What a Michigan business has to have in writing

After discovering a breach, determine whether it is likely to cause substantial loss or injury or identity theft; if so, notify each affected Michigan resident without unreasonable delay by mail, email or, for large or costly incidents, by substitute notice. The notice must describe the breach in general terms, say what data was involved, list what the business is doing about it, give a contact phone number and tell people to watch their credit reports. Michigan does not require a state agency filing, but breaches affecting more than 1,000 residents must be reported to the national consumer reporting agencies.

Destroy customer and employee records containing personal information once the business no longer needs to keep them, by shredding, erasing or otherwise making the data unreadable and unreconstructable. In practice this means writing and following a retention and destruction schedule that covers paper and electronic records alike.

Write a privacy policy for the social security numbers you hold. It has to keep them confidential so far as practicable, forbid unlawful disclosure, limit who can reach the information or documents that contain them, describe how to dispose of those documents properly, and set penalties for breaking the policy. Publish that policy in an employee handbook, a procedures manual or a similar document, which may be electronic.

Follow the MIOSHA standards, which adopt the federal standards plus Michigan-only parts, display the MIOSHA required poster set, keep the injury and illness log and report fatalities and serious hospitalizations to MIOSHA. Written programs are required wherever the applicable MIOSHA part calls for one, including hazard communication, bloodborne infectious diseases, respiratory protection, lockout and confined space, and construction employers must run an accident prevention program.

Keep a written hazard communication program covering container labelling, safety data sheets and employee training, hold a current chemical inventory for each workplace, make the safety data sheets available on every shift, post the Employee Right to Know notice, and train employees before their first exposure and whenever a new hazard arrives.

Run a risk assessment and maintain a comprehensive written information security program with administrative, technical and physical safeguards, third-party service provider oversight and a written incident response plan. Insurers domiciled in Michigan file the Information Security Program Annual Certification with the DIFS Director by February 15 each year and keep the supporting records; cybersecurity events get reported to DIFS within three business days.

Let employees accrue at least one hour of earned sick time for every 30 hours worked, up to 72 hours a year for most employers and 40 for small businesses, and allow carryover or frontloading. Display the state ESTA poster where employees can read it and give each employee written notice of their rights at hire, and keep hours-worked and sick-time records for at least three years.

Display the state's required notices where employees gather: MIOSHA safety and health protection, Employee Right to Know, minimum wage and overtime, earned sick time, youth employment, whistleblower protection, unemployment insurance and the workers' compensation carrier notice. MIOSHA and the Wage and Hour Division publish the posters free.

Do not make nondisclosure of wages a condition of employment, do not ask an employee to sign any waiver or document purporting to deny the right to disclose their wages, and do not discharge, formally discipline or hold back for job advancement an employee who discloses their wages. So any handbook, offer letter or confidentiality agreement that gags pay talk has to be rewritten. Separately, do not pay one sex less than the other within an establishment for equal work needing equal skill, effort and responsibility under similar conditions, unless the gap runs off a seniority system, a merit system, a system measuring earnings by quantity or quality of production, or a factor other than sex, and never fix a gap by cutting anyone's pay. Michigan sets no salary-range disclosure duty.

File formation or foreign-qualification documents with the LARA Corporations Division, keep a resident agent and registered office on record, and file the annual report or annual statement (February 15 for corporations, February 15 for LLCs) to stay in good standing. Employers register separately for withholding and unemployment insurance.

Complete the required prelicensure course, pass the exam and hold a residential builder or maintenance and alteration contractor licence from the Bureau of Construction Codes before contracting, renew every three years with continuing competency, and use a written contract that carries the licence number and the disclosures the Occupational Code requires.

Get the right licence before opening, from MDARD for retail and processing operations or from the local health department for food service, and renew it annually. Food service establishments must keep a certified food safety manager on staff, hold food handler training records, and follow the written procedures the Food Code requires such as an employee health reporting agreement and a variance or HACCP plan for specialized processes.

Post at every work site, or otherwise make available to employees in writing, a notice of the regular paydays and the time and place of payment, together with the employer's written policy on fringe benefits such as vacation, sick pay, holidays and bonuses. Deductions from pay need the employee's written consent for each deduction, and the wage and benefit records have to be kept.

Obtain and keep on file at the minor's workplace a current, age-appropriate work permit before the minor starts work, follow the hour, time-of-day and prohibited-occupation limits for that age, and post the youth employment notice. From October 2026 all permits must come through the state's centralized work permit system.

Post the state whistleblower notice where employees can see it, telling them they may report suspected violations of law to a public body without retaliation and how to bring a claim. Employers commonly mirror this in a written internal reporting and non-retaliation procedure.