation, sick pay, holidays and bonuses. Deductions from pay need the employee's written consent for each deduction, and the wage and benefit records have to be kept.

Obtain and keep on file at the minor's workplace a current, age-appropriate work permit before the minor starts work, follow the hour, time-of-day and prohibited-occupation limits for that age, and post the youth employment notice. Since October 2, 2026, work permits come only through the state's centralized system (the Youth Employment Permit Portal), overseen by the Wage and Hour Division.

Post notices, and use other appropriate means, to keep employees informed of their protections and obligations under the Whistleblowers' Protection Act (MCL 15.368). The state publishes the poster free. Employers commonly mirror this in a written internal reporting and non-retaliation procedure.

Complete the required prelicensure course, pass the exam and hold a residential builder or maintenance and alteration contractor license from the Bureau of Construction Codes before contracting, renew every three years with continuing competency, and use a written contract that carries the license number and the disclosures the Occupational Code requires.

Get the right license before opening, from MDARD for retail and processing operations or from the local health department for food service, and renew it annually. Food service establishments must keep a certified food safety manager on staff, hold food handler training records, and follow the written procedures the Food Code requires such as an employee health reporting agreement and a variance or HACCP plan for specialized processes.

Run a risk assessment and maintain a comprehensive written information security program with administrative, technical and physical safeguards, third-party service provider oversight and a written incident response plan. Insurers domiciled in Michigan file the Information Security Program Annual Certification (form FIS 2360, or FIS 2378 if exempt) with the DIFS Director by February 15 each year and keep the supporting records; cybersecurity events get reported to the Director as promptly as possible and no later than 10 business days after the licensee determines one occurred (form FIS 2359). Licensees with fewer than 25 employees, counting independent contractors, and licensees that comply with HIPAA are exempt from the program requirements (MCL 500.565); a licensee that reaches 25 must comply within 180 days. The exemptions do not cover the duties to notify the Director and residents.