Small Business Legal Compliance Checklist: Licenses, Contracts, Taxes, and Privacy by State

Overview

Business compliance is not one task completed at formation. Requirements can depend on your business structure, location, industry, employees, customers, physical premises, and use of personal information. A business operating from home may have different obligations from a restaurant, construction company, online retailer, health practice, or professional service firm.

Start by creating a compliance file—digital or physical—with your formation documents, registrations, licenses, permits, insurance records, tax notices, signed contracts, policies, and renewal dates. Keep a separate list of questions that require confirmation. Rules change, and a document that was appropriate when the business opened may not address a new service, location, employee, vendor, or software tool.

This checklist is designed for planning, not as a substitute for legal or tax advice. If a missed requirement could lead to a lawsuit, penalty, loss of a license, employment claim, or significant contract exposure, consider consulting a contract review lawyer or another attorney with relevant business experience.

Checklist by scenario

1. Starting or buying a business

• Choose and document the business structure, such as a sole proprietorship, partnership, corporation, or limited liability company. An LLC formation legal guide can help identify common formation questions, but state filing requirements should be confirmed directly.
• Check name availability and determine whether a trade name, assumed name, or other local registration is required.
• Register with the appropriate state authority and obtain any required tax identification numbers.
• Confirm city, county, and state business license requirements. Search for industry-specific permits if you sell food, alcohol, regulated products, financial services, health-related services, transportation, construction, or professional services.
• Check zoning, home-occupation, signage, occupancy, and health or safety rules for each physical location.
• Review the purchase agreement, lease, equipment documents, financing records, and any assignment or consent requirements when acquiring an existing business.
• Document ownership, management authority, profit allocation, decision-making, and exit procedures in an operating agreement, partnership agreement, or shareholder agreement where appropriate.

2. Selling products or services

• Use written terms that clearly describe scope, deliverables, deadlines, payment timing, refunds, cancellation, ownership of work, confidentiality, and dispute procedures.
• Use a contract review checklist before signing important customer, supplier, platform, lease, or technology agreements. For independent work, compare this guide with the freelance contract checklist.
• Consider whether a non-disclosure agreement is appropriate before sharing confidential information. An NDA checklist can help you review definitions, permitted uses, exclusions, duration, and remedies.
• Check advertising, labeling, warranty, accessibility, and consumer-protection rules relevant to your product or industry.
• Confirm how sales, use, or other transaction-related taxes may apply to your goods or services and keep records supporting your filings.
• Review vendor and platform contracts for data-use rights, automatic renewals, indemnity language, service levels, and termination procedures.

3. Hiring employees or contractors

• Decide whether each worker is properly classified as an employee or independent contractor under the applicable tests. Classification can affect wages, taxes, benefits, leave, insurance, and recordkeeping. See Independent Contractor vs. Employee for issues to examine.
• Prepare offer letters, employment agreements, contractor agreements, confidentiality terms, invention assignments, and restrictive-covenant provisions only where appropriate and enforceable.
• Set up payroll, required tax withholding, workplace notices, time records, and required employment records.
• Review wage-and-hour, minimum-wage, overtime, meal and rest break, leave, anti-discrimination, accommodation, safety, and workers’ compensation requirements for the locations where people work.
• Give workers a practical handbook or written policies covering conduct, reporting concerns, technology use, privacy, security, and remote work.

4. Running a website, app, or online store

• Publish terms that accurately describe purchases, subscriptions, acceptable use, intellectual-property rights, disclaimers, and dispute procedures.
• Prepare a privacy notice that matches the information you collect, why you collect it, how it is shared, how long it is retained, and how people can exercise available rights.
• Review cookies, analytics, advertising tools, payment processors, customer relationship systems, and other vendors that receive or process personal information.
• Provide appropriate consent, notice, access, deletion, opt-out, or security processes when applicable to your business and the people whose information you handle.
• Use the website legal requirements checklist to review privacy policy compliance, terms, cookies, and disclosures together rather than treating them as separate copy-and-paste documents.

What to double-check

State and local requirements deserve special attention. Confirm obligations in every state where the business is formed, has employees, maintains property, sells directly, or conducts enough activity to trigger registration or tax responsibilities. A license issued in one city or state may not authorize operations elsewhere. Ask the relevant state business office, tax authority, licensing board, and local government what applies, and record the date and source of each confirmation.

Review your contracts for practical gaps: Is the legal name correct? Does the signer have authority? Are payment milestones measurable? Who owns the work product? What happens if delivery is late? Is confidential information defined? Are insurance, indemnity, limitation-of-liability, renewal, termination, governing-law, and dispute provisions acceptable? Do not rely on a generic legal template without adapting it to the transaction and applicable law.

Also double-check the connection between operations and documents. Your privacy notice should match actual data practices. Your contractor agreement should match how the person is managed. Your refund policy should match checkout behavior. Your employee handbook should match payroll and workplace procedures. Inconsistencies can create avoidable risk even when each document appears reasonable by itself.

Common mistakes

• Assuming formation equals permission to operate. Creating an entity does not necessarily satisfy local licenses, permits, tax registrations, or industry approvals.
• Using one contract for every customer. A recurring subscription, one-time project, wholesale order, and professional service may require different terms.
• Copying a privacy policy without reviewing data flows. A policy should describe what the business actually does and should be updated when tools or practices change.
• Ignoring renewal dates. Licenses, assumed-name registrations, insurance, domains, leases, software agreements, and certifications may have different deadlines.
• Mixing personal and business records. Keep business finances, approvals, contracts, and communications organized and separate from personal activity.
• Waiting until a dispute begins. A lawyer can usually provide more useful and less pressured guidance when the business seeks advice before signing, hiring, expanding, or changing its model.

When to revisit

Put this checklist on a recurring review schedule, at least before major planning or renewal cycles. Revisit it immediately when you change the business name or structure, open or close a location, enter a new state, add employees, launch a product, collect new categories of personal information, adopt new tracking tools, sign a major contract, acquire another business, or receive a government notice.

At each review, assign an owner to every task, record the applicable jurisdiction, save the official source or confirmation, and note the next renewal or review date. Compare written policies with actual workflows, remove obsolete forms, and ask whether a new risk justifies professional advice. For related document reviews, see the guidance on small business legal planning and contract review. A short quarterly check and a more complete annual review can make compliance a routine operating process rather than an emergency project.