What a Montana business has to have in writing

Tell affected Montana residents without unreasonable delay by written, electronic, telephone or substitute notice. At the same time send the Attorney General's Office of Consumer Protection an electronic copy of the notice plus a statement of the date and method of distribution and the number of Montanans notified. Coordinate with the credit bureaus if the notice points people to their credit file. A business that keeps its own written notification procedures inside an information security policy may follow those instead.

Take all reasonable steps to destroy customer records containing personal information once they no longer need to be kept, by shredding, erasing or otherwise making the information unreadable. Many businesses use a written retention and disposal schedule to do this; the statute itself requires only reasonable steps.

The act applies to a business that controls or processes the personal data of at least 25,000 Montana consumers, or at least 15,000 consumers if more than 25% of its gross revenue comes from selling personal data. Publish a clear privacy notice covering the categories of data processed, the purposes, what is sold or shared and to which categories of third parties, a contact address, how to exercise and appeal rights, and the last-updated date, in every language the product is offered in. Keep reasonable administrative, technical and physical security practices; collect only what is necessary; get consent before processing sensitive data; conduct and document a data protection assessment for targeted advertising, data sales, risky profiling and sensitive-data processing and hand it to the Attorney General on demand; the assessment duty covers processing activity after January 1, 2025. Give a plain opt-out link for sales and targeted advertising. Honor a consumer's revocation of consent within 45 days. Anyone offering an online service to a known minor has extra duties regardless of size.

Publish both a short high-level privacy overview and a full public privacy notice covering collection, consent, use, access, disclosure, transfer, security, retention and deletion. Take layered express consent: initial consent to collect and use, separate consent to transfer data or a sample to a third party by name, separate consent for uses beyond the primary purpose, informed consent for research, and consent for marketing or any sale. Build and maintain a written comprehensive security program, and run processes for consumers to access, delete, revoke consent and have samples destroyed. Do not release genetic data to a health, life or long-term care insurer, or to the consumer's employer, without express consent, and require valid legal process before disclosure to law enforcement. Genetic data may not be stored in a country the statute lists as sanctioned or as a foreign adversary. The act exempts protected health information under HIPAA, research uses and government uses. A violation of section 30-23-104 carries a civil penalty of $2,500 for each violation.

Establish and administer an education-based safety program with, at a minimum: a general safety orientation for every new employee before they begin their regular job duties, job- or task-specific safety training before they perform that job or task without direct supervision, continuing regular refresher training, a system for the employer and employees to develop safety awareness, periodic self-inspection for hazards when the program starts, at new worksites and at least annually with documented corrective action, and documentation of those activities. An employer that uses temporary workers includes them in its program. Employers with more than five employees run a safety committee of employer and employee representatives that meets at least once every four months. The department recommends that the committee document its activities and act as a fact-finding body reporting to the employer.

Grant a reasonable leave of absence for pregnancy, do not terminate because of pregnancy, do not impose a mandatory maternity leave of unreasonable length, and do not withhold accrued disability or leave benefits. When the employee signifies an intent to return, reinstate her to the original or an equivalent job with equivalent pay, seniority, retirement and other service credits, unless that is impossible or unreasonable because a private employer's circumstances have changed. Montana has no statewide paid sick leave or paid family leave law.

Register or foreign-qualify through the Secretary of State's business filing portal, name a registered agent, record an assumed business name where one is used, and file the annual report between January 1 and April 15 each year to stay active. The first annual report is due the year after the entity is formed.

After probation, a Montana employee can be discharged only for good cause. A discharge is also wrongful if it retaliates for reporting or refusing to violate public policy, if the employer materially violated an express provision of its own written personnel policy, or if it violates the employee's free speech rights (39-2-904). During probation either side may end the employment at will. If the employer does not set a probationary period, or state that there is none, before work starts, a 12-month period applies by default. The employer can extend probation, but the total cannot exceed 18 months, and leave of absence extends it (39-2-910). The act does not itself require a written personnel policy.

Adopt written testing policies and procedures and make them available to all employees 60 days before they take effect or change. The policy has to set out the legal sanctions for unlawful drug activity, the employer's education program on drug and alcohol risks, its standards of conduct, the employee assistance programs available, the sanctions for a violation or a positive test, the test types used, the substances screened and the alcohol threshold, the hiring policy for applicants who test positive, the detailed testing and dispute-resolution procedure, and confidentiality rules for results.

Do not refuse employment, bar someone from employment or vary pay or terms based on vaccination status or whether the person holds an immunity passport. Recommending a vaccine is allowed. A licensed health care facility may ask employees to volunteer their status only for the purpose of deciding reasonable accommodation measures, and a facility that asks employees to volunteer their status must implement reasonable accommodation measures. Any employer vaccination policy has to be written against this rule.

Give the employee an itemized statement with every wage payment showing state and federal income tax, social security and any other deductions and the amount of each; where no deductions were taken, give a statement saying so.

Hold a current construction contractor license from the Department of Labor and Industry before doing business, with proof of compliance with workers' compensation law and the identity details of the owners, partners, officers, managers or members plus the registered agent. Renew on the department's cycle. This replaced the older contractor registration program on January 1, 2026.

Make sure the affected employee and any witnesses give an oral report within 24 hours of an act of violence, then write a formal report capturing the employer's contact details, the employee's details, the assailant where known, and a detailed description with the time of the oral report. Keep the reports separate from patient medical records, retain them for five years, and give copies to the Department of Justice quarterly or on request. Report to law enforcement if the employee consents.

Get an annual license from the Department of Public Health and Human Services before operating, one per establishment, signed and validated as the statute requires. Temporary food establishments get a permit from the local regulatory authority in the county where they operate, and need a fresh permit each time the menu changes substantially by food type or means of production.

Develop and maintain an information security policy for safeguarding personal information, together with written security breach notice procedures. On a breach, notify affected individuals without unreasonable delay and simultaneously file an electronic copy of that notice with the Commissioner of Securities and Insurance, along with the date and method of distribution and the number of Montanans notified. Service providers must report a breach to the licensee immediately on discovery.