Workplace Investigations

Before commencing a workplace investigation, an employer must review the terms of any applicable employment contract, policy, procedure or industrial instrument. These documents will likely contain clauses that will dictate the investigation process.

There is also a significant body of common law that dictates how an investigation should be conducted and the procedural fairness that should be afforded to those involved. To ensure a workplace investigation is procedurally fair, employers must consider several factors, including:

• putting all allegations to the respondent in a manner which does not suggest a pre-determination of the outcome;
• conducting the investigation in a timely manner;
• providing the respondent with the opportunity to respond to the allegations;
• conducting a fair investigation process;
• making an unbiased (and not pre-determined) decision; and
• permitting the respondent and complainant to involve a support person or union representative.

Employers should also consider the additional steps they can take to conduct a best-practice investigation, including:

• being thorough and taking the time to plan the investigation;
• communicating clearly and fairly;
• considering whether the allegations are indicative of a wider workplace behaviour problem;
• maintaining confidentiality; and
• preventing victimisation.

Austrian law does not impose an obligation on employers to conduct internal investigations and they do not have to follow a specific legal pattern when doing so. However, an obligation to conduct internal investigations may arise out of certain provisions of criminal, company or even labour law – in particular, an indirect obligation arising from an employer's duty of care, which requires them to act against employee mistreatment, such as bullying.

If such internal investigations are initiated, compliance with labour law and data protection regulations is mandatory. According to section 16 of the Austrian Civil Code (ABGB), the employer must also protect the personal rights of the individual. It is important to emphasise that a company's internal investigation is a private measure and differs from official investigations.

There is no specific legislation regarding a workplace investigation. In general, an employer has the right to investigate incidents at the workplace based on their authority over employees. However, the investigative powers of the employer are among others limited by the general right to privacy, which is also enshrined in Collective Bargaining Agreement No. 81 of 26 April 2002 to protect the privacy of employees concerning the control of electronic online data. If there are official complaints by employees due to sexual harassment, bullying or violence at work,  well-being legislation provides a specific procedure. Also, upcoming whistleblower rules include some specifications for an investigation, but at the time of publication these are not yet final (we refer to is in more detail below). The information below is only valid for workplace investigations in the private sector. The public sector has a set of specific rules and principles, which are outside the scope of this chapter.

There is no specific law governing workplace investigations in Brazil, but Law 14.457/2022 states that companies must have rules that relate to sexual and other forms of harassment in their internal policies, address the rules for receiving and processing accusations, assess the facts, and discipline any individuals directly and indirectly involved in acts of sexual harassment or violence.

If the investigation has any connection with anticorruption matters, the investigation procedure must comply with Law 12846/2013 (Brazilian Anticorruption Act) and Decree 8420/2015.

As a result, Brazilian employers usually follow the rules determined by internal corporate policies, which often result from international regulations and principles that differ from the Brazilian ones, which inadvertently expose the Brazilian subsidiary to liability. The answers below will highlight common examples of this, when appropriate.

Currently there are no unified laws, administrative regulations or policies in the field of labor laws in People's Republic of China (referred to as “PRC”) regarding investigations on workplaces of ordinary employers. The laws and regulations of employers in certain specific industries (such as banking, securities, insurance, medical institutions, etc.) and the laws and regulations governing certain personnel (such as officers of state-owned enterprises and members of the Communist Party of China) contain provisions relating to investigations on employees' conduct, but such provisions are only applicable to the aforementioned specific industries or personnel.

Employers generally will specify their investigation rights and rules and procedures of internal investigations in their internal rules and regulations (such as the employee handbook) or the employment contracts entered into with their employees. However, it should be noted that workplace investigations are still subject to laws and regulations in relation to personal information, privacy and data protection.

Mainly, the Occupational Safety and Health Act (738/2002). In addition, the following also have relevance in connection to a workplace investigation: the Employment Contracts Act (55/2001), the Criminal Code (39/1889), the Act on Occupational Safety and Health Enforcement and Cooperation on Occupational Safety and Health at Workplaces (44/2006), the Act on Equality between Women and Men (609/1986) and the Non-discrimination Act (1325/2014). In addition, the employer's own policies must be taken into consideration while conducting a workplace investigation.

No specific rules directly govern a workplace investigation in the event of employee misconduct. However, several rules, both legal and administrative, affect the conduct of such an investigation. In addition, codes of conduct, internal regulations or guidelines may also exist within companies.

A new law (No. 2022-401) came into effect on 1 September 2022 and constitutes one of the cornerstones for future regulation of workplace investigations. This law transposes into French law the European directive relating to whistleblower protection. It does not, however, constitute a revolution, as a previous French law dated 9 December 2016 (the so-called Sapin 2 Law) already provided the whistleblower with a specific status and protection. These laws are fundamental when considering an internal investigation as the rules protecting the whistleblower and requiring the establishment of an internal whistleblowing channel (eg, a dedicated email or hotline) affect the degree of flexibility available to companies in conducting the investigation.

A new decree has been adopted (No. 2022-1284), dated 3 October 2022, for application of these new provisions. This decree sets out several obligations relating to the internal whistleblowing reporting process. The reporting channel will necessarily contribute to shape the internal investigation triggered by situations which have been reported by that channel. Companies subject to this decree may define the reporting procedure using the supporting tool of their choice (company collective agreement, internal memorandum, etc.), as long as the employee representative bodies are duly consulted on the matter. The decree also specifies that an acknowledgement of receipt of the alert must be provided to the author of the alert in writing within seven days from the company receiving the alert. The author of the alert must also be informed in writing, within a reasonable period not exceeding three months from acknowledgement of receipt of the alert, of the measures envisaged or taken to assess the accuracy of the allegations and, where appropriate, to remedy the situation which had been reported, as well as the reasons for these measures and, finally, the closure of the case.

More generally, not only do all the “pure” labour law rules relating to the protection of the human rights of employees need to be complied with (right to privacy, data protection under the GDPR, etc), but also the disciplinary rules and regulations that protect employees from unfounded sanctions imposed by their employer. For example, an employer can only sanction an employee's misconduct if the disciplinary procedure begins within two months of when the misconduct was committed or when the employer becomes aware of it. In this respect, an internal investigation can be necessary for the employer to obtain full knowledge of the facts alleged to have been committed by the employee. It is nonetheless recommended that the internal investigation be completed within these two months to avoid the risk of the disciplinary action being time-barred.

Administrative rules produced by the French anti-corruption agency should also be taken into consideration (good practice, guidelines and recommendations relating to senior management’s commitment to implement anti-corruption measures, corruption risk mapping, corruption risk management measures and procedures), as well as the guidelines produced by the French Ministry of Employment relating to the prevention of sexual harassment and gender-based violence or the recommendations of the Human Rights Defender, which is a French special institution aimed at protecting fundamental rights.

When the investigation in question concerns moral or sexual harassment or violence in the workplace, the national interprofessional agreement of 26 March 2010 should be <referred to. This text stipulates that in the event of an investigation procedure, it should be based on, but not limited to, the following guiding principles:

• it is in everyone's interest to act with the discretion necessary to protect everyone's dignity and privacy;
• no information, unless it is anonymized, should be divulged to parties not involved in the case in question;
• complaints must be investigated and dealt with without delay;
• all parties involved must be listened to impartially and treated fairly;
• complaints must be supported by detailed information;
• deliberate false accusations must not be tolerated, and may result in disciplinary action;
• external assistance may be useful, notably from occupational health services.

Many are calling for the adoption of legislative rules governing such investigations, and their coordination with general whistleblower protection measures.

Finally, a company must take its own rules and regulations into account. Every company with at least 50 employees has the legal obligation to draw up internal rules and regulations, which notably set out the disciplinary sanctions applicable to employees, as well as a reminder of certain employees' rights.

There are no specific legislative requirements for workplace investigations in Germany. In 2020, the Federal Ministry of Justice presented a draft bill with regulations on internal investigations and, in particular, employee interviews. However, this law failed to pass under the previous government. The current government has announced it will take up this matter again and plans to create a precise legal framework for internal investigations. Details, timing and content remain to be seen.

Nevertheless, workplace investigations do not take place in a "lawless space". They must comply with the provisions of employment and data protection law. Further, criminal and corporate law aspects can play a role. Moreover, works council information and co-determination rights may have to be taken into account.

In Greece, workplace investigations are not heavily regulated.

However, internal disciplinary procedures are governed by certain general principles, while there is also legislation regulating certain aspects of investigations opened in the context of whistleblowing procedures or concerning complaints for workplace violence or harassment. These include Law 4990/2022, which transposed EU Directive 2019/1937 into Greek Law; and Law 4808/2021, which ratified the ILO’s Violence and Harassment Convention, 2019 (No190) and introduced relevant provisions.

As far as disciplinary procedures in private-sector companies are concerned, employers that must have internal labour regulations in place (ie, those with more than 70 employees) or opt to adopt them voluntarily, can regulate the procedures themselves.  

In the public sector, internal investigations are governed by disciplinary provisions included in the civil servant code.

The Employment Ordinance (EO), which is the primary legislation governing employment relationships in Hong Kong, does not provide for a statutory workplace investigation procedure.

The Labour Department of Hong Kong has, however, published a Guide to Good People Management Practices[1] which recommends that employers lay down rules of conduct, grievance and disciplinary procedures. Such rules should be simple and clear, logical and fair, and in line with the provisions in the EO.

As part of risk management and internal controls, Hong Kong-listed companies are expected by The Stock Exchange of Hong Kong Limited (SEHK) to establish whistleblowing policies and systems for employees to raise concerns about possible improprieties with independent board members. Listed companies are also expected to establish policies for the promotion and support of anti-corruption laws and regulations. Such policies and systems may include workplace investigation procedures.[2] If a listed company chooses to not establish such policies and systems, it is required to explain how it could achieve appropriate and effective risk management and internal controls.

There is no codified law in India on conducting workplace investigations, so they largely depend on the internal policies of the employer. Certain requirements and best practice measures have evolved through judicial precedent, and these are codified through internal policies.

For claims involving sexual harassment, however, investigations can only be undertaken by the Internal Committee (IC), which an employer needs to constitute under the Prevention of Sexual Harassment of Women and Workplace (Prevention, Prohibition and Redressal) Act 2013 (SH Act).  

The general principle laid down by the courts is that any action against an employee for misconduct should be taken after conducting a disciplinary inquiry as per the principles of natural justice (PNJ). Whether or not a disciplinary inquiry can be done away with in any circumstances is a very fact-specific assessment and depends on various factors, including but not limited to the seniority and location of employment of the employee, and the nature and circumstances of the alleged misconduct.

The PNJ broadly require:

• that the accused employee should be issued with a written charge sheet or notice setting out the allegations against him or her along with a reasonable opportunity to respond;
• appointment of an independent inquiry officer to assess whether the allegations are proven or not; and
• that action must be taken based on the outcome of the inquiry, any punishment ordered should be proportionate to the gravity of the misconduct, and also take into account the service history (eg, prior warnings) of the individual.

The charge sheet or notice issued to the employee has to set out the evidence used by the employer to support the allegations in sufficient detail. Therefore, gathering necessary information and evidence is usually a critical precursor for any disciplinary process that an employer may eventually initiate against an employee.

In Ireland, employees have a constitutional right and an implied contractual right to natural justice and fair procedures. If a workplace investigation is not conducted in accordance with these principles, an employee may allege that the investigation is fundamentally flawed. If such an allegation is made then an employee may seek recourse from the Workplace Relations Commission (WRC) or potentially the High Court. The WRC is the body in Ireland tasked with dealing with employment law-related claims, including unfair dismissal.

The constitutional rights that employees enjoy were specified in the Supreme Court case of Re Haughey in 1971. That case held that where proceedings may harm the reputation of a person, public bodies must afford certain basic protections of constitutional justice to a witness appearing before it. It further stated that article 40.3 of the Irish Constitution is a guarantee to the citizen of basic fairness of procedures. These protections, known as “Re Haughey rights” are implied in each contract of employment.

A Code of Practice was introduced in 2000, namely S.I. No. 146/2000 - Industrial Relations Act, 1990 (Code of Practice on Grievance and Disciplinary Procedures) (Declaration) Order, 2000 (the Code). The Code set out the procedures for dealing with grievances or disciplinary matters, which must comply with the general principles of natural justice and fair procedures and include:

• that employee grievances are fairly examined and processed;
• that details of any allegations or complaints are put to the employee concerned;
• that the employee concerned is allowed to respond fully to any such allegations or complaints;
• that the employee concerned is given the opportunity to avail of the right to be represented during the procedure; and
• that the employee concerned has the right to a fair and impartial determination of the issues concerned, taking into account any representations made by, or on behalf of, the employee and any other relevant or appropriate evidence, factors or circumstances.

Further Codes of Practice on the prevention and resolution of bullying at work and on dealing with sexual harassment and harassment at work were published in 2021 and 2022, respectively. The provisions of these codes are admissible in evidence before a court, the WRC and the Labour Court.

In addition to the above, the Data Protection Commission published Data Protection in the Workplace: Employer Guidance in April 2023.

All employers should have specific and up-to-date policies dealing with how workplace investigations will be carried out that are suitable for their organisation. These policies may vary, depending on the subject of the investigation and the size and type of employer. However, all should adhere to the principles identified above to ensure that a robust policy is in place and can be utilised.

From an Italian employment law perspective, there is no specific body of legislation that governs investigations. However, several legal and case-law principles may be relevant concerning various specific aspects of investigations, and to which reference will be made below (eg, provisions under Law No. 300 of 1970, the so-called Workers’ Statute regarding “controls on employees”, both physical and “remote”, or regarding “disciplinary proceedings”).

In addition, and outside of the specific scope of employment law, other law provisions may have an impact on investigations, including those regarding privacy law (eg, Italian Legislative Decree No. 196 of 2003 and the Regulation (EU) No. 679 of 2016 (GDPR), regarding data protection and the related policies), whistleblowing (Law No. 179 of 2017 and Directive (EU) No. 1937 of 2019, regarding whistleblower protection) and criminal law (eg, Italian Criminal Procedure Code, providing rules for criminal investigation and Italian Legislative Decree No. 231 of 2001, regarding the corporate (criminal) liability of legal entities).

There is no specific legislation, guidance or policies covering investigations in the workplace. Issues such as the Personal Data Protection Law, invasion of privacy, and infringement of freedoms may arise regarding the related parties, subjects, methods, and results of investigations. In addition, court decisions have stated that "when there has been a violation of corporate order, an investigation of the facts may be conducted to clarify the nature of the violation, issue business instructions or orders necessary to restore the disturbed order or take disciplinary action against the violator as a sanction”. The investigation or order must be reasonable and necessary for the smooth operation of the enterprise, and the method and manner of the investigation or order must not be excessive or restrain an employee's personality or freedom. In such a case, the investigation may be considered to be illegal and may constitute a tort.

Dutch employment law does not provide for a timeframe within which an internal investigation must be launched. However, it is important for an employer who suspects abuse or irregularities, to start an internal investigation without delay. In essence, that means that as soon as management, or – depending on the specific circumstances – the person who is authorised to decide on disciplinary sanctions against a certain employee, becomes aware of a potential abuse or irregularity, all measures to initiate an internal investigation should be taken promptly. If this is not done, the employer may lose the opportunity to take certain disciplinary actions.

The legal framework relating to an investigation by an employer into the acts and omissions of an employee are determined by, among other things, section 7:611 of the Dutch Civil Code (DCC) that stipulates good employer practices; Section 7:660 DCC (right to give instructions to the employee); the European Convention on Human Rights; the Dutch Constitution; the General Data Processing Regulation; and, if the employer uses a private investigation agency, the Private Security Organisations and Detective Agencies Act and the Privacy Code of Conduct for Private Investigation Agencies.

The legal basis from which the employer derives the authority to investigate can be based on the employer's right to give instructions (section 7:660 DCC). Pursuant to this section, the employer has – to a certain extent – the right to give instructions to the employee “which are intended to promote good order in the undertaking of the employer”. In many cases, an investigation of a work-related incident will aim to promote good order within the company. As such, the investigation is trying to:

• find the truth;
• sanction the perpetrator; and
• prevent repetition.

Instructing an employee to cooperate with an internal investigation falls within the scope of the right to instruct.

Subsequently, the employer must behave as a good employer during the investigation, pursuant to section 7:611 DCC. This is coloured by the classic principles of careful investigation: the principle of justification, the principle of trust, the principle of proportionality, the principle of subsidiarity and the principle of equality. Furthermore, the principle of hearing both sides of the argument applies and there must be a concrete suspicion of wrongdoing.

• The Constitution of the Federal Republic of Nigeria, 1999 (as amended)
• The Criminal Code Act
• Penal Code Law
• Money Laundering (Prohibition) Act 2011 (as amended)
• Freedom of Information Act 2011
• Terrorism (Prevention) Act 2013
• Independent Corrupt Practices and other related offences Act 2000
• Code of Conduct Bureau and Tribunal Act
• Companies and Allied Matters Act 2020
• Nigerian Code of Corporate Governance 2018
• Economic Financial Crime Commission (Establishment) Act 2004
• Investment Securities Act 2007
• Central Bank of Nigeria Act 2007
• Banks and Other Financial Institutions Act 2020
• Whistleblowing Programme under the Ministry of Finance

There are essentially two phases in a workplace investigation: the fact-finding phase and the administrative proceeding.

The fact-finding phase of workplace investigations is usually governed by the internal policies of the employer, save for investigations relating to gender-based sexual harassment in the workplace. Republic Act No. 11313, otherwise known as the Safe Spaces Act, sets the parameters for these kinds of investigations.

Philippine case law recognises the right of an employer to conduct investigations for other acts of misconduct in the workplace in the exercise of its management prerogative. The Supreme Court has held that it is an employer’s right to investigate acts of wrongdoing by employees, and employees involved in such investigations cannot simply claim that employers are out to get them.

After the fact-finding aspect of the investigation, if the employer decides it has sufficient grounds to proceed to full-blown administrative proceedings, it needs to comply with the due process requirements outlined under the Philippine Labor Code. These requirements are:

• a first notice, or notice to explain, informing the employee of the charges against him or her;
• an opportunity for the employee to be heard; and
• a final notice on the outcome of the administrative action.

There is no legislation on this area in Poland. However, employers implement internal policies that provide for workplace investigation rules to fulfil certain legal obligations, including those arising directly from labour law.

Based on the currently binding provisions of labour law, an employer must counteract unwanted behaviour in the workplace (eg, bullying, discrimination and unequal treatment). To fulfil this obligation, employers implement internal policies that provide a framework for reporting misconduct and conducting internal investigations. They may freely design the rules of such investigations, within the constraints of their policy. Therefore, it is recommended they create the policy based on the following:
 

• it should be possible to effectively report the misconduct;
• there should be more than one way to report misconduct;
• anonymous reporting should be allowed;
• an investigation committee should be appointed and be objective;
• rules on excluding persons with a conflict of interest from conducting the investigation should be provided; and
• the report from the investigation should be prepared and signed by all persons participating in the process.

However, work on a bill on whistleblower protections is in progress (the Draft Law). The Draft Law will not determine the rules of workplace investigations but it will force employers to implement a whistleblowing procedure and follow-up on recommendations in the case of a report, including initiating an internal investigation where appropriate. Whether an internal investigation is initiated depends on the assessment of a reported irregularity by the employer.

In addition, employers (especially those that are part of an international group) often already implement internal policies on whistleblowing management and internal investigations. Employers often base their policies on guidelines issued by relevant (usually international) organisations.

Pursuant to article 98 of the Portuguese Labour Code, the employer has a disciplinary power over its employees during the employment period. This is enforced through the initiation of disciplinary procedures – which can include a preliminary workplace investigation as provided for in article 352(1) of the Portuguese Labour Code – and ultimately the application of sanctions laid down by law or in an applicable collective bargaining agreement.

The Portuguese Labour Code governs disciplinary procedures, which can include a preliminary workplace investigation, in two different sections. On the one hand, articles 328 to 332 establish general rules regarding the imposition of disciplinary sanctions; statutory deadlines and statutes of limitations involved; decision criteria; penalties; and disciplinary records. On the other hand, articles 351 to 358 lay down the rules applicable to dismissals with cause, which are also widely understood to be applicable concerning conservatory sanctions (i.e. those that enable the continuity of the employment relationship).

Additionally, collective bargaining agreements may provide for different disciplinary penalties, as long as the rights and guarantees of employees are not impaired.

Workplace investigations must also abide by the general rules laid down in the Portuguese Constitution, Portuguese Civil Code and Data Protection Laws (including guidelines issued by the Data Protection Agency), as regards the personal rights of the employees.

A workplace investigation is usually governed by the employer’s internal grievance policy or contractual guidelines found in the employment contract or employee handbook. In the absence of the same, the default governing regime is as set out by the Ministry of Manpower (MOM) and the Tripartite Alliance for Fair and Progressive Employment Practices (TAFEP) in its guidelines and advisories, which include:

• the Tripartite Advisory on Managing Workplace Harassment;
• the TAFEP Grievance Handling Handbook; and
• the Tripartite Guidelines on Fair Employment Practices.

In addition, section 14(1) of the Employment Act 1968 provides that an employer is required to conduct “due inquiry” before dismissing an employee covered under the Employment Act 1968 without notice for misconduct. The Singapore Courts take the view that “due inquiry” suggests some sort of process in which the employee concerned is informed about the allegations and the evidence against him or her so that he or she has an opportunity to defend him or herself with or without evidence during the investigation process.

Further, there are numerous cases where the Singapore High Court has alluded to or implicitly accepted the application of the implied term of mutual trust and confidence in employment contracts that would oblige the employer to act reasonably and fairly during the investigation, even though it is worth noting that the Singapore Court of Appeal has stated that the status of the implied term of mutual trust and confidence has not been settled in Singapore and that the Appellate Division of the Singapore High Court has stated that “[i]t remains an open question for the Court of Appeal to resolve in a more appropriate case, ideally with facts capable of bearing out a claim based directly on the existence of the implied term” (see [81]-[82] of Dong Wei v Shell Eastern Trading (Pte) Ltd and another [2022] SGHC(A) 8).

Hence, any references to the application of the implied term of mutual trust and confidence in Singapore in this article must be read in light of the above.

The current position is expected to change in the second half of 2024, with the passing of Singapore’s first workplace fairness law, the Workplace Fairness Legislation. On 4 August 2023, the Singapore government announced that it has accepted the final set of recommendations by the Tripartite Committee on Workplace Fairness in respect of the upcoming Workplace Fairness Legislation. The Tripartite Committee on Workplace Fairness recommended, among other things, that employers are required to put grievance-handling processes in place. It is therefore expected that the Workplace Fairness Legislation may contain requirements on how and when a workplace investigation should be conducted.

This article sets out the current position, before the Workplace Fairness Legislation was enacted, and will be updated when appropriate.

While there are no specific laws that regulate a workplace investigation, there are several laws that companies should consider when conducting a workplace investigation concerning alleged employee misconduct.

One key example is the Whistleblower Protection Act (WPA). The WPA provides legal protection to a whistleblower if their allegations are raised in good faith and are in the public interest as specified under the WPA. If the WPA applies, certain obligations apply to the company, including but not limited to the following:

• the obligation to protect the confidentiality of the whistleblower’s identity;
• protecting the whistleblower if the whistleblower suffers or is likely to suffer serious harm to life or health as a result of whistleblowing and the whistleblower requests protection; and
• refraining from taking retaliatory action on the whistleblower.

Therefore, if an employee raises allegations of another employee’s misconduct, the company should review whether the allegations fall under the WPA.

There are also special laws that impose obligations on the company if there are certain types of allegations (eg, sexual harassment, workplace harassment).

In addition, when collecting and reviewing employees’ electronic data, such as emails or files stored in work laptops or company servers, which may contain personal information, the company should comply with data privacy laws discussed in more detail in questions 7 and 8.

Companies may also have internal policies (eg, whistleblower protection policies, Code of Conduct) that may apply to workplace investigations, aside from the requirements under Korean law.

Spain has not passed any statutes, regulations or policies specifically governing workplace investigations. Instead, general employment and data protection legislation, which safeguards employees’ rights, is fully applicable during these types of enquiries.

These statutes focus on employee privacy. As a result, the application of this legislation:

• limits the matters that may be investigated: they have to be relevant to the employment relationship and there has to be a legitimate reason to conduct the enquiry;
• sets boundaries to the means that may be lawfully used by the company in the investigation: they must be the least intrusive means for employees’ rights (for instance, an email review should be a last resort, reserved for when less-invasive means are not available or would not be effective); and
• states that the companies’ decisions during the investigation must be proportional in light of the facts under review and the legal consequences attached to them.

Collective bargaining agreements, which in Spain generally apply to every company within their scope of application (normally a given economic sector), may regulate workplace investigations. However, it is unusual for collective bargaining agreements to regulate workplace investigations.

Finally, major international corporations with a presence in Spain do tend to have an ethics or whistleblowing policy that governs how an investigation should be conducted. Even if these are self-imposed policies, they are contractually binding and, once established, must be respected by companies.

Workplace investigations in Sweden are governed by several rules and regulations. Listed below are the central legislation and regulations that govern a workplace investigation related to alleged employee misconduct.

• The Swedish Discrimination Act (2008:567).
• The Swedish Work Environment Act (1977:1160), which is complemented by the Swedish Work Environment Authority’s other statutes.[1]
• The Swedish Whistleblowing Act (2021:890).

If a workplace investigation has been initiated after the receipt of a report filed through a reporting channel established under the Swedish Whistleblowing Act, that law applies provided that the report has been filed by a person who may report under the Act and provided that the subject of the report falls under the material scope of the Act. The Swedish Whistleblowing Act implements Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law and has been given a wide material scope in Sweden. The Swedish Whistleblowing Act may apply if the reported irregularity concerns breaches of certain EU laws or if the reported irregularity is of public interest.

In addition to the regulations mentioned above, certain data protection legislation may affect workplace investigations by restricting what personal data may be processed. Such data protection legislation includes the following:

• Regulation (EU) 2016/679 on the protection of natural persons concerning the processing of personal data and the free movement of such data (the GDPR);
• the Swedish Supplementary Data Protection Act (2018:218);
• the Swedish Supplementary Data Protection Regulation (2018:219);

• Regulation DIFS:2018:2 on the processing of personal data relating to criminal convictions or offences. This regulation governs the processing of personal data relating to criminal convictions or suspected criminal offences in internal workplace investigations that are not governed by the Swedish Whistleblowing Act.[2]

The above-mentioned legislation and regulations may overlap in many aspects and it is therefore important before starting an investigation, as well as during an investigation, to assess which rules and regulations apply to the situation at hand. Another aspect of this is that many issues that can arise during an investigation are not regulated by law or other legislation. If the investigation is a non-whistleblowing investigation there are limited rules on exactly how and by whom the investigation should be carried out.

A Swedish law firm that undertakes a workplace investigation also has to adhere to the Swedish Bar Association’s Code of Conduct. The Code of Conduct includes additional considerations, mainly ethical, which will not be addressed in this submission. Furthermore, this submission will not focus on investigations following an employee’s possible misappropriation of proprietary information or breach of the Swedish Trade Secrets Act (2018:558). Investigations into such irregularities are often conducted to gather evidence and these investigations include the same or similar investigative measures used in other investigations, such as interviews with employees and IT-forensic searches, but also infringement investigations carried out by the authorities or other measures by the police.

There is no specific legal regulation for internal investigations in Switzerland. The legal framework is derived from general rules such as the employer's duty of care, the employee's duty of loyalty and the employee's data protection rights. Depending on the context of the investigation, additional legal provisions may apply; for instance, additional provisions of the Swiss Federal Act on Data Protection or the Swiss Criminal Code.

The Labour Protection Act B.E. 2541 (1998) (LPA) is the key legislation governing the relationship between employer and employee in Thailand. The LPA set out a minimum standard for the protection of employees’ rights, as well as a mechanism for suspension from work for an investigation.

The LPA requires any employer having ten or more employees to prepare work rules in the Thai language and the work rules require an employer to prescribe a procedure for the submission of grievances that would normally include the process for investigations in the workplace. Therefore, the work rules are the main guidance and policy that govern a workplace investigation. In some cases, an employer may have a whistleblowing policy allowing whistle-blowers to submit complaints of illegal or improper activities to the employer. The whistleblowing policy will also prescribe the procedures for investigating in workplace reflecting the complaints submitted by whistle-blowers.

There is no specific legislation governing workplace investigations in Turkish law. However, there are general principles stemming from Labour Law No. 4857 as well as good practice principles. Data protection laws also occasionally intertwine with these. The internal codes and policies of the company should also be followed throughout the process.

In the UK, the primary employment legislation of relevance to a workplace investigation includes the Employment Rights Act 1996 (ERA 1996), the Equality Act 2010 (EA 2010), and the Employment Relations Act 1999 (ERA 1999).

Other legislation includes the retained EU law version of the General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), the Investigatory Powers Act 2016 (IPA 2016) and the Investigatory Powers (Interception by Businesses etc for Monitoring and Record-keeping Purposes) Regulations 2018 (IP Regs 2018), and the Humans Rights Act 1998 (HRA 1998).

In terms of guidance, the Advisory, Conciliation and Arbitration Service (ACAS) have produced a Code of Practice on Disciplinary and Grievance Procedures (the ACAS Code) as well as a Guide to conducting workplace investigations. The Information Commissioner’s Office (ICO) have their Employment Practices Code,  and other pieces of guidance on the data protection aspects of investigations (see question 7).

Most employers will have internal policies governing how workplace investigations should be conducted. The level of detail may vary considerably; public sector and regulated employers may be more prescriptive in their policies, which may even have contractual force. There may also be provisions of the employment contract that are relevant (particularly as regards suspension – see question 3).

In the United States, any combination of legislation at the federal, state and local level, as well as judicial opinions and regulatory guidance interpreting those statutes, may impose obligations on relevant employers to undertake a timely internal investigation in response to complaints of workplace misconduct and to promptly implement remedial measures, where appropriate.

An employer’s written policies often also set forth the company’s expectations for how its employees, partners, vendors, consultants or other third parties will conduct themselves in carrying out the business of the company, and these policies may include protocols setting forth the parameters for an investigation in the event of potential non-compliance. Such investigatory roadmaps are often described in, for example, employee handbooks or a company’s policy against discrimination and harassment.

Due to the patchwork nature of employment and related laws, it is not possible to cover every investigation scenario or related legislation in this guide. Employers should instead consult with experienced employment attorneys in their state to ensure compliance with the applicable legal and regulatory regimes. 

There are no specific legislative requirements for workplace investigations in Vietnam. However, Labor Code No. 45/2019/QH14 dated 20 November 2019 (2019 Labor Code), which is currently the primary legislation governing employment relationships, requires employers that have more than ten employees to provide a mechanism and procedure for handling sexual harassment cases in the workplace. Other than that, an employer may incorporate policies and guidelines on how to deal with workplace investigations into its handbook.

Non-disclosure agreements, also known as confidentiality agreements, can be used to maintain the confidentiality of the investigation. In this agreement, the employee will be directed to maintain confidentiality concerning the investigation and matters that are the subject of the investigation, and not speak to anyone outside the investigation team about the investigation without authorisation.

Confidentiality agreements are legal documents. Employees should be informed that a breach of the confidentiality agreement could result in disciplinary action being taken against them, up to and including termination of their employment.  

According to section 6(1) of the DSG, employees who have access to personal data in the course of their professional activities must maintain data confidentiality and continue to do so even after termination of their employment.

Non-disclosure agreements can generally be used to achieve this but are subject to certain restrictions. They may not be used to conceal criminal activity, violate the privacy rights of individuals, circumvent legal disclosure obligations, prevent the exercise of legal rights or contain clauses that violate existing laws, in particular data protection regulations.

In principle this is possible. However, these NDAs do have their limits and cannot prevent involved persons from, for example, bringing a legal claim or filing a report if they are legally entitled to do so. Under whistleblower rules, a reporter can even publish his or her complaint under certain circumstances.

Yes, NDAs may be executed to reinforce the confidentiality obligations outlined in the company's policies and reinforced in interviews.

Yes. In practice, before conducting a compliance investigation, we recommend that the employer and the investigator enter into a confidentiality agreement to require the investigator to keep confidential the facts and the substance of the investigation. This will not only better protect the personal information of the complainant, the witness and the investigated employee, but also help the investigation to proceed smoothly.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

Most of the time, the legal protection afforded by the legally prescribed confidentiality obligation that applies to whistleblowing is sufficient. This is all the more so given every person involved is bound by an obligation of discretion. However, there is no legal obstacle to the creation of an NDA between the employer and the people involved.

NDAs setting out a strict and reinforced obligation of confidentiality and discretion during the investigation should be signed by any external parties involved (eg, translation agency, IT expert) or when the internal investigation is outside the scope of whistleblowing regulations.

In principle, it is possible to conclude non-disclosure agreements with external consultants of the investigation or with employees involved in the investigation. However, regarding external lawyers, a non-disclosure agreement is not necessary since lawyers are already subject to professional confidentiality. Concerning employees, it is rare in Germany to conclude confidentiality agreements in connection with a workplace investigation.

NDAs are an option, especially to outline in detail the obligations of the persons conducting the investigation, which is also provided for in law. On the other hand, NDAs will not prevent persons involved from providing information to the competent authorities in the context of criminal or other similar procedures, where they must do so by law. Moreover, they may not protect confidentiality if persons who report breaches of Union law decide to make an external or public report, according to the provisions of L. 4990/2022.

In general terms, NDAs can be used and indeed are commonly used to keep the fact and substance of a workplace investigation confidential. However, NDAs will not be effective in preventing the disclosure of information which is in the public interest or is important for safeguarding public welfare in matters of health and safety. Further, several laws in Hong Kong provide that disclosures as a result of compliance with a requirement made by the relevant authorities will not be treated as a breach of any restriction imposed by contract or otherwise by law.[1]

Yes. While it is common for employees to be bound by general confidentiality obligations at the beginning of employment, it is advisable to reiterate such confidentiality obligations through NDAs during an investigation.

There is no legislation regarding NDAs, but there is a Bill before the legislature proposing to “restrict the use of non-disclosure agreements as they relate to incidents of workplace sexual harassment and discrimination”. It is currently at the report stage. Whether it passes remains to be seen, but there has in recent times been strong criticism of the use of NDAs to cover up matters that ought to be fully investigated and dealt with in an organisation.

Settlement agreements, however they arise, may include confidentiality clauses which may, depending on the terms of the agreement, extend to the fact and substance of an investigation, but as in the UK an employee's right to make a protected disclosure or report a criminal offence cannot be waived by signing an NDA.

Yes, in principle, NDAs can be used to keep the fact and substance of an investigation confidential, even if it is not strictly necessary (and not often done in our experience).

It is possible to use NDAs in investigations.

Yes, NDAs can be used for this purpose. However, employers in the Netherlands often rely on general confidentiality obligations that the relevant employee already has to adhere to vis-à-vis their employer, for example in the employment agreement or collective labour agreement, if applicable. It is good practice to reiterate the confidential nature of any interview and its contents, and the existence of the investigation as such, to avoid any alleged confusion as to the confidential nature of investigative procedures later on.

NDAs are usually part of an employee’s contract and, as such, create a contractual obligation between the parties privy to it. However, where the subject matter of an investigation borders on matters of a criminal nature, it might be impossible for parties to the NDA to continually uphold the obligation under the NDA because the parties have an obligation to the state to disclose facts of a criminal nature.

The practice of stipulating matters to ensure adherence to confidentiality is not uncommon. As such, NDAs are executed as a means of added protection for both the company and the employees involved.

Yes, but it may not stop the disclosure of information at the request of relevant law enforcement authorities.

Please see question 12 above. NDAs are not admissible.

Yes, NDAs can be used to keep the fact and substance of an investigation confidential. There are no express prohibitions against such NDAs under Singapore law. However, information or evidence covered by the NDA may still be discoverable in court or arbitration proceedings; and may also be subject to disclosure requests or directions by the police or statutory authorities, including the MOM.   

Some companies require an employee subject to investigation to sign an NDA or other similar documents (eg, a pledge of confidentiality) agreeing not to disclose information relating to the investigation to outside parties.

Yes. NDAs are the preferred instrument to ensure that employees conducting the investigation, as well as those who participate as witnesses or collaborators, will keep the enquiry and its existence confidential.

NDAs can be used for some investigations carried out in the private sector. However, under the Swedish Whistleblowing Act, a contract is void to the extent it retracts or restricts a person’s rights under the Swedish Whistleblowing Act. An NDA that restricts the right to report irregularities to authorities or the media would, therefore, typically be void.

In addition to the above-mentioned statutory confidentiality obligations, separate non-disclosure agreements can be signed. In an internal investigation, the employee should be expressly instructed to maintain confidentiality.

Non-disclosure agreements can be made between an employer and employees who are involved in an investigation. This may include investigators and witnesses, apart from the employee under investigation. This minimises the risk of information being leaked, which can affect all parties related to the workplace investigation. However, an NDA is not absolute means to prevent the disclosure of confidential information, as the court has the authority to compel disclosure.

It is crucial to keep the events and facts of a workplace investigation confidential for the integrity of the process. It may be necessary to consider appropriate confidentiality measures to protect the complainant, mitigate risks, and preserve evidence. Damage to the confidentiality of the case can prevent the investigation team from bringing the case to a correct and complete conclusion. Although the labour legislation imposes a general confidentiality obligation on employees, NDAs can still be used as supplementary documents that may emphasise the confidentiality obligations of employees in workplace investigations and provide additional contractual protections such as penalties if there is a breach.

Only to a limited extent. As a matter of law, NDAs cannot prevent a worker from making a protected disclosure, or reporting a crime to the police. As a matter of the regulatory obligations of solicitors, NDAs should not be used in other ways, including as a means of influencing the content of disclosures, or by using warranties, indemnities and clawback clauses in a way that is designed to, or has the effect of, improperly preventing or inhibiting permitted reporting or disclosures (see the SRA’s warning notice on the use of NDAs).

This is a fact-specific inquiry that depends on the specific circumstances and laws of the relevant state. In general, NDAs are frowned upon but can be used to an extent to keep certain facts and the substance of an investigation confidential. NDAs can never prevent employees from assisting in official agency investigations, however. NDAs also cannot lawfully prohibit employees from officially reporting illegal conduct by their employer.

Generally, NDAs can be used to keep the facts and substance of a workplace investigation confidential. There are no express prohibitions against such NDAs. However, there are cases set out under Decree No. 13/2023/ND-CP on personal data protection where personal data is allowed or required to be disclosed without the data subject’s consent, in instances that are necessary to serve the public interest or to protect the life and health of the data subject.