What a North Dakota business has to have in writing

Notify affected North Dakota residents in the most expedient time possible and without unreasonable delay, by written, electronic or substitute notice. Report the breach to the Attorney General by mail or email whenever it involves more than 250 individuals. A business with its own written notification procedures inside an information security policy may follow those instead; financial institutions under the federal interagency guidance and HIPAA covered entities and business associates are treated as compliant.

Do not disclose the contents of a customer record, in whole, in part, or folded into a composite, to anyone other than the individual or business the record is about, without their express written consent. Subpoenas, court orders, search warrants and civil discovery are the only carve-outs, so a service provider needs a written consent and disclosure procedure to operate safely here.

Post, in an area every employee can reach, the North Dakota Minimum Wage and Work Conditions Summary poster, the Job Service North Dakota unemployment insurance poster and the federal FLSA minimum wage poster. The Department of Labor and Human Rights supplies all of them free, so there is no reason to buy a commercial all-in-one poster.

Do not pay one sex at a lower rate than the other for comparable work on jobs requiring comparable skill, effort and responsibility under similar conditions. Make and keep records of wages and wage rates, job classifications and other terms and conditions of employment for every employee, preserve them for as long as the person is employed plus two years, and make the reports the Labor Commissioner prescribes. North Dakota has no salary-range disclosure law and repealed the equal pay posting requirement in 1997.

Register or foreign-qualify through the Secretary of State's FirstStop portal, keep a registered agent, and file the annual report on the deadline set for that entity type, updating the mailing address, business activities and stakeholders. Farm and ranch corporations and LLCs also report shares or membership interests and the land they own or lease. An annual report left unfiled for a year leads to involuntary dissolution or termination.

Post no-smoking signs or the international no-smoking symbol clearly and conspicuously inside the premises and at every entrance, remove all ashtrays from areas where smoking is prohibited, tell existing employees and every job applicant that smoking is prohibited there, and ask anyone smoking in violation to stop and then to leave. Smoking is also banned within 20 feet of entrances, exits, operable windows, air intakes and ventilation systems.

Apply to Workforce Safety and Insurance for coverage before anyone starts work, stating the nature of the intended employment and the estimated payroll for the coming 12 months, then report all North Dakota wages to WSI. WSI is the sole provider; private workers' compensation insurance is not permitted in North Dakota. Deducting any part of the premium from wages is unlawful, and so is an employee waiver. Operating uninsured can bring a cease and desist order, a $10,000 penalty plus $100 a day, and personal liability for claims.

Keep a completed employment certificate on file for each 14- or 15-year-old, signed by the parent or guardian, and make it available for inspection by the minor's school principal or the Labor Commissioner. Keep a list of the minors employed. Observe and post the notice of the maximum hours rules: no work before 7 a.m. or after 7 p.m. (9 p.m. from June 1 through Labor Day), no more than three hours on a school day or 18 in a school week, and no more than eight hours a day or 40 hours in a non-school week.

Keep hiring, pay and discipline practices free of the listed protected characteristics, including the North Dakota-specific protection for lawful off-duty activity, and do not retaliate against an employee who reports a suspected violation of law or refuses to break the law. North Dakota does not require a written harassment policy or harassment training, so the substance lives in the employer's own handbook.

Report each new hire to the state directory of new hires within 20 days of the date of hire, giving the employee's name, address and social security number, the date of hire, whether health insurance is offered, and the employer's name, address and federal EIN. Use a W-4 or the equivalent form. An employer with more than 24 employees at any time must report electronically; electronic filers may instead send two monthly transmissions 12 to 16 days apart. Multistate employers who file electronically may designate a single state and notify the federal HHS Secretary in writing.

Hold a Secretary of State contractor license before taking a job over $4,000, in the class that matches the contract size (class A unlimited, B up to $500,000, C and D lower), post the required contractor's bond, show the license number on bids and when applying for a building permit, and renew annually. Working unlicensed is a class A misdemeanor, blocks the contractor from suing on the contract, and carries a civil penalty of up to three times the license fee.

Apply for and hold a license from the Department of Health and Human Services before operating, meet the sanitation, safety, exiting and drinking water standards, allow inspections, and post the certificate of inspection where the statute requires. A separate license is needed to handle salvaged food. Food preparers who fall outside the licensed categories are subject to the department's food preparer education rules.

Develop, implement and maintain a comprehensive written information security program based on a risk assessment, with administrative, technical and physical safeguards, a named owner of the program, retention and destruction schedules, cybersecurity awareness training, third-party service provider due diligence and contractual safeguards, and board or executive oversight with regular reporting. Keep a written incident response plan covering roles, communications, remediation, documentation and post-incident revision. Notify the Insurance Commissioner within three business days of determining a cybersecurity event occurred. Insurers domiciled in North Dakota file a written compliance certification by April 15 each year and keep the supporting records for five years.