What CEOs, HR managers, and business owners need to do differently when a complaint lands on their desk.
Monday morning. A complaint lands on your desk. Maybe an employee says her manager has been harassing her. Maybe an exit interview points to retaliation. Maybe your finance lead spotted numbers that do not add up.
You are now in charge of what happens next. And what happens next will be judged by someone who was not in the room.
That someone could be a California Civil Rights Department investigator. It could be a Labor Commissioner. It could be a jury. It could be opposing counsel asking, two years from now, why a key document was never saved.
One thing protects you in all of those settings. Good notes, kept as the investigation unfolds. Not made up later. Not pulled together the night before a deposition. Written down as it happens.
This guide shows you how to do that under California law. We focus on the rules that actually apply, the steps that hold up under outside review, and the mistakes we see employers make over and over.
I. Why California is Different (and Why it Matters to You)
California protects employee privacy more than federal law and more than most other states. Article I, Section 1 of the California Constitution treats privacy as a basic right. The California Supreme Court has said this right applies to private companies, not just government employers. (Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1.)
In practice, this means that when you look at an employee’s emails, devices, or personal information during an investigation, the question is whether the employee had a reasonable expectation that this information would stay private. (Hernandez v. Hillsides, Inc. (2009) 47 Cal.4th 272.)
You lower that expectation with a clear, written policy. If your company tells employees in writing that company email, company computers, and company systems may be monitored, and the employee signs that policy, you have a much stronger position when you need to look. If you do not have that policy, or if it has not been updated in years, fix this before your next investigation. This is the single most important policy document you have.
California also makes investigation a duty, not a choice. Under Government Code section 12940(k), employers must take reasonable steps to prevent and correct harassment and discrimination. Courts have read this to include investigating complaints when they come in. The question is rarely whether to investigate. It is how to investigate so the file holds up.
California Rules that Apply Every Time
- Labor Code § 435: No audio or video recording in restrooms, locker rooms, or rooms used for changing clothes. No exceptions, even for investigations.
- Penal Code § 632: Recording a confidential conversation in California requires the consent of all parties. No secret recordings of witness interviews.
- Labor Code § 980: Employers cannot demand personal social media passwords. A narrow exception in § 980(c) allows requests for content reasonably believed relevant to an investigation.
- CCPA / CPRA: Employee data is fully covered as of January 1, 2023, for qualifying businesses. Data duties continue during investigations.
II. Opening the File: What to Write Down Right Now (The First 30 Minutes)
The file starts before you collect a single piece of evidence. The first thing you write is the intake memo.
Your intake memo records the date you received the complaint, who received it, what was said, and any first steps you took (such as separating the parties, cutting off system access, or suspending privileges). It names who authorized the investigation and the investigator who will handle it.
First 30 Minutes · Sequence of Actions
- Receive the complaint and stop reacting
- Note any urgent separation or access steps
- Open the intake memo
- Authorize the investigation and assign the investigator
- Begin the investigation log
If you bring in an external investigator, the engagement letter sets the scope of the investigation, the issues to look into, the standard of proof (preponderance of the evidence, which means more likely than not), and what the final deliverable will look like.
From the moment the file opens, log every step. Date, time, what you did, why you did it. Gaps in the log create gaps in your defense. In our experience, investigations that don’t hold up aren’t the ones where the investigator got it wrong.
They’re the ones where the investigation report can’t show the work. A conclusion without a documented path is a conclusion that can’t be defended.
Do This Today
Start the intake memo the moment a complaint comes in. Not the next day. Not after you “look into it a little.” Right now.
III. The Documents that Will Make or Break Your Case
Memory fades. Documents do not. In harassment, discrimination, and retaliation matters, what you collected and how you collected it will outweigh what anyone remembers.
The documents you will need in most investigations are emails, text messages, Teams or Slack messages, performance reviews, calendars, attendance records, schedules, pay records, complaint logs, training records, and signed policies.
Here is how to collect them.
Figure out which categories of documents relate to the allegations. Pull them in their original electronic form, with the metadata intact. Metadata is hidden data about a file, such as when it was created, who edited it, and when.
Write down the source, the date range, who produced the document, and the date you collected it. Put collected documents in a separate investigation folder where they cannot be changed.
Once a document is in your file, do not mark it up. Do not highlight it. Do not write notes in the margins. Any analysis goes in the investigator notes, with citations back to the clean original.
IV. Electronic Evidence: Email, Texts, and Company Devices
Work from copies, not originals. Opening the original file can change the metadata. When you look at a copy, the original is preserved exactly as it was.
Save emails with the full header. The header shows sender, recipient, timestamps, and server path. Printing to PDF often strips this data. If authenticity is later challenged, the header is your proof.
Write down the tools and search terms you used. If you searched a specific mailbox for the words “complaint” and “harassment” between certain dates, write that down. An investigator who cannot describe what was searched, where, and how, cannot defend the completeness of the search.
Date and label every screenshot, and include the URL or file path showing where it came from. A screenshot without context is hard to authenticate later.
Personal devices and personal accounts are different. You generally cannot make an employee hand over a personal phone, personal email, or personal social media password. The narrow section 980(c) exception lets you request personal social media content you reasonably believe relates to the investigation. It is not a license to demand passwords.
When personal devices or accounts become relevant, talk to counsel before you make the request.
V. When Physical Items Are Part of the Complaint
Physical items come up most often in theft, vandalism, safety incidents, and certain harassment cases where notes, gifts, or photographs are part of what the complaint is about.
When you collect a physical item, write down right then: the date and time, where you took it from, who collected it, and a description specific enough to tell it apart from similar items. Photograph items in place before you move them. Store items securely with access controlled and logged.
This is chain of custody. It supports the credibility of your findings under the preponderance standard and the AWI Guiding Principles (AWI is the Association of Workplace Investigators, the leading professional body for this work). It does not have to meet the standards of a criminal trial.
VI. Cameras, Recordings, and What You Can Legally Use
Video footage is becoming more central in California workplace investigations.
Labor Code section 435 prohibits audio or video recording in restrooms, locker rooms, or rooms used for changing clothes. No exceptions. Footage from those areas cannot be used, regardless of how it was obtained.
Outside those areas, video is generally allowed in workspaces where employees do not have a reasonable expectation of privacy. Notice matters. If employees know cameras cover the warehouse and the entry doors, their expectation of privacy in those areas drops. The reasonable expectation analysis from Hernandez v. Hillsides governs the close cases.
When you preserve footage as evidence, keep the original unedited file. Any shorter version used for review should be labeled as a clip, with a record of how it was created and by whom. The preservation log should include the system, camera number, date and time range, who pulled the footage, and where the original is stored.
Audio is stricter. Penal Code section 632 generally prohibits recording a confidential conversation without the consent of all parties. Witness interviews in California are not recorded unless the witness agrees on the record.
VII. Talking to Witnesses Without Wrecking Your Case
The interview is the work. The Witness Interview Summary is what survives. The summary is what will be read by lawyers, regulators, and decision-makers years from now.
A good Witness Interview Summary identifies the witness, the date, time, and location of the interview, who else was present, and what the witness said. Direct quotes belong in the summary only when the exact words matter.
The summary keeps clear lines between what the witness said happened, what the witness saw for themselves, what the witness heard from others, and what the investigator noticed about the witness’ demeanor. Mixing those four categories is one of the most common problems in company investigation files.
Write summaries the same day, if possible. A summary written a week later, after other interviews have happened, is a less reliable record.
The National Labor Relations Board, in Stericycle, Inc., 372 NLRB No. 113 (August 2023), restored a stricter test for workplace rules, including confidentiality instructions given to witnesses. A blanket “do not discuss this” instruction can be challenged as interfering with employees’ rights to talk about workplace conditions.
If you give a confidentiality instruction, tailor it. Connect it to a specific business reason, such as protecting a witness from retaliation, keeping evidence intact, or preventing witnesses from comparing stories before they are interviewed. Document the reason in the file. Put the instruction in writing.
VIII. The Five Mistakes We See Over and Over
In the workplace investigations we conduct, the same documentation problems appear again and again. Each one is fixable.
- Backfilling the file: The investigation log should show steps recorded as facts came in, not a narrative built backward from the conclusion. A log written all at once at the end will look that way to anyone reading it.
- Marking up evidence: Highlighted or annotated documents lose their value. Analysis goes in a separate document, with citations to clean source material.
- Treating verbal complaints as informal: A verbal complaint is a complaint. The intake memo opens whether it came by email, in person, or through a passing comment.
- Sweeping confidentiality orders: After Stericycle, the old “do not discuss this with anyone” instruction does not hold up. Apply reasonable and legitimate limitations (such as not discussing anything discussed during the investigation interview with co-workers during the pendency of the investigation) and tailor it with a stated business reason, or do not give it.
- Losing metadata: Printing emails to PDF and forwarding messages strip data that proves authenticity. Collect in native format whenever you can.
IX. Closing and Keeping the File
A complete investigation file typically includes the intake memo and the authorization to investigate, the engagement letter for outside investigators, the investigation log, all collected evidence with custody notes, all interview summaries, the analysis notes, any privileged communications with counsel, and the final investigation report.
Access to the file should be limited to people who need it. Investigation working files are usually not personnel records subject to inspection under Labor Code section 1198.5 and should be kept separate from the personnel folder. Discipline documents that result from findings may go into the personnel folder, but the working file stays separate.
Do not destroy investigation files while related matters are open or could open. If you reasonably expect an administrative charge or a formal complaint, your duty to preserve attaches and overrides any default destruction schedule.
X. When You Need an External Investigator
Some matters can be handled internally. Many cannot. We generally recommend bringing in an outside investigator when one or more of these conditions apply.
- The complaint involves a senior executive or HR leader: Independence is hard to demonstrate when the subject sits above or beside the people running the investigation.
- The matter could lead to terminating an employee with significant tenure: The risk of a wrongful termination claim climbs with tenure, and a well-documented external investigation reduces that risk.
- The result will be reviewed by someone outside the company: A Civil Rights Department charge, EEOC charge, or administrative complaint brings outside scrutiny that an internal investigation often cannot withstand.
- Your internal team lacks the time or specialized skill the matter requires: Investigations done in the margins of other work usually look like they were.
An outside investigator brings independence, a clear methodology, and a documentation framework built for scrutiny. Those are the same elements that determine whether an investigation holds up.
California Labor Solutions, LLC. This Is the Work We Do.
A workplace complaint is a moment that shapes everything that follows. The investigation that comes out of it will either give you a defensible record to act on, or it will not. There is no version of this work where a thin file gets stronger with time.
California Labor Solutions (CLS) exists for this work. We hold California Private Investigator License Number 26311. Under Business and Professions Code section 7520, conducting external workplace investigations in California for hire generally requires either a State Bar license or a Private Investigator license.
The category of HR firms that hold this license is extremely small. Most do not, which means most cannot lawfully provide this service in this state.
Our founder and lead investigator, Shawn P. Larry, J.D., brings a Juris Doctor and more than twenty years of California employment and workplace investigation experience to every matter. Every investigation we conduct is governed by the AWI Guiding Principles and the preponderance of the evidence standard.