Updated November 8, 2026. This article was first written in February 2025. It reflects the record rules that applied then. A 2026 change to California’s personnel records law that specifically addresses training records is described separately in the “Current context” section near the end. It is general information, not legal advice.
The binder nobody thinks about
Every hospitality business accumulates training records. There are RBS certification details for servers and managers, harassment prevention certificates, food handler cards, workplace violence prevention training sign-in sheets, and onboarding acknowledgments. These records often live in a binder in the office, a shared drive, a scheduling app, or a manager’s phone.
Training records prove compliance, but they also contain personal information. Handled carelessly, they can expose employees’ details to coworkers or the public. Handled well, they protect both the business and its workers. This guide looks at what records California law expects hospitality employers to keep, who can see them, and how to store them responsibly.
RBS records: what ABC provides and what employers verify
ABC’s RBS FAQ explains that ABC does not issue physical or downloadable RBS certificates. A server’s status appears on their RBS Server homepage, which shows their nine-digit Server ID number. Servers can print an unofficial copy of their status, but ABC says the employer must confirm official status with the Server ID in the RBS Portal. With a License Administrator account, an employer can check status by searching the Server ID and last name as they appear in the portal.
That means a typical restaurant’s RBS records consist of a roster: names, Server IDs, certification status, expiration dates, and the date status was last verified. Because a Server ID and last name are what is needed to look up status, treat that roster as internal information. Do not post it on a break room wall or share it in a group chat.
ABC also says each server must register for their own account and that the email address must be registered to them. Managers should never create accounts for staff or ask for portal passwords. Collect only what you need: the Server ID and the legal name as it appears in the portal.
Workplace violence prevention training records
California’s workplace violence prevention law, Labor Code section 6401.9, operative since July 1, 2024, contains specific training record requirements. Under subdivision (f)(2), training records must be created and maintained for at least one year and must include:
- Training dates.
- Contents or a summary of the training sessions.
- Names and qualifications of the persons conducting the training.
- Names and job titles of all persons attending.
Subdivision (f)(6) says these records, along with hazard records and violent incident logs, must be made available to employees and their representatives upon request and without cost for examination and copying within 15 calendar days. Subdivision (f)(5) says all records required by the section must be made available to Cal/OSHA upon request.
That 15-day deadline is short. A business that keeps sign-in sheets scattered across locations may struggle to respond in time. Our workplace violence prevention guide covers the plan itself.
The same section also has a privacy rule for the violent incident log: employers must omit personal identifying information sufficient to identify any person involved, such as names, addresses, and phone numbers. Investigation records must not contain medical information as defined in the Civil Code.
Build the record at the end of each session, not weeks later. Have attendees sign in, attach a short summary of what was covered, and note the trainer and their qualifications before everyone leaves. Records assembled from memory are rarely complete.
Signed documents and employee copies
Hospitality onboarding often involves many signatures: acknowledgments of the alcohol service policy, the harassment policy, the handbook, and training completion. Labor Code section 432 says that if an employee or applicant signs any instrument relating to obtaining or holding employment, they must be given a copy upon request.
A practical approach is to give employees copies of signed acknowledgments automatically, or store them in an employee portal where workers can access their own documents. That avoids delays when someone asks.
Personnel records access
California also gives current and former employees a right to inspect and receive copies of personnel records relating to their performance or to any grievance, under Labor Code section 1198.5. Training records connected to performance, such as documentation of a server’s refusal training or a corrective action requiring retraining, may fall within that right. Employers should have a designated person to receive requests and a process for responding on time. The current statute’s specific timelines and the 2026 changes are summarized at the end of this article.
Where training records should live
Many small venues keep records in several places at once. Consolidating them reduces both privacy risk and response time. Consider:
- One secure location. Use a locked cabinet or an access-controlled digital folder rather than a shared drive anyone can open.
- Role-based access. Shift leads may need to see who is certified, but not employees’ home addresses or medical notes.
- Separation of sensitive files. Keep medical information, accommodation requests, and investigation files separate from general training rosters.
- Consistent naming. Name files by employee, training type, and date so records can be found quickly.
- Retention schedule. Keep each record type for at least the period the law requires, and dispose of records securely afterward if no longer needed.
What to collect, and what not to
Collect what the law requires and what you need to manage the business. For RBS, that is the Server ID, legal name, status, and expiration date. For workplace violence prevention training, it is the elements listed in section 6401.9(f)(2). Avoid collecting copies of driver’s licenses or Social Security numbers in training files unless there is a specific need. Less data means less to protect.
Photos of certificates on managers’ personal phones are a common weak point. If a manager photographs a training certificate, move it to the secure system and delete it from the phone.
Third-party training providers
RBS training is delivered by ABC-approved providers, and other trainings may come from vendors or online platforms. ABC’s FAQ notes that the training provider’s website is separate from the RBS Portal and uses different login information. When choosing vendors for other trainings, ask how they store completion records, who can access them, and how you can export them if you change vendors. Your business remains responsible for producing records when an employee or agency asks.
Harassment prevention training certificates
Many hospitality employers use the Civil Rights Department’s free online harassment prevention training. CRD’s training page explains that at the end of the course, the employee enters information to generate a certificate of completion, which they can save, print, screenshot, or photograph. CRD tells employees to ask their employer beforehand how the employer prefers to receive the certificate, and says CRD cannot email a replacement certificate.
That puts the burden on the employer to collect certificates reliably. Tell employees exactly how to submit them, such as uploading to a secure HR portal rather than texting a photo to a manager, and confirm receipt. A missing certificate is hard to recreate later.
When employees leave
Turnover is constant in hospitality, and former employees’ records still need care. Keep their files in the same secure system, marked inactive, for at least the required retention periods. Remove former employees from active rosters so their Server IDs are not mistakenly treated as current staff. If a former employee asks for records, follow the same process as for current staff. When records reach the end of their retention period and are no longer needed, shred paper and delete digital files securely rather than tossing them in the trash.
Responding to a records request
A simple process helps:
- Log the date the request was received.
- Identify which law applies: workplace violence records, personnel records, or signed documents.
- Gather the records from your consolidated system.
- Verify the requester’s identity or authorization.
- Provide records within the applicable deadline and note the date provided.
Assign this task to one trained person, often the general manager or HR lead, so requests do not get lost.
Insurers and audits
Insurers may ask for proof of training when underwriting or renewing coverage. Share summaries, such as a list showing that all servers are certified and the expiration dates, rather than full personnel files. Our insurance and RBS article discusses what insurers may request. For renewal tracking, see our RBS renewal guide.
A scenario at a restaurant group
A three-location restaurant group discovers that RBS rosters, harassment training certificates, and workplace violence sign-in sheets are kept differently at each site, some in binders and some on managers’ phones. The operations manager creates one access-controlled folder per location, with a standard roster template for RBS status and expiration dates, and moves all certificate photos off personal phones. When a former bartender asks for her training records, the group produces them within days because everything is in one place.
Frequently asked questions
Does ABC send employers RBS certificates?
No. ABC says employers confirm official status with the Server ID in the RBS Portal.
How long must workplace violence training records be kept?
Section 6401.9 requires at least one year.
Can I post a list of certified servers?
Keep rosters internal. Server IDs and names are what is needed to look up status.
Current context as of November 8, 2026
Labor Code section 1198.5 was amended by SB 513, effective January 1, 2026, after this article was first written. The current text expressly includes “education or training records” in the personnel records employees may inspect and copy, and requires employers that maintain education or training records to include the employee’s name, the training provider’s name, the duration and date of the training, the core competencies of the training, and the resulting certification or qualification. The current statute requires inspection and copies within 30 calendar days of a written request, with limited written extensions to no more than 35 days; requires employers to keep personnel records for at least three years after termination; and allows a $750 penalty for failing to comply on time. Review your training record templates against the current text.
The bottom line
Training records protect your license and your team only when they are complete, findable, and private. Consolidate them, limit access, and know which deadlines apply when someone asks.
Make Your RBS Records Easy
Clean records start with certified staff. ServeTrain’s ABC-approved online RBS course helps California servers and managers complete certification on schedule. Before enrolling, register or log in to your RBS Portal account with ABC and confirm your chosen course appears in the portal’s training provider search.
Sources
- ABC: RBS Frequently Asked Questions
- California Labor Code 6401.9
- California Labor Code 432
- California Labor Code 1198.5 (current text)
- CRD: Sexual Harassment Prevention Training
This article is general information, not legal advice.
