What a New Jersey business has to have in writing

Report the breach to the Division of State Police before telling customers, then notify affected New Jersey customers in the most expedient time possible and without unreasonable delay once misuse of the information is reasonably possible. Notify the national consumer reporting agencies when more than 1,000 people are notified, and keep the investigation records for five years.

Publish a privacy notice covering the categories of personal data processed and shared, the purposes, the categories of third parties, how to exercise and appeal rights, and an active contact channel. Get consent before processing sensitive data or the data of a consumer aged 13 to 16 for targeted advertising or sale, honor rights requests and universal opt-out signals within 45 days, keep written data protection assessments for higher-risk processing, and use written processor contracts.

Public employers must post the PEOSH poster, follow the adopted federal and New Jersey standards, keep injury and illness records, and maintain the written programs those standards call for, such as hazard communication, bloodborne pathogens and indoor air quality. Private employers follow federal OSHA instead, since New Jersey's state plan does not cover them.

A procurement condition, and the closest thing New Jersey has to a supplier authorization program. A bidder in scope files the state's Third-Party Information Security Questionnaire with its quote, and a bidder that does not has seven business days to comply after the state asks or the quote can be ruled non-responsive. The questionnaire tracks the controls in the Statewide Information Security Manual, itself built on the NIST Cybersecurity Framework, the CIS Critical Security Controls and the Cloud Security Alliance Cloud Controls Matrix, and asks among other things whether the product is FedRAMP or StateRAMP authorized and at what impact level. The New Jersey Cybersecurity and Communications Integration Cell reviews the submission, may demand further documentation, certifications and attestations, and issues a Third-Party Information Security Risk Assessment Report; the submission is not complete until that report exists. The sponsoring agency then decides whether the risk rating is acceptable, and the state can require extra controls to be in place before any contract is awarded. Holding a GovRAMP authorization is not itself required.

Let employees accrue one hour of paid sick leave for every 30 hours worked, up to 40 hours a benefit year, give each employee a written notice of the right at hire and on request, in English and their first language where the Department publishes one, and post the earned sick leave notice at every worksite. The written policy has to state the benefit year start and end dates and the accrual, carryover and payout rules.

Give eligible employees up to 12 weeks of job-protected family leave in a 24-month period, post the Family Leave Act notice, and post the Family Leave Insurance and Temporary Disability Insurance notices while also handing a copy to each new hire, to any employee who asks and to any employee taking qualifying leave.

Display the Department of Labor's poster set at every worksite: earned sick leave, wage and hour abstract, payment of wages, child labor and minors' hours, family leave insurance, unemployment and disability, CEPA whistleblower rights, the SAFE Act, the gender equity notice, misclassification and reporting and record keeping, plus the Division on Civil Rights and federal notices and the carrier's workers' compensation notice.

In every internal or external posting for a new job or a transfer opportunity, state the hourly wage or salary, or a range, and a general description of the benefits and other compensation programs the employee would be eligible for; pay or benefits may be raised at the offer. Before deciding a promotion, make reasonable efforts to tell all current employees in the affected department about it, except promotions awarded for years of experience or performance and emergency promotions.

File the entity formation or foreign registration with the Division of Revenue and Enterprise Services, register for tax and employer purposes on form NJ-REG within 15 days of starting business, name a registered agent, and file the annual report each year. Municipal mercantile licenses are separate.

Post a notice of employee whistleblower rights and remedies in a conspicuous place, name the person inside the company designated to receive complaints, and distribute the written notice to every employee at least once a year, in English and Spanish and in any other language spoken by a majority of the workforce.

Post the Department of Labor gender equity notice, hand or email a copy to every employee at hire, again each year by December 31, and whenever an employee asks, and collect a signed written acknowledgment that the employee received and read it within 30 days of each distribution.

Allow up to 20 days of unpaid, job-protected leave in a 12-month period for an employee or their family member who is a victim of domestic violence or a sexually violent offense, keep the request and supporting documents confidential, and post and give employees the Department of Labor SAFE Act notice.

Write a standard operating procedure for reasonable-suspicion testing that pairs a scientifically valid test with a documented physical observation of impairment made by a trained, designated staff member, record the observation on a standard form, and stop treating a positive cannabis test on its own as grounds for discipline. Employees have a right to explain a positive result.

Give each temporary worker a written statement of the assignment terms, pay rate, employer and worksite details in their preferred language before the shift, provide a detailed itemized wage statement, keep assignment and pay records for six years, register the staffing firm with the Division of Consumer Affairs, and pay temporary workers no less than the client's comparable employees.

Register with the Division of Consumer Affairs before selling or doing the work, carry at least $500,000 commercial general liability insurance, show the registration number in every advertisement and contract, and use a written contract signed by both sides that states the total price, start and finish dates, a description of the work and the three-day cancellation right.

A covered facility has to stand up a violence prevention program, seat a violence prevention committee with defined membership and duties, and keep a written violence prevention plan that its workers can take part in shaping.

The facility must conspicuously display, in a common area, a written notice in the statutory wording stating that assaulting a health care professional, volunteer or employee on duty is a crime carrying a fine, imprisonment or both.

Get a license from the local health authority before opening and renew it annually, keep a person in charge on duty who demonstrates food safety knowledge, employ at least one certified food protection manager where the risk type requires it, and maintain the written employee health, allergen and clean-up procedures the Food Code calls for.

Put in place a comprehensive written information security program with administrative, technical and physical safeguards sized to the licensee, covering risk assessment, access controls, service-provider oversight and program monitoring, and adjust it as the business and threats change. Cybersecurity events affecting New Jersey customers also trigger the state's breach notification duty.