What a Delaware business has to have in writing

Investigate promptly and, unless the investigation shows the breach is unlikely to cause harm, notify affected Delaware residents within 60 days of discovery. When more than 500 residents are notified, also report to the Attorney General within the same 60 days. If Social Security numbers were involved, offer at least one year of free credit monitoring and give the information people need to enroll.

Implement and maintain reasonable procedures and practices to protect personal information from unauthorized access, use, modification or disclosure, matched to the nature of the data. When records containing personal identifying information are no longer needed, shred, erase or otherwise destroy them so the information cannot be read or reconstructed, and hold service providers to the same standard by contract.

Publish a privacy notice covering the categories of personal data processed and shared, the purposes, the categories of third parties, how consumers exercise and appeal rights, and an active contact route. Get opt-in consent before processing sensitive data or data on a consumer between 13 and 18, recognize universal opt-out signals, sign data processing agreements with processors, and keep a written data protection assessment for targeted advertising, data sales, sensitive data and heightened-risk profiling. Unlike most state privacy laws this one reaches nonprofits and higher education institutions.

Post a conspicuous privacy policy on the site or app that lists the categories of personally identifiable information collected and the third parties it may be shared with, explains how a user can review and request changes, describes how policy changes are announced, and says whether the operator honors Do Not Track signals. Sites directed at children carry extra limits on advertising and on using a minor's information.

Give every employee the Department of Labor's sexual harassment information sheet, or an equivalent document, within six months of hire, and give it to new hires as part of onboarding. Employers at the 50-employee mark must run interactive anti-harassment training for employees within a year of hire and for supervisors within a year of taking the role, then repeat it every two years, and keep the attendance records.

Build and maintain a written information security program based on a documented risk assessment, with board oversight, third-party service provider due diligence and a written incident response plan. Insurers domiciled in Delaware file a written certification of compliance with the Commissioner by February 15 each year and keep the supporting records for five years, documenting any area identified for improvement and the remediation underway. A cybersecurity event meeting the statutory triggers must be reported to the Commissioner within three business days.

A procurement condition, not a certification programme. Every state IT solicitation, contract and data-sharing agreement that involves offsite hosting must carry the Department of Technology and Information's signed Cloud Services and Data Usage Agreement, and contracts already running must add it at the next renewal. The supplier commits in writing to encryption in transit and, for personal information, at rest using FIPS 140-2 validated cryptography, and a supplier that cannot encrypt at rest must instead carry cyber security liability insurance for the life of the contract. Delaware asks suppliers to follow recognised approaches such as FedRAMP, Cloud Security Alliance and NIST, but stops short of requiring any authorization or certification, and the state is not a GovRAMP participant. Any cloud or externally hosted engagement is separately vetted on the state side through DTI's business case process, the Architecture Review Board, the Technology Investment Council and the Department of Justice.

Register with the Delaware Paid Leave system, withhold and remit the quarterly contributions or get approval for a private plan, and give employees written notice of paid leave rights at hire, when they ask about leave and once a year. Post the program notice, keep the required records, and set out job protection, benefit continuation and how to apply for benefits in a written leave policy.

Display the Department of Labor's poster set - minimum wage, wage payment and collection, equal pay and discrimination, sexual harassment, whistleblower protection, child labor, unemployment insurance, workers' compensation and Delaware Paid Leave - where employees can see it, and give the same notices to remote workers.

Application forms, screening criteria and interview scripts must carry no request for an applicant's pay history, and recruiters acting for the employer have to be instructed in writing to follow the same rule. Pay history may only be sought after an offer with compensation terms has been made and accepted.

Every internal and external job posting must state the pay or pay range plus a general description of benefits and other compensation; commission and tipped roles must say so and give the base wage. Where no posting exists the range must be given to the applicant before any offer or pay discussion. Job descriptions and wage rate history for each employee must be kept for at least three years and handed to the Department of Labor on request.

File the certificate of incorporation or formation, or a foreign qualification, with the Division of Corporations, keep a Delaware registered agent, and meet the annual obligations: corporations file an annual report and franchise tax by March 1, LLCs and LPs pay the annual tax by June 1. Register any trade name with the prothonotary in each county where you operate.

Get a Delaware business license from the Division of Revenue before starting operations, using the Delaware One Stop registration, and renew it annually or on the three-year cycle where that applies. File and pay gross receipts tax on the schedule assigned to your license category, and register for employer withholding and unemployment insurance at the same time. Contractors coming from out of state must also post a surety bond before starting a project.

Get a permit from the Division of Public Health Office of Food Protection before opening, submit plans for new or remodeled facilities, and renew the permit each year. Each establishment must have a person in charge with a certified food protection manager credential from an accredited program available for inspectors, and must keep written employee health reporting agreements on file.

Either certify an exemption because you already sponsor a qualified plan, or register with Delaware EARNS, upload the employee roster, distribute the program packet so employees have the statutory window to opt out or set their own rate, and remit payroll deductions each pay period.

Take salary history questions out of applications, screening scripts and interview guides. You may not ask an applicant or a former employer about compensation history, or screen applicants on it, though you may confirm a figure the applicant volunteers after an offer with terms of compensation has been made. Review recruiter contracts so third parties working for you follow the same rule.

Get and keep on file a valid work permit for every employee under 18 before the first day of work, return it to the issuing officer when employment ends, and follow the daily, weekly and school-night hour limits and the prohibited occupations list. Post the child labor notice with the rest of the poster set and keep the permit available for Department of Labor inspection.