California WVPP: A Small Business Guide

In July 2024, a new California law quietly went into effect that most small business owners still do not know about. It requires every employer in the state to have a written Workplace Violence Prevention Plan, train their employees on it, and keep a log of any incidents. The penalties for ignoring it start at over $16,000 per violation.

If you run a restaurant, retail shop, salon, or any business where customers come through the door, this applies to you. There is no small business exemption.

Here is what the law requires, what your plan needs to include, and how to get into compliance without turning it into a massive project.

What Is the California WVPP Requirement?

Senate Bill 553 was signed in September 2023 and took effect on July 1, 2024. It added a new section to the California Labor Code that requires employers to establish, implement, and maintain a written Workplace Violence Prevention Plan, or WVPP.

The law was driven largely by incidents in healthcare settings, but the final version covers almost all California employers. If you have employees and your location is accessible to the public, you must comply. A coffee shop in Costa Mesa with three part-time employees has to follow the same rule as a company with 300 workers.

The only employers that are exempt are those with fewer than 10 employees working at a location at any given time, where that location is not open to the public. A plumber working alone in a warehouse with no customer walk-in traffic, for example, might qualify. A restaurant, a nail salon, a boutique, a gym, a pet store -- none of them qualify for that exemption.

Why Most Small Business Owners Have Not Heard of This

Part of the reason so many owners are still unaware is that the law did not get the same media coverage as minimum wage increases or pay transparency rules. It was framed as a workplace safety issue rather than a hiring or HR issue, so it fell through the cracks for a lot of small operators.

The other reason is that Cal/OSHA enforcement has been building gradually. In 2025, inspectors began citing employers more actively, and the penalties are not small. A general violation can run $16,285. A willful or repeat violation can reach $162,851. For a small business, either of those numbers is painful.

The good news is that compliance is not complicated once you understand what is actually required. This is not like writing a legal brief. Cal/OSHA even published a free model template you can customize for your business.

The Four Types of Workplace Violence

California's law defines four categories of workplace violence. Your plan needs to account for each one.

Type 1 is violence by someone with no legitimate business relationship to your location -- a robbery, for example, or a random act of violence by a stranger. This is the most common concern for retail and food service businesses.

Type 2 is violence by a customer, client, or patient. In restaurant and retail settings, this usually means an agitated customer who escalates to threatening or physical behavior.

Type 3 is violence between coworkers -- an argument that turns physical, or threats between staff members.

Type 4 is violence connected to someone's personal life that spills into the workplace. A domestic violence situation that follows an employee to work is the most common example.

Your plan does not need to be a thick binder covering every imaginable scenario. It needs to show that you have thought about each of these categories in the context of your specific business and location, and that you have procedures in place for preventing and responding to incidents.

What Your Plan Must Include

Cal/OSHA specifies the required components of a compliant WVPP. Here is what every plan needs.

Who is responsible. Name the specific person (or job title) in your business who owns the WVPP. In a small operation, this is usually the owner or general manager. You cannot just say "management." It needs to be a real person or role.

How employees can report concerns. Your plan must describe how workers can flag a threat, an incident, or a hazard without fear of retaliation. You need to include a statement that you will not retaliate against anyone who reports in good faith. For a small team, this might just be: tell the manager or call the owner directly.

How you identify and assess hazards. Walk through your space with the question: where could something go wrong? A late-night bar in Huntington Beach has different risks than a daytime dry cleaner in Irvine. Factors to assess include who has access to your location, whether you handle cash, whether you are open late, whether employees are ever alone, and whether customers have ever been threatening or aggressive.

How you correct hazards. Once you identify a risk, the plan needs to show how you address it. This could be as practical as: adding a lock to the back office door, installing a doorbell camera, removing the ability for cashiers to open the register without a manager present, or establishing a two-person rule for late closing shifts.

How you respond to and investigate incidents. If something happens -- a threat, a fight, a robbery attempt -- what do you do? Who calls 911? Who talks to witnesses? How do you document what happened? Your plan should spell this out at a basic level.

Employee training. You must train employees on the plan when they are first hired, and then annually after that. The training has to cover the specific risks at your location and cannot be a generic off-the-shelf video. It does not need to be long. Thirty minutes walking through the plan, showing employees how to report incidents, and discussing what to do if a situation escalates is sufficient for most small businesses.

The Violent Incident Log. You are required to keep a written log of any workplace violence incidents. The log must record the date, time, location, type of violence, the person involved (without personally identifying information if they are an employee), any injury, what security measures were in place, and what actions were taken afterward. Cal/OSHA provides a log template. If you have a zero-incident record and nothing to log, you still need the log -- it just stays blank.

How to Actually Create Your Plan

The fastest path to compliance is Cal/OSHA's free model WVPP, which is a fillable document available on the Cal/OSHA Workplace Violence Prevention page. You download it, fill in your business name, the name of your responsible person, your specific hazards and procedures, and you have a working plan.

You are not required to use their template. But for most small businesses, it covers everything you need and takes a couple of hours to complete honestly and thoughtfully.

After you fill it out, do not just file it in a drawer. The law requires that employees can access it on request, so keep a copy somewhere accessible -- a shared folder, a binder in the break room, or an email you can resend.

A few practical additions that most small businesses in Southern California should consider adding to their plan:

Put in clear guidance on cash handling. If your employees deal with cash, address how you reduce that risk -- whether that is a drop safe, a policy of keeping a minimal amount in the register, or requiring two people to close out at the end of the night.

Note your security setup. If you have cameras, a door buzzer, or a panic button, mention it in the plan. If you do not have any of these things, the hazard assessment section is a good prompt to reconsider.

Address after-hours procedures. Closing shifts carry elevated risk. Who locks up? Does anyone confirm the building is clear? Is there a check-in call with the owner?

The Training Requirement

You need to train employees when they start and once per year after that. The training has to be in a language your employees understand, which matters a lot for businesses in Orange County where bilingual teams are common. If your staff primarily speaks Spanish, a training given only in English does not satisfy the requirement.

The training should cover:

• What workplace violence is, including the four types
• How to report a threat or incident
• What to do if a situation becomes dangerous (get out, call 911, alert others)
• Who the responsible person is and how to reach them
• How to access the WVPP

For most small teams, this can be done as part of your regular onboarding process and then as an annual refresher. You do not need a consultant or a formal classroom session. A focused 30-minute team meeting where you walk through the document together and take a few questions is sufficient for most businesses.

Document that the training happened. Write down the date, what was covered, and who attended. Keep that record for at least five years, which is what the law requires for training documentation.

What Happens If You Do Not Comply

Cal/OSHA can conduct inspections based on complaints from employees, following an incident, or randomly. If they find you do not have a WVPP or that your plan does not meet the requirements, they issue citations.

Penalties depend on the type and severity of the violation:

• General violations: up to $16,285
• Repeat or willful violations: up to $162,851

Beyond fines, if a violent incident occurs at your business and Cal/OSHA discovers you had no plan and provided no training, your liability exposure in any related lawsuit increases significantly. The plan is not just a compliance checkbox -- it is evidence that you took your duty of care seriously.

If you already have an employee handbook, consider adding a section that references the WVPP and tells employees where to find it. They are separate documents, but pointing to one from the other makes your compliance more visible.

A Note on Related Compliance

The WVPP is one of several California employment laws that have gone into effect in recent years that catch small business owners off guard. If you are making sure your compliance is tight, also review your obligations under California's meal and rest break rules, paid sick leave requirements, and overtime law. Each of these has its own documentation and training requirements that layer on top of the WVPP.

Running a small business in California requires keeping up with a real amount of compliance work. The businesses that handle it well are the ones that treat it as an ongoing part of operations rather than something to panic about once a year.

Where to Start Today

If you do not yet have a WVPP:

1. Download the model plan from the Cal/OSHA Workplace Violence Prevention FAQ page, which also has answers to the most common questions.

2. Fill it in for your specific location and situation. Be honest about the hazards that actually exist in your business.

3. Schedule a 30-minute team meeting to walk through the plan together.

4. Document that the training happened.

5. Put a reminder in your calendar to do it again in 12 months.

That is the whole process. It does not require a lawyer or an HR consultant. It requires honesty about what the risks are at your location and enough follow-through to put them in writing.

Where My Friendly Staff Fits In

The WVPP requirement is specifically about workplace safety, not hiring. But the two intersect more than people realize. Part of reducing Type 3 and Type 4 incidents (coworker violence and personal conflicts that follow someone to work) starts with hiring people who are a stable fit for your team.

A fast, consistent screening process helps you get to know candidates before they start. My Friendly Staff screens applicants automatically when they call your hiring number, so you can spend your in-person interview time on the questions that actually tell you who someone is.

Once you have your WVPP sorted and your compliance in order, your next focus is building a team worth protecting. Read our guide on how to hire employees for a small business if you are starting that process or want to tighten it up.

California's compliance landscape is not getting simpler. But none of these requirements are designed to trip up small business owners who are genuinely trying to do right by their employees. Take them one at a time, document what you do, and you will be in good shape.