- Record every workplace violence incident. Cal/OSHA guidance says workplace violence incidents are documented in the violent incident log, including incidents that do not become OSHA 300 entries.
- Build the log as redacted from the start. Personal identifying information, including details that identify someone when combined with public facts, must stay out of the SB 553 incident log.
- Keep violent incident logs for at least five years. Incident investigation, hazard identification, evaluation, and correction records are also five-year records.
- Employees and representatives can access the log. Hazard records, training records, and violent incident logs must be produced within 15 calendar days, at no cost.
- Keep names in the investigation file. The separate investigation file can preserve witness notes, HR follow-up, security material, and counsel-directed work without polluting the shareable log.
Exact answers
- If personal information could allow someone to be identified from the contents of the incident log, can it go in the log? No. Identifying information must not be included in the SB 553 violent incident log. Do not wait for an employee or employer redaction request.
- Does the SB 553 incident log need to be redacted? Yes. Build the violent incident log as a non-identifying record from the start instead of creating a name-heavy file and trying to redact it later.
- Can personal identifying information be included in the SB 553 violent incident log? No. Personal identifying information must not be included in the SB 553 violent incident log. Omit names, addresses, email addresses, phone numbers, Social Security numbers, medical details, and facts that alone or combined with public information could identify a person involved in the incident.
- What personal information could allow someone to be identified? Names and direct contact details are obvious, but the rule also reaches combinations of facts. For example, a job title, shift, exact location, relationship, unusual circumstance, or public-facing role can identify a person when paired with publicly available information.
- Where do names, witness notes, and HR details go? Put them in the separate investigation file or other appropriate confidential record. The shareable log should contain prevention facts without identifying the people involved.
- How long shall an employer retain records of violent incidents? Keep the violent incident log for at least five years. Keep workplace violence incident investigation records for at least five years as well.
- Which applicable records must be available within 15 calendar days? Hazard identification, evaluation, and correction records, training records, and violent incident logs must be available to employees and authorized representatives within 15 calendar days of a request, at no cost.
Exact answer: what the violent incident log is for
The violent incident log is the employer's required record of workplace violence incidents. It is for prevention, not blame. The log gives the employer, employees, and Cal/OSHA a way to see where incidents are happening, what type of violence is recurring, what circumstances were present, and what the employer did after the incident.
Cal/OSHA's general-industry guidance separates the log from the post-incident investigation. After a workplace violence incident, an employer should record required information in the log, investigate and evaluate the incident, determine and implement needed changes, and review whether the written workplace violence prevention plan needs revision.
The log should answer these practical questions without naming the people involved:
- What happened?
- When and where did it happen?
- Which workplace violence type was involved?
- What circumstances made the incident more likely or more severe?
- Was security or law enforcement contacted?
- What was done to protect employees from a continuing or future threat?
That is why an empty log is not automatically a good fact. If employees can describe threats, assaults, weapon displays, stalking spillover, or customer aggression but the log has no entries, the recordkeeping system is probably failing.
Exact answer: can personal identifying information be included in the log
No. Personal identifying information must not be included in the SB 553 violent incident log.
That is the practical answer to the common training-question phrasing: personal information that could allow someone to be identified from the contents of the incident log is not "redacted at the employee's request" or "redacted at the employer's request." It should not be included in the log in the first place.
Cal/OSHA and DIR materials describe this broadly. Leave out names, addresses, email addresses, phone numbers, Social Security numbers, and any other information that would identify a person involved in the incident. Also leave out combinations of details that make a person identifiable when paired with publicly available information.
That is the answer to the long-form query employers often paste from the rule: if personal information could allow someone to be identified when combined with other public information, do not put it in the log. Put sensitive names, witness notes, medical details, HR facts, security material, and legal analysis in the separate investigation file instead.
Use neutral descriptions instead:
| Do not put this in the log | Use this kind of description instead |
|---|---|
| "Maria R. at register 2" | "Front-end employee at register area" |
| "John Smith, former employee" | "Former employee" |
| A home address, phone number, email, or Social Security number | Omit it from the log |
| A detailed family relationship that identifies the employee | "Person with known personal relationship to employee" |
| Medical details about the employee | Keep medical information out of the log and route medical records separately |
| Exact shift plus unique role that identifies one person | "Employee working closing shift" or another broader non-identifying description |
From rule to working record
Build an audit-ready record chain
The incident log is the shareable, non-identifying layer. A usable packet keeps the sensitive facts elsewhere and preserves the follow-through an employee request or Cal/OSHA review will look for.
- Violent incident log: non-identifying event facts, violence type, circumstances, and response.
- Confidential investigation file: names, witness notes, HR follow-up, security material, and counsel-directed work.
- Hazard correction record: the owner, due date, corrective action, and proof that the identified hazard was addressed.
- Audit packet: the plan, log, investigation reference, training record, hazard correction, and review history organized for retrieval.
SB553Ready organizes the software workflow and record packet. It does not provide legal advice or attorney review.
The person completing the log is different. The log can identify the person who completed the entry, including that person's name, job title, and completion date, because that is part of the required entry documentation. The no-identifying-information rule is aimed at people involved in the violent incident.
Exact answer: how long incident records must be retained
Violent incident logs must be retained for at least five years.
Keep workplace violence incident investigation records for at least five years as well. Cal/OSHA's general-industry page lists both violent incident logs and records of workplace violence incident investigations in the five-year bucket. It also lists workplace violence hazard identification, evaluation, and correction records in the five-year bucket.
Training records have a different minimum retention period: at least one year.
| Record | Minimum retention |
|---|---|
| Violent incident log | 5 years |
| Workplace violence incident investigation records | 5 years |
| Hazard identification, evaluation, and correction records | 5 years |
| Training records | 1 year |
| Cal/OSHA Form 300, when the injury/illness is recordable | 5 years |
Do not clear out the log each calendar year. A practical system should preserve the running history and still let you filter by year, location, incident type, work area, and corrective action.
Exact answer: who can access workplace violence records
Employees and authorized representatives can access certain workplace violence records. Cal/OSHA's general-industry guidance says hazard identification, evaluation, and correction records, training records, and violent incident logs must be made available to employees and authorized representatives within 15 calendar days of a request, at no cost, for examination and copying.
Cal/OSHA can request all workplace violence records, including incident investigations.
| Requester | What they can access |
|---|---|
| Employee | Hazard records, training records, and violent incident logs within 15 calendar days, at no cost |
| Authorized employee representative | The same 15-day access to hazard records, training records, and violent incident logs |
| Cal/OSHA | All workplace violence records on request, including incident investigations |
| Employer management, HR, safety, counsel | The underlying working files needed to investigate, correct hazards, and maintain the program |
Keep the employee-access log separate from the confidential investigation file. The log is designed to be shareable because it omits personal identifying information. The investigation file can contain witness notes, HR follow-up, security material, counsel-directed work, and other sensitive information that should not be dumped into a routine employee record packet.
What goes in each log entry
DIR's employer fact sheet summarizes the violent incident log fields. At minimum, each entry should capture:
- Incident date, time, and location.
- Workplace violence type.
- A detailed description of the incident.
- A classification of who committed the violence.
- Circumstances at the time of the incident.
- Where the incident occurred.
- The incident characteristics, such as a physical attack, weapon involvement, threat, sexual assault or threat, animal incident, or other event.
- Consequences of the incident, including law enforcement involvement.
- Steps taken to protect employees from further threat or hazards.
- Who completed the log, including name, job title, and date completed.
The four workplace violence types
Every log entry should classify the incident.
| Type | Meaning | Practical example |
|---|---|---|
| Type 1 | Criminal intent by someone with no legitimate business at the worksite | Robbery, break-in, or armed threat by a stranger |
| Type 2 | Violence directed at employees by customers, clients, patients, students, inmates, or visitors | Customer threatens a cashier or patient threatens staff |
| Type 3 | Violence against an employee by a present or former employee, supervisor, or manager | Former employee threatens a manager |
| Type 4 | Violence by someone who does not work there but has or had a personal relationship with an employee | Employee's former partner comes to the worksite and threatens staff |
The type matters because it points to different controls. Type 1 may call for cash handling, lighting, access control, and closing procedures. Type 2 often points to de-escalation, staffing, service-counter design, and escalation rules. Type 3 and Type 4 require reporting, threat response, and coordination with HR, security, and law enforcement when needed.
Need your SB 553 audit packet cleaned up this week?
Get a guided setup and audit-packet review to organize your plan, training records, incident log, hazard fixes, and exportable packet.
Common mistakes
Treating the log like an OSHA 300 replacement
The violent incident log is not the OSHA 300 log. Cal/OSHA's FAQ says all workplace violence incidents are documented in the violent incident log. A workplace violence injury or illness is recorded on the OSHA 300 only when it meets the occupational injury and illness recording criteria.
Waiting for police involvement
Law enforcement contact is a field in the log. It is not the trigger for the log. Threats and no-injury incidents can still belong in the violent incident log.
Treating redaction as a last-minute cleanup
If the log contains employee, witness, patient, customer, or aggressor names, it is not built for the employee-access rule. The better practice is not "redact later." It is to write the log in a non-identifying format from the start, then move the "who said what" details to the investigation file and keep the log focused on prevention facts.
Forgetting the corrective action
The log should not end at the description of the event. Inspectors and employees will look for what changed afterward. If a parking lot threat led to lighting repair, staffing change, revised closing procedure, or training follow-up, connect that back to the log and hazard correction records.
Keeping the log outside the audit packet
The log is one of the first records to organize. It should link to the post-incident investigation, hazard correction records, and annual plan review. That is what makes it useful during a Cal/OSHA inspection or employee record request. For the rest of the program, go back through the SB 553 compliance resource hub and route the work into the checklist, WVPP template, penalties guide, healthcare comparison, threat response checklist, and 2026 update.
If the incident came from an active or recent threat, use the workplace violence threat response checklist to separate immediate safety steps, the non-identifying log entry, and the confidential investigation file. If the log shows the written plan is stale, update the California workplace violence prevention plan template and then re-check the full SB 553 compliance checklist.
Sources
- California Labor Code Section 6401.9 - statutory text for the violent incident log, personal-identifying-information omission, five-year retention, and 15-calendar-day employee access rules.
- Cal/OSHA Workplace Violence Prevention for General Industry - agency guidance on incident response, record retention, and access to workplace violence records.
- Cal/OSHA Workplace Violence Prevention FAQ - agency answers on violent incident logs, OSHA 300 overlap, plan accessibility, training, and enforceability.
- DIR general-industry employer fact sheet - DIR fact sheet summarizing the violent incident log fields, personal-identifying-information rule, training topics, and record retention.
- DIR general-industry worker fact sheet - employee-facing Cal/OSHA fact sheet describing access to hazard records, training records, and violent incident logs.
Frequently asked questions
What is the violent incident log for?
It is the SB 553 record of workplace violence incidents. It helps the employer evaluate patterns, investigate incidents, correct hazards, review whether the workplace violence prevention plan is working, and produce required records.
Can personal identifying information be included in the SB 553 violent incident log?
No. Personal identifying information must not be included in the SB 553 violent incident log. Omit names, addresses, email addresses, phone numbers, Social Security numbers, and details that alone or combined with public information would identify a person involved in the incident.
Does the SB 553 incident log need to be redacted?
Yes. The practical way to comply is to make the log non-identifying from the start. Do not enter names, direct contact details, Social Security numbers, medical information, or combinations of facts that would identify a person involved in the incident.
What counts as identifying information in a violent incident log?
Direct identifiers count, and so do combinations of facts. A job title, exact shift, precise location, family relationship, unusual role, or public detail can identify someone when combined with other information.
Where do names, witness notes, and HR details go?
Keep them in the separate incident investigation file or other appropriate confidential record, not in the shareable violent incident log. The log should contain prevention facts without identifying the people involved.
How long shall an employer retain records of violent incidents?
SB 553 violent incident logs must be retained for at least five years. Workplace violence incident investigation records must also be retained for at least five years.
Which applicable SB 553 records must be available within 15 calendar days?
Hazard identification, evaluation, and correction records, training records, and violent incident logs must be made available to employees and authorized representatives within 15 calendar days of a request, at no cost.
Is the violent incident log the same as the OSHA 300 log?
No. The violent incident log records workplace violence incidents. The OSHA 300 log records qualifying work-related injuries and illnesses. One event can require both, but many violent incidents belong only in the violent incident log.
How we research & review these guides →
This article is general information about California workplace violence prevention requirements, not legal advice. Confirm your program with qualified counsel or a workplace safety professional.