What a New York business has to have in writing

Notify affected New York residents in the most expedient time possible without unreasonable delay, and separately notify the Attorney General, the Department of State Division of Consumer Protection and the State Police through the AG's breach reporting portal; when more than 500 residents are affected, file the written determination and template notice with the AG within ten days. If the business concludes an inadvertent disclosure is unlikely to cause harm, document that determination in writing and keep it for five years.

Develop, implement and maintain a data security program with administrative, technical and physical safeguards: name a security coordinator, run risk assessments, train staff on security practices, put security terms into vendor contracts, test and monitor controls, and dispose of private information securely. Small businesses may size the program to their operations and the sensitivity of the data.

Do not process the personal data of a user known to be under 18, or of any user of a service aimed at minors, and do not let processors or third parties do so, unless: for users 12 and under, COPPA allows it (generally with verifiable parental consent); for users 13 to 17, it is strictly necessary for a listed purpose (marketing and advertising never qualify) or the user has given informed consent through a separate, clear request that makes refusal the most prominent option. Never buy or sell a covered user's data. Within 30 days of learning a user is a minor, delete data you are not allowed to keep and tell third parties you shared it with. Document the permitted purpose relied on and put written, binding agreements in place with processors.

Adopt a written sexual harassment prevention policy that meets or exceeds the state model: examples of prohibited conduct, the complaint form, the internal investigation procedure, external forums for redress, and a statement that retaliation is unlawful. Give every employee the policy in writing at hire and at each annual training, in English and in the employee's primary language, and run interactive sexual harassment prevention training every year with extra content for supervisors.

Adopt a written airborne infectious disease exposure prevention plan, either the Department of Labor's industry model or an equivalent one covering health screening, face coverings, employer-paid PPE, a designated supervisor to enforce it, and notification duties. The plan sits dormant until the Commissioner of Health designates a highly contagious airborne disease; on designation it must be activated, distributed to employees within 30 days and to new hires at hire, and posted at each worksite.

Public employers must follow the OSHA standards PESH adopts, post the state Public Employees Safety Rights notice, keep injury and illness records, and report fatalities and hospitalizations to PESH. Private employers in New York meet federal OSHA recordkeeping and posting duties instead.

Let employees accrue at least one hour of sick leave for every 30 hours worked and give the annual entitlement the statute sets for the employer's size (56 paid hours at 100+ employees, 40 paid hours at 5-99 employees or at 4 or fewer with over $1M net income, 40 unpaid hours at 4 or fewer with $1M or less net income). Employers commonly document this in a written sick leave policy, must keep accrual and use records for six years, and must give an employee a summary of accrued and used leave within three business days of a request.

Buy Paid Family Leave insurance (usually as a rider on the disability policy), collect the employee payroll contribution, and either add Paid Family Leave language to the employee handbook or issue written guidance explaining the benefit and how to file a claim. Post and keep in plain view the carrier's Notice of Compliance, and complete the employer part of each leave request.

Display the Department of Labor's required notices where employees can see them: minimum wage, job safety and health (with the OSHA 300A summary posted from February 1 for three months), equal pay, whistleblower retaliation protections, criminal conviction records, no-smoking signs, minor work schedules, the Unemployment Insurance notice (IA 133), the tip deduction and tip appropriation notices if you sell or serve food or beverages, and the veterans' benefits poster if you have more than 50 full-time employees; add the workers' compensation, disability and Paid Family Leave notices from the insurance carrier and the Division of Human Rights discrimination poster. Construction employers also post the Construction Industry Fair Play Act notice; employers on public work projects post the prevailing rate schedule and public work notice (Labor Law article 8); health care employers post the nurse coverage plan (section 167); and the fringe benefits and hours policy must be given in writing or posted (section 195.5). Give employees in writing the pay notice at hire, the sexual harassment prevention policy, and the breast milk expression policy at hire and every year.

State a good-faith minimum and maximum pay range, and the job description if one exists, in every advertisement for a job, promotion or transfer opportunity, whether public or internal; a commission-only role says that pay is based on commission. Do not refuse to interview, hire, promote or otherwise retaliate against anyone for using these rights.

File a certificate of incorporation or articles of organization (or an application for authority for an out-of-state entity) with the Department of State, name the Secretary of State as agent for service of process, file an assumed name certificate where a DBA is used, and file a biennial statement every two years in the anniversary month of the original filing.

Give employees 30 minutes of paid break time to express breast milk as often as reasonably needed for three years after a child's birth, plus unpaid time, and make reasonable efforts to provide a private, non-bathroom room close to the work area. Hand every employee the Department of Labor written policy on the rights of employees to express breast milk at hire and once a year after that, and give written notice of the section to employees returning to work after a birth.

Give every new hire written or electronic notice, acknowledged in writing or electronically, that phone calls, email and internet activity may be monitored at any time, and post the same notice conspicuously for existing employees. Purely automated systems for managing message volume or protecting the network are exempt.

Run a written cybersecurity program built on an annual risk assessment, with documented policies approved by the governing body, a designated Chief Information Security Officer, secure development and third-party vendor security procedures, identity and access management, audit trails, staff training, and a tested incident response plan. Report a cybersecurity incident to the Department of Health no later than 72 hours after determining one has occurred.

Get a permit to operate from the local health department (or the Department of Health district office) before opening, and show proof of New York workers' compensation, disability and Paid Family Leave coverage before the permit is issued; then operate to the Subpart 14-1 standards on food handling, temperature control and facility condition and pass routine inspections. New York City runs its own food protection certificate rules on top of the state code.

Maintain a written cybersecurity policy and program approved by the board or a senior officer, based on periodic risk assessment; appoint a CISO who reports to the board at least annually; run penetration testing, vulnerability management, access reviews, multi-factor authentication, an incident response plan and a business continuity plan; file a written Certification of Material Compliance or an Acknowledgement of Non-Compliance with the Superintendent by April 15 each year and keep five years of supporting records; report a cybersecurity incident to DFS within 72 hours and a ransom payment within 24 hours.

Adopt a retail workplace violence prevention policy, either the Department of Labor model or an equal one, covering the risk factors retail staff face, prevention methods, the federal and state laws on violence against retail workers and the remedies available, and a statement that retaliation is unlawful; give it to every employee in writing at hire and at each training. Train employees on workplace violence prevention every year at 50 or more retail employees, every two years below that. From January 1, 2027 retailers with 500 or more employees statewide must install silent response buttons and train staff on them.