Workplace Investigations

A complaint will be a whistleblowing complaint where a complainant has reasonable grounds to suspect that the information they are disclosing about the organisation concerns misconduct or an improper state of affairs or circumstances. The information can be about the organisation or an officer or employee of the organisation engaging in conduct that:

• breaches the Corporations Act 2001 (Cth);
• breaches other financial sector laws;
• breaches any other law punishable by 12 months’ imprisonment; or
• represents a danger to the public or the financial system.

Since 2020, all public companies, large proprietary companies and trustees of registrable superannuation entities in Australia are required to have a whistleblower policy. Employers conducting an investigation will need to follow the processes outlined in their policy.

One of the key differences when conducting an investigation that involves whistleblowing is identity protection and the ability of the whistleblower to disclose anonymously and remain anonymous.

The provisions of the Whistleblowing Directive must be respected. In Austria, these have been implemented through the Whistleblower Protection Act (HSchG). If the whistleblower or the persons concerned fall within the scope of the Directive, their identity must be protected. Only authorised persons may access the report. Retaliatory measures are invalid or must be reversed. Within a maximum of seven days, the whistleblower must receive a confirmation of his or her complaint. Feedback to the whistleblower must then be provided within a maximum of three months.

If the investigation is based on a whistleblower report that falls under the scope of the upcoming rules, the investigators are bound by a strict duty of confidentiality, especially regarding the identity of the report. The rules also provide some procedural deadlines for feeding back to the reporter. Within seven days of receiving the report through an internal reporting channel, the reporting manager needs to send a receipt to the whistleblower. From that moment, the reporting manager has three months to investigate the report and give feedback and an adequate follow-up to the report. Next, the rules offer strong protection against any retaliatory measures the reporter may experience. Regardless, these rules are mostly intended to offer the necessary protection for whistleblowers and to ensure that companies take necessary investigative steps following a report, but they do not include much information about the actual procedure of the investigation besides certain deadlines, nor do they deal with other employees involved (or under investigation).

If the investigation involves matters within the scope of a specific whistleblowing policy, the policy rules should prevail against the general investigation rules if there is a conflict.

In practice, the following factors to be considered will be: (1) verification of the informant's identity; (2) whether the informant has any conflict of interest with the reported employee or whether it will affect the objectivity of their reporting; (3) how to persuade the informant to provide more information or evidence, or to cooperate in court as a witness; (4) how to increase the admissibility of evidence when the informant refuses to cooperate in court as a witness or fails to provide original evidence; (5) how to improve the evidence chain and protect the informant from being attacked or retaliated by the informant, etc.

In respect of data protection, the processing of personal data in whistleblowing systems is considered by the Finnish Data Protection Ombudsman (DPO) as requiring a data protection impact assessment (DPIA).

Evidence obtained in the context of an investigation must specify who provided it and the date it was provided. No retaliatory measures may be taken against the whistleblower for the act of whistleblowing.

In certain cases, the whistleblower report must be forwarded to the judicial authorities (eg, when there is an obligation to assist persons in imminent danger, for serious offences or a disclosure that a vulnerable person is in danger (ie, minors under 15 or a person who is unable to protect themselves)).

In 2023, Germany has implemented the EU Whistleblowing Directive into national law with the German Whistleblower Protection Act (HinSchG).

The German Whistleblower Protection Act provides that companies with at least 50 employees must establish internal reporting channels as further set out in the law. Among other things, the confidentiality of the whistleblower as well as of the individuals affected by the report must be protected.

Further, whistleblowers must be protected from negative consequences that may arise from their reports. If the employment of a whistleblower were terminated or if the whistleblower were to be denied promotion after reporting a violation, the employer would have to prove that this was not related to the whistleblowing but was based on justified reasons.

Employers should  familiarise themselves with the provisions of the new law.

L. 4990/2022 includes specific requirements regarding, among other things, the procedure of receiving and investigating respective reports, confidentiality issues (especially regarding the identity of the whistleblower), data protection issues (including restrictions to the right of access) and the employer’s right to keep a record of the relevant complaint and investigation. Such provisions are expected to be further detailed by Ministerial Decisions in future.

Hong Kong does not have a comprehensive legislative framework relating to whistleblowing. Therefore, in general, employers are free to establish whistleblowing policies and procedures and confer such protections on whistleblowers as they see fit. That said, companies listed on the Main Board of the SEHK are expected to establish a whistleblowing policy and system for employees to voice concerns anonymously about possible improprieties in the companies’ affairs. If a listed issuer deviates from this practice, it must explain the deviation.[1]

When an investigation involves whistleblowing, the employer needs to comply with the relevant policy and system and provide the whistleblower with such protections as stated in the policy. The employer should not ignore a complaint simply because it was made anonymously, and should ascertain the substance of the complaint to decide whether a full-blown investigation is warranted.

In addition, the employer should seek to establish a secure communication channel with the whistleblower to gather more information about the complaint or misconduct while maintaining the confidentiality of his or her identity. If the complaint is serious, the employer may consider referring the complaint to a law enforcement agency or regulator as they would be better placed in protecting the anonymity of the whistleblower while proceeding with the investigation. That said, employers generally have no obligation to report internal wrongdoing to any external body (please see question 25 for exceptions). The employer may assess whether it is appropriate to do so on a case-by-case basis.

Indian labour legislation does not stipulate any additional considerations or requirements concerning whistleblower complaints in private organisations and these are only available if there are complaints against public servants. Further, under the Companies Act, 2013, certain companies are required to establish a “vigil mechanism” for directors and employees to report genuine concerns regarding the affairs of the company. The vigil mechanism should provide adequate safeguards against the victimisation of persons using it.

Most whistleblowing policies will include a section that provides for an initial assessment of the complaint as to whether it meets the definition of a protected disclosure. This assessment, which ought to be carried out by a designated person who has been appointed to deal with disclosures, is a useful tool as some matters which may be labelled as whistleblowing may fall under the grievance procedure.

Where there are grounds, an investigation will be commenced. Under the Protected Disclosures (Amendment) Act 2022, whistleblowers are protected from penalisation for having made a protected disclosure, under the Act.

Penalisation may include; suspension, lay-off or dismissal; demotion, loss of opportunity for promotion or withholding of promotion; transfer of duties, change of location or place of work; reduction in wages or change in working hours; the imposition or administering of any discipline, reprimand or other penalty (including a financial penalty); coercion, intimidation, harassment or ostracism; or discrimination, disadvantage or unfair treatment.

If an employee (which includes trainees, volunteers, and job applicants) alleges that they have suffered penalisation as a result of making a protected disclosure, they may apply to the Circuit Court for interim relief within 21 days of the date of the last act of penalisation by the employer.

A claim for penalisation may also be brought before the WRC within six months of the alleged act of penalisation. If an employee alleges that they were dismissed for having made a protected disclosure, the potential award that the WRC can make increases from the usual unfair dismissal cap of two years’ pay to up to five years’ gross pay, based on actual loss.

Where a complaint of whistleblowing is made, employers should ensure that they appoint investigators with the appropriate knowledge and expertise to deal with such a matter and comply with the time limits set by legislation.

The regulations on whistleblowing in the private sector were originally outlined in article 6 of Italian Legislative Decree No. 231 of 2001 (as amended by Law No. 179 of 2017), which state that the models of organisation must provide for one or more channels that allow persons in positions of representation, administration and management of the entity (and persons subject to their direction or supervision) to report unlawful conduct according to Italian Legislative Decree No. 231 of 2001 and violations of the entity’s organisational and management rules.

Currently, Italy has implemented Directive (EU) No. 1937 of 2019, which provides for the adoption of new standards of protection for whistleblowers, through the Italian Legislative Decree No. 24 of 2023 (WB Decree)[1].

In line with the Directive, the WB Decree states, inter alia, that[2]:

• an internal whistleblowing reporting channel must be put in place by all private legal entities (and legal entities in the public sector) that have employed, during the previous year, an average of 50 employees or, even below this threshold, operate in certain industries[3] or have adopted an organizational model in accordance with Legislative Decree no. 231 of 2001;
• the WB Decree prescriptions apply to reports concerning breaches of certain national/EU[4] legal provisions (varying depending on features such as the private or public nature of the employer and its dimensions), and not to claims or requests linked to interests of a personal nature of the reporting individuals (pertaining to their individual employment contracts or to relations with their superiors)[5];
• whistleblowers’ reporting may take place through:
  • the company’s internal reporting channels and internal reporting procedures (with the possibility – for entities employing up to 249 employees, even if not part of the same group – to share whistleblowing reporting channels); or
  • external reporting channels and external reporting procedures established by the member states’ competent authorities (in Italy, ANAC, i.e. the National Anticorruption Authority); or
  • in certain circumstances, public disclosure;
• whistleblowing systems must provide:
  • a duty of confidentiality regarding the whistleblowers’ identity (which generally may not be disclosed to persons other than those competent to receive or investigate on the reports, except in specific case and with the whistleblower’s consent; see also answer to question 12 below); and
  • ways of protecting collected data according to the GDPR, as well as tight deadlines for communication with whistleblowers[6]; and
  • an integrated system of protection of whistleblowers against any retaliatory action directly or indirectly linked to their reports or declarations, with a reversal of the burden of proof (meaning the employer must give proof of the non-retaliatory nature of measures adopted vis-à-vis whistleblowers); and
  • the procedures to be taken in case of anonymous whistleblowing report.

See question 4 regarding amendments to the Whistleblower Protection Act.

The person designated as a whistleblower response service employee must not divulge the name, employee ID number, or other information that would allow a whistleblower to be identified without a justifiable reason, and there is a criminal penalty of up to 300,000 yen for violating this duty of confidentiality.

The former Act on the House for Whistleblowers already provided for several preconditions that a whistleblowing procedure must meet. For example, internal reporting lines must be laid down, as well as how the internal report is handled, and an obligation of confidentiality and the opportunity to consult an advisor in confidence must be applied. Employers are obliged to share the whistleblowing policy with employees, including information about the employee's legal protection. The employee who reports a suspicion of wrongdoing in good faith may not be disadvantaged in their legal position because of the report (section17e/ea Act House of Whistleblowers).

The starting point is that an employee must first report internally, unless this cannot reasonably be expected. If the employee does not report internally first, the House for Whistleblowers does not initiate an investigation. The House for Whistleblowers was established on 1 July 2016 and has two main tasks: advising employees on the steps to take and conducting an investigation in response to a report.

The Act on the Protection of Whistleblowers, which entered into force in 2023, introduced several changes, of which the most relevant are:

• Abolition of mandatory internal reporting: the obligation to report internally first is abolished. Direct external reporting is allowed, such as to the House for Whistleblowers or another competent authority. When reporting externally, the reporter retains his protection. However, reporting internally first remains preferable and will be encouraged by the employer as much as possible.
• Expansion of prohibition on detriment: the prohibition on detriment already included prejudicing the legal position of the reporter, such as suspension, dismissal, demotion, withholding of promotion, reduction of salary or change of work location. It now also includes all forms of disadvantage, such as being blacklisted, refusing to give a reference, bullying, intimidation and exclusion. 
• Stricter time limit requirements for internal reporting: the reporter must receive an acknowledgement of receipt of the report within seven days and the reporter must receive information from the employer on the assessment of their report within a reasonable period, not exceeding three months.

• Extension of the circle of protected persons: not just employees, but third parties who are in a working relationship with the employer are now also protected, such as freelancers, interns, volunteers, suppliers, shareholders, job applicants and involved family members and colleagues.

Consideration must be given to the confidentiality or anonymity of the whistleblower, when an investigation involves whistleblowing.

Since there is no specific law that governs whistleblowing, matters that involve whistleblowing will be governed by company policy.

In principle, an internal investigation should be conducted in the same way, regardless of whether it is initiated following a whistleblowing report, an audit, or a monitoring result. This includes anything related to confidentiality, fairness, data privacy protection, etc.

If an internal investigation is initiated following a whistleblower report, the main characteristic that is imposed by the EU Directive on the protection of persons who report breaches of EU Law (Whistleblowers Directive) and that will also be available under the Draft Law is for the organisation (employer) to communicate (if practicable) the report to the whistleblower. Furthermore, the whistleblower should receive feedback as to whether follow-up actions were undertaken following the report and, if yes – what actions were taken – and if not – why the follow-up actions were not taken.

The treatment of whistleblowers and their reports is laid down in various specific laws in Portugal.

Law 93/2021

Under Law 93/2021, a whistleblower of work-related offences must not be retaliated against. Furthermore, imposing disciplinary penalties on the whistleblower within two years after their disclosure is presumed to be abusive. The whistleblower is entitled to judicial protection and may benefit from the witness protection programme within criminal proceedings. Additionally, reports will be recorded for five years and, where applicable, personal data that is not relevant for the handling of a specific report will not be collected or, if accidentally collected, will be deleted immediately.

Corruption and Financial Crime Law (Law 19/2008)

Under Law 19/2008, a whistleblower must not be hampered. Furthermore, the imposition of disciplinary penalties on a whistleblower within one year following the communication of the infraction is presumed to be unfair.

Additionally, whistleblowers are entitled to:

• anonymity until the pressing of charges;
• be transferred following the pressing of charges; and
• benefit from the witness protection programme within criminal proceedings (remaining anonymous upon the verification of specific circumstances).

Money Laundering and Terrorism Financing Law (Law 83/2017)

Law 83/2017, which sets forth the legal framework to prevent, detect and effectively combat money laundering and terrorism financing, applies to financial entities and legal or natural persons acting in the exercise of their professional activities (eg, auditors and lawyers)(collectively, obliged entities).

According to article 20 of Law 83/2017, individuals who learn of any breach through their professional duties must report those breaches to the company's supervisory or management bodies. As a result, the obliged entities must refrain from threatening or taking hostile action against the whistleblower and, in particular, unfair treatment within the workplace. Specifically, the report cannot be used as grounds for disciplinary, civil or criminal action against the whistleblower (unless the communication is deliberately and clearly unjustified).

Legal Framework of Credit Institutions and Financial Companies (RGICSF)

Credit institutions must implement internal-reporting mechanisms that must guarantee the confidentiality of the information received and the protection of the personal data of the persons reporting the breaches and the persons charged. Under article 116-AA of RGICSF, persons who, while working in a credit institution, become aware of:

• any serious irregularities in the management, accounting procedures or internal control of the credit institution; or
• evidence of a breach of the duties set out in the RGICSF that may cause any financial imbalance, must communicate those circumstances to the company's supervisory body.

These communications cannot, per se, be used as grounds for disciplinary, criminal or civil liability actions brought by the credit institution against the whistleblower.

Moreover, article 116-AB of the RGICSF establishes that any person aware of compelling evidence of a breach of statutory duties may report it to the Bank of Portugal. Such communications cannot, per se, be used as grounds for disciplinary, criminal or civil liability actions brought by the credit institution against the whistleblower, unless the report is clearly unfounded.

The Bank of Portugal must ensure adequate protection of the person who has reported the breach and the person accused of breaching the applicable duties. It must also guarantee the confidentiality of the persons who have reported breaches at any given time.

Portuguese Securities Code (CVM)

Article 382 of the CVM states that financial intermediaries subject to the supervision of the Portuguese Securities Market Commission (CMVM), judicial authorities, police authorities, or respective employees must immediately inform the CMVM if they become aware of facts that qualify as crimes against the securities market or the market of other financial instruments, due to their performance, activity, or position.

Additionally, according to article 368-A of the CVM, any person aware of facts, evidence, or information regarding administrative offences under the CVM or its supplementary regulations may report them to the CMVM either anonymously or with the whistleblower's identity. The disclosure of the whistleblower's identity, as well as that of their employer, is optional. If the report identifies the whistleblower, their identity cannot be disclosed unless specifically authorised by the whistleblower, by an express provision of law or by the determination of a court.

Such communications may not be used as grounds for disciplinary, criminal, or civil liability action brought against the whistleblower, and they may not be used to demote the employee.

According to article 368-E of the CVM, the CMVM must cooperate with other authorities within the scope of administrative or judicial proceedings to protect employees against employer discrimination, retaliation or any other form of unfair treatment by the employer that may be linked to the communication to the CMVM. The whistleblower may be entitled to benefit from the witness-protection programme if an individual is charged in criminal or administrative proceedings because of their communication to the CMVM.

Under the Prevention of Corruption Act 1960 and the Corruption, Drug Trafficking and Other Serious Crimes (Confiscation of Benefits) Act 1992 (CDSCA), in any civil or criminal proceeding, no witness is obliged to disclose the name or address of any informer, or disclose any information that might lead to his or her discovery concerning offences such as corruption, drug trafficking, and money laundering, save where:

• in any proceeding for the offence, the Court, after a full inquiry into the case, is of the opinion that the informer wilfully made, in his complaint, a material statement that he knew or believed to be false or did not believe to be true; or
• in any other proceeding, the court is of the opinion that justice cannot be fully done between the parties without the discovery of the informer.

In line with the above, employers should therefore keep the informer’s identity confidential upon receiving a complaint relating to corruption, drug trafficking, money laundering, and other serious offences prescribed in the second schedule of the CDSCA.

Aside from the legal obligations imposed on the company when dealing with a whistleblower who is subject to the WPA as discussed in question 1, there are also practical considerations the company should keep in mind when dealing with a whistleblower, regardless of whether the whistleblower falls under the WPA.

For example, there have been instances where an employee who raised allegations filed a complaint with Korean authorities (such as the Anti-Corruption and Civil Rights Commission (ACRC) or the Labour Office) that the company took retaliatory action against the whistleblower. The company should carefully review the legal risks before taking action, such as personnel action or civil or criminal action, against an employee who raises allegations if that employee was also involved in the wrongdoing.

Directive (EU) 2019/1937 of the European Parliament and of the Council, of 23 October 2019, on the protection of persons who report breaches of Union law, has been implemented in Spain through Law 2/2023 (Ley 2/2023, de 20 de febrero, reguladora de la protección de las personas que informen sobre infracciones normativas y de lucha contra la corrupción). This law limits the capacity of companies to retaliate or to take any action against employees who report workplace violations or breaches of the law. Any action taken against an employee in such a position would be considered null and void if challenged in court.

Spanish law allows anonymous reports to protect whistleblowers from retaliation.

If the Swedish Whistleblowing Act governs the investigation, additional considerations apply relating to who may investigate a reported irregularity (see question 4) and the duty of confidentiality and restrictions on access to and disclosure of personal data in investigations (see questions 6, 10 and 11), as well as the rights and protections of whistleblowers.

As regards the rights and protections of whistleblowers, the following can be noted. A person reporting in a reporting channel governed by the Swedish Whistleblowing Act is protected against retaliation and restrictive measures. Thus, companies are prohibited from preventing or trying to prevent a person from reporting, and retaliating against a person who reports. Furthermore, a reporting person will not be held liable for breach of confidentiality for collecting the reported information if the person had reasonable grounds to believe that it was necessary to submit the report to expose irregularities. Under the Swedish Whistleblowing Act, any person reporting irregularities in a reporting channel established under the Swedish Whistleblowing Act may also report irregularities to designated Swedish authorities.

If an employee complains to his or her superiors about grievances or misconduct in the workplace and is subsequently dismissed, this may constitute an unlawful termination (article 336, Swiss Code of Obligations). However, the prerequisite for this is that the employee behaves in good faith, which is not the case if he or she is (partly) responsible for the grievance.

It is down to the employer’s discretion and subject to the whistleblowing policy (if any) to commence the investigation resulting from a complaint from a whistleblower. Whistleblowers and those who cooperate with an investigation should be protected. Normally the employer would not try to identify the whistleblowers. Also, it is best not to reveal the identity of the witness or the source of information; otherwise, they may feel uncomfortable giving information or raising their concerns next time. Any allegations of retaliation that surface during the investigation should be treated as a new report of possible misconduct that could be subject to additional investigation.

Although there is no specific legislation in Turkish law on whistleblowing, necessary mechanisms need to be implemented to ensure that whistleblowers and the whistleblowing process are kept confidential. In addition, whistleblowers must be encouraged and supported to be open about raising their concerns in good faith. A whistleblowing activity, when it amounts to raising a concern in good faith, must not be mistreated by the employer. Employers should also put in place protection mechanisms against the mistreatment of whistleblowers or retaliation towards them by other employees.   

The employer should first identify which individuals may have protection as whistleblowers. This could be a current or former employee who raises the initial complaint, a co-worker who gives evidence as part of the investigation, or the accused employee.

In each case, consider whether a “protected disclosure” has been made (under Part IVA ERA 1996). This requires analysis of the subject matter of the disclosure, how it is made, and a reasonable belief that it is made in the public interest.

Employers must then ensure there is no detrimental treatment or dismissal of any worker on the grounds of their protected disclosure. Although the causation test for these purposes is not straightforward, as a general rule if the protected disclosure has a “material influence” on the decision to discipline or dismiss, there may be liability. Individual managers may be personally liable alongside the employer. Compensation for whistleblowing cases is uncapped, meaning businesses and individuals can face significant financial and reputational exposure.

What this means in practical terms is that the employer should promote a “speak-up” culture and, where protected disclosures are made, ensure they are handled by a team who are properly trained in how to do so.

Several federal, state, and local employment laws prohibit retaliation against employees who come forward with complaints or participate in corporate investigations. Employees who possess information regarding corporate misconduct may also be considered whistleblowers protected from retaliation under federal and state whistleblower laws, including but not limited to the Sarbanes-Oxley Act of 2002, the Dodd-Frank Wall Street Reform and Consumer Protection Act, and the Consumer Financial Protection Act of 2010.

An employee generally does not need to show that he or she was terminated or demoted to bring a retaliation claim; other actions on the part of the employer may qualify if they could be seen to discourage employees from raising complaints. To protect against a potential retaliation claim, employers should make clear at the outset of an investigation that retaliation will not be tolerated and require the complaining employee (and potentially his or her manager) to bring any instances of retaliation to the investigator’s attention immediately.

It is up to the employer to determine whether or not to open an investigation after a complaint from a whistleblower. It is very important that the identity of the whistleblower is protected and that the employer also should not reveal the identity of the witness or the source of information, as the sources and witnesses may fear retaliation and feel uncomfortable or hesitant in giving information or raising concerns again.

Non-disclosure agreements, also known as confidentiality agreements, can be used to maintain the confidentiality of the investigation. In this agreement, the employee will be directed to maintain confidentiality concerning the investigation and matters that are the subject of the investigation, and not speak to anyone outside the investigation team about the investigation without authorisation.

Confidentiality agreements are legal documents. Employees should be informed that a breach of the confidentiality agreement could result in disciplinary action being taken against them, up to and including termination of their employment.  

According to section 6(1) of the DSG, employees who have access to personal data in the course of their professional activities must maintain data confidentiality and continue to do so even after termination of their employment.

Non-disclosure agreements can generally be used to achieve this but are subject to certain restrictions. They may not be used to conceal criminal activity, violate the privacy rights of individuals, circumvent legal disclosure obligations, prevent the exercise of legal rights or contain clauses that violate existing laws, in particular data protection regulations.

In principle this is possible. However, these NDAs do have their limits and cannot prevent involved persons from, for example, bringing a legal claim or filing a report if they are legally entitled to do so. Under whistleblower rules, a reporter can even publish his or her complaint under certain circumstances.

Yes, NDAs may be executed to reinforce the confidentiality obligations outlined in the company's policies and reinforced in interviews.

Yes. In practice, before conducting a compliance investigation, we recommend that the employer and the investigator enter into a confidentiality agreement to require the investigator to keep confidential the facts and the substance of the investigation. This will not only better protect the personal information of the complainant, the witness and the investigated employee, but also help the investigation to proceed smoothly.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

Most of the time, the legal protection afforded by the legally prescribed confidentiality obligation that applies to whistleblowing is sufficient. This is all the more so given every person involved is bound by an obligation of discretion. However, there is no legal obstacle to the creation of an NDA between the employer and the people involved.

NDAs setting out a strict and reinforced obligation of confidentiality and discretion during the investigation should be signed by any external parties involved (eg, translation agency, IT expert) or when the internal investigation is outside the scope of whistleblowing regulations.

In principle, it is possible to conclude non-disclosure agreements with external consultants of the investigation or with employees involved in the investigation. However, regarding external lawyers, a non-disclosure agreement is not necessary since lawyers are already subject to professional confidentiality. Concerning employees, it is rare in Germany to conclude confidentiality agreements in connection with a workplace investigation.

NDAs are an option, especially to outline in detail the obligations of the persons conducting the investigation, which is also provided for in law. On the other hand, NDAs will not prevent persons involved from providing information to the competent authorities in the context of criminal or other similar procedures, where they must do so by law. Moreover, they may not protect confidentiality if persons who report breaches of Union law decide to make an external or public report, according to the provisions of L. 4990/2022.

In general terms, NDAs can be used and indeed are commonly used to keep the fact and substance of a workplace investigation confidential. However, NDAs will not be effective in preventing the disclosure of information which is in the public interest or is important for safeguarding public welfare in matters of health and safety. Further, several laws in Hong Kong provide that disclosures as a result of compliance with a requirement made by the relevant authorities will not be treated as a breach of any restriction imposed by contract or otherwise by law.[1]

Yes. While it is common for employees to be bound by general confidentiality obligations at the beginning of employment, it is advisable to reiterate such confidentiality obligations through NDAs during an investigation.

There is no legislation regarding NDAs, but there is a Bill before the legislature proposing to “restrict the use of non-disclosure agreements as they relate to incidents of workplace sexual harassment and discrimination”. It is currently at the report stage. Whether it passes remains to be seen, but there has in recent times been strong criticism of the use of NDAs to cover up matters that ought to be fully investigated and dealt with in an organisation.

Settlement agreements, however they arise, may include confidentiality clauses which may, depending on the terms of the agreement, extend to the fact and substance of an investigation, but as in the UK an employee's right to make a protected disclosure or report a criminal offence cannot be waived by signing an NDA.

Yes, in principle, NDAs can be used to keep the fact and substance of an investigation confidential, even if it is not strictly necessary (and not often done in our experience).

It is possible to use NDAs in investigations.

Yes, NDAs can be used for this purpose. However, employers in the Netherlands often rely on general confidentiality obligations that the relevant employee already has to adhere to vis-à-vis their employer, for example in the employment agreement or collective labour agreement, if applicable. It is good practice to reiterate the confidential nature of any interview and its contents, and the existence of the investigation as such, to avoid any alleged confusion as to the confidential nature of investigative procedures later on.

NDAs are usually part of an employee’s contract and, as such, create a contractual obligation between the parties privy to it. However, where the subject matter of an investigation borders on matters of a criminal nature, it might be impossible for parties to the NDA to continually uphold the obligation under the NDA because the parties have an obligation to the state to disclose facts of a criminal nature.

The practice of stipulating matters to ensure adherence to confidentiality is not uncommon. As such, NDAs are executed as a means of added protection for both the company and the employees involved.

Yes, but it may not stop the disclosure of information at the request of relevant law enforcement authorities.

Please see question 12 above. NDAs are not admissible.

Yes, NDAs can be used to keep the fact and substance of an investigation confidential. There are no express prohibitions against such NDAs under Singapore law. However, information or evidence covered by the NDA may still be discoverable in court or arbitration proceedings; and may also be subject to disclosure requests or directions by the police or statutory authorities, including the MOM.   

Some companies require an employee subject to investigation to sign an NDA or other similar documents (eg, a pledge of confidentiality) agreeing not to disclose information relating to the investigation to outside parties.

Yes. NDAs are the preferred instrument to ensure that employees conducting the investigation, as well as those who participate as witnesses or collaborators, will keep the enquiry and its existence confidential.

NDAs can be used for some investigations carried out in the private sector. However, under the Swedish Whistleblowing Act, a contract is void to the extent it retracts or restricts a person’s rights under the Swedish Whistleblowing Act. An NDA that restricts the right to report irregularities to authorities or the media would, therefore, typically be void.

In addition to the above-mentioned statutory confidentiality obligations, separate non-disclosure agreements can be signed. In an internal investigation, the employee should be expressly instructed to maintain confidentiality.

Non-disclosure agreements can be made between an employer and employees who are involved in an investigation. This may include investigators and witnesses, apart from the employee under investigation. This minimises the risk of information being leaked, which can affect all parties related to the workplace investigation. However, an NDA is not absolute means to prevent the disclosure of confidential information, as the court has the authority to compel disclosure.

It is crucial to keep the events and facts of a workplace investigation confidential for the integrity of the process. It may be necessary to consider appropriate confidentiality measures to protect the complainant, mitigate risks, and preserve evidence. Damage to the confidentiality of the case can prevent the investigation team from bringing the case to a correct and complete conclusion. Although the labour legislation imposes a general confidentiality obligation on employees, NDAs can still be used as supplementary documents that may emphasise the confidentiality obligations of employees in workplace investigations and provide additional contractual protections such as penalties if there is a breach.

Only to a limited extent. As a matter of law, NDAs cannot prevent a worker from making a protected disclosure, or reporting a crime to the police. As a matter of the regulatory obligations of solicitors, NDAs should not be used in other ways, including as a means of influencing the content of disclosures, or by using warranties, indemnities and clawback clauses in a way that is designed to, or has the effect of, improperly preventing or inhibiting permitted reporting or disclosures (see the SRA’s warning notice on the use of NDAs).

This is a fact-specific inquiry that depends on the specific circumstances and laws of the relevant state. In general, NDAs are frowned upon but can be used to an extent to keep certain facts and the substance of an investigation confidential. NDAs can never prevent employees from assisting in official agency investigations, however. NDAs also cannot lawfully prohibit employees from officially reporting illegal conduct by their employer.

Generally, NDAs can be used to keep the facts and substance of a workplace investigation confidential. There are no express prohibitions against such NDAs. However, there are cases set out under Decree No. 13/2023/ND-CP on personal data protection where personal data is allowed or required to be disclosed without the data subject’s consent, in instances that are necessary to serve the public interest or to protect the life and health of the data subject.

Employers must take steps to deal with the findings of the investigation and implement any recommendations promptly. This may involve commencing disciplinary action.

The complainant and respondent need to be informed of the outcome of the investigation. All witnesses who participated in the investigation should also be thanked for their contribution and advised that the investigation has been completed. All participants in an investigation should be reminded of their ongoing obligations concerning confidentiality and victimisation.

If an employer decides that it may be appropriate to terminate a respondent’s employment, the employee must be provided with the opportunity to respond and to “show cause” as to why their employment should not be terminated.

The investigation report along with any other materials produced during the investigation should be kept in a separate confidential file.

Employers should also consider whether action should be taken at an organisational level to prevent future misconduct. In particular, employers are required to take a proactive approach to addressing systemic workplace cultural issues in relation to sex discrimination, sexual harassment and victimisation.

The employer may impose consequences under labour law. Consequences may include verbal or written warnings, transfers or other disciplinary measures. The employer may also implement training or educational measures if the issue is due to the employee's lack of knowledge. In serious cases, besides dismissal without notice – for example. if the employer seeks damages –legal action (civil or criminal) may be taken against the employee.

If the investigation leads to the establishment of grave errors by the employee, this can lead to sanctions. The employer must follow the procedure laid down in the internal work rules of the company and can only impose sanctions that are included in the internal work rules. In general, these are: a verbal warning; a written warning; a suspension (remunerated or not); a fine (capped to one-fifth of daily remuneration); and dismissal. If there are very serious errors leading to an immediate inability to continue the employment relationship with the employee, the employer can dismiss the employee with urgent cause without any notice period or indemnity in lieu of notice (following the specific procedure for these types of dismissals). In less serious cases, the employer could still dismiss the employee with a notice period or indemnity in lieu of notice. In principle, the employer has a right to dismiss the employee, even if this sanction is not included in the internal work rules.

As said previously, disciplinary sanctions (included in the internal work rules) must be communicated to the sanctioned employee the day after the employer or his delegate has established fault. The sanction must be registered in a sanction register, with the name of the employee, the date, the reason and the nature of the sanction. If there is a fine, the amount of the fine should be mentioned. The proceeds of the fines must be used for the benefit of employees. Where a works council exists, the use of the proceeds of the fines must be determined after consultation with it.

If investigators conclude that a breach has occurred, the company may determine the appropriate response, which may include verbal or written warnings; the suspension of employment without payment (for up to 29 days) or termination of employment without or with cause; a review of policies or operational protocols; and new training modules or the updating of training modules.

If the investigators conclude that a breach has not occurred but determine that the report was made in good faith, the case must be set aside. If the investigators determine that the report was made in bad faith, the employer must determine how to respond to the bad-faith reporter.

The employer may take disciplinary actions against the employee based on the investigation result and pursue their civil, administrative and even criminal liabilities. To be specific: 1) the employer may criticize and educate the employee, or take disciplinary actions such as warning, demotion and removal according to the internal rules and regulations of the employer. If the misconduct of the employee constitutes one of the circumstances stipulated in Article 39 of the Employment Contract Law of the PRC, the employer is entitled to take the most severe disciplinary action, namely termination of employment contract; 2) if the employee has caused economic loss to the employer, the employer may lawfully initiate a civil litigation recourse procedure; 3) if the employee violates the Law on Administrative Penalties for Public Security Administration of the PRC, the employer may deliver the case to the administrative department for corresponding administrative penalties; 4) if the employee is suspected of a crime, the employer should deliver the case to the public security authority and pursue his/her corresponding criminal liabilities according to the law.

The employer decides whether misconduct has taken place or not. Depending on the case, the employer may recommend a workplace conciliation in which the parties try to find a solution that can be accepted by both sides. The employer may choose to give an oral reprimand or a written warning. If the legal conditions are met, the employer may also terminate the employment agreement.

The employer can decide to sanction the person who was under investigation or to close the case. The employer may also need to protect any victims, witnesses and whistleblowers. If, during the investigation, it is discovered that a supplier or other commercial partner is implicated, the relevant contract may be terminated. The employer can take legal action , file a complaint (if the company is a direct victim of a criminal offence) or report the offence to the public prosecutor’s office. The employer must archive the file or ensure its lawful preservation after a certain period.

Depending on the results of the investigation, different steps may have to be taken by the employer. Specifically, the following should be considered:

• in certain cases, there may be an obligation (or at least good reason) to share the results of the workplace investigation with the authorities (see question 25);
• filing of a criminal complaint against the employee;
• disciplinary measures against the employee such as a warning, ordinary termination or termination for cause;
• assessing and asserting claims for damages against the employee;
• offering compliance training to the relevant employees or introducing additional measures to prevent further violations;
• if there is a risk that the company itself is exposed to investigative proceedings at some point and may have to defend itself, investigation materials should be stored at the company's external attorney's office; and
• depending on the individual circumstances of the case and to mitigate potential reputational damage, proactively informing the public (eg, by issuing a press release) may be beneficial.

For workplace violence and harassment investigations, depending on the outcome of the internal investigation, the employer may adopt certain measures including, for example, recommendations to the employee under investigation, changes to the employee’s working hours and transfer to another department.

If the employer decides to terminate the employment relationship, without having previously followed existing corporate policies regarding reporting procedures or without having provided the alleged perpetrator with the right to be heard, the dismissal could be deemed invalid. In any case, the measures adopted should be appropriate and proportional to the act committed.

If the outcome of the investigation reveals that misconduct has been committed by the employee, the employer may consider whether it should allow the employee to defend him or herself against such findings. If the employment contract or relevant internal policies specify a right to be heard on the part of the employee through a disciplinary hearing before any actions can be taken against him or her, such procedures should be followed.

Assuming the employer maintains its findings that the employee has committed misconduct after the conclusion of the disciplinary hearing (if any), the employer may consider taking one of the following disciplinary actions against the employee depending on the nature and severity of the misconduct:

• Verbal or written warning – this is a common form of disciplinary action. The employer may consider including the nature of the misconduct and the potential consequences of repeating such misconduct (for example, termination of employment) in the warning to be given to the employee;
• Termination with notice – the EO allows employers and employees to terminate the employment with notice. It is not necessary to give reasons for the termination unless the employee concerned has been employed for at least 24 months, in which case the employer shall demonstrate a valid reason for the termination as defined under the EO;
• Suspension – the employer may suspend the employee without pay for up to 14 days in circumstances where the misconduct concerned justifies a summary dismissal, or where a decision on summary dismissal is pending. The employee may also be suspended where there is a criminal proceeding against him or her relevant to the investigation, until the conclusion of the criminal proceeding (as discussed in question 3);[1] and
• Summary dismissal – the employer may terminate an employment contract without notice if the employee is found to have:
  • wilfully disobeyed a lawful and reasonable order;
  • failed to duly and faithfully discharge his duties;
  • committed fraud or acted dishonesty; or
  • been habitually neglectful in his duties.[2]

In misconduct cases, the next steps for an employer would depend on the outcome of the investigation. If the investigation reveals that the employee has violated the terms of employment and the employer wishes to take disciplinary action (which may include dismissal, depending on the gravity of the misconduct), it would normally be necessary to conduct a disciplinary inquiry as per the principles of natural justice before any actual punishment is meted out. Such a disciplinary inquiry would normally require the issuance of a charge sheet, the appointment of an independent inquiry officer (who should not have been involved in the investigation or otherwise in a position of bias vis-a-vis the parties involved),  and conducting disciplinary hearings, etc.

With SH complaints, once the investigation is concluded by the IC, the employer will be provided with a copy of the final report by the IC along with recommendations (ie, the disciplinary measures to be taken against the accused) for the employer to implement. The employer would then be required to act upon the recommendations shared by the IC within 60 days.

The investigator will usually set out recommendations within their report. It will then be up to the employer to act on those recommendations and to accept or reject the findings (if it were a fact-finding investigation). If, for example, a recommendation is made that the matter should proceed to a disciplinary hearing, the employer should then arrange such a hearing and nominate an impartial member of management to carry out the disciplinary hearing. In some instances, recommendations are made by investigators to provide training or update policies and such recommendations should be acted upon without delay. It may also be appropriate to notify a specific regulator of the outcome of the investigation.

Upon completion of the investigation, the employer – if misconduct by the employee emerges – may bring disciplinary action against him or her (which may be either dismissal or a “conservative” measure such as an oral or written warning, a fine, or a suspension, within the limits provided under the law and possibly the applicable NCBA).

If a criminal offence by the employee emerges, the employer may also decide to report the crime to the public authorities (see question 25).

In an investigation into an employee's misconduct, based on the results of the investigation, disciplinary action will be considered if there are grounds for disciplinary action, and dismissal will also be considered. Personnel actions (eg, dismissal, reassignment) may also be taken.

A distinction can be made between a non-public reprimand and a public reprimand. A non-public reprimand is a warning from the employer to the employee that certain behaviour by the employee may not be repeated. This is a relatively light measure. The employer can apply this measure to behaviour for which a verbal warning is insufficient or has already been given (more than once). The employer should confirm the reprimand to the employee in writing, so that it forms part of the employee's personnel file. It is important to have an acknowledgement so there is no dispute as to whether the reprimand has reached the employee. Often, the letter will also mention the consequences if the employee continues to behave in this way, so that the employee is aware of them. The employer then has reasonable grounds to apply a more severe disciplinary measure, such as suspension or dismissal, should the behaviour be repeated.

For a public reprimand, the warning is also made known to third parties. This is, therefore, a more severe measure than a non-public reprimand, as the honour and reputation of the employee are affected. A public reprimand must, therefore, be proportionate to the seriousness of the behaviour and will only be possible in the event of a serious offence, for which a non-public warning will not suffice. A public reprimand is also more likely if it is necessary to prevent other employees from engaging in the same behaviour (deterrent effect). Given the impact on the employee, it is important that the employer carefully investigates the facts and allows the employee to tell their side of the story (hearing both sides of the argument). A public reprimand is rarely given.

If the outcome of the investigation is that the employee is culpable, the employer can request that the court dissolves the employment agreement for that reason. The employer will have to show that continuation of the employment agreement is no longer possible. If the court rules that the employee is culpable, the employment agreement will be dissolved, observing the relevant notice period and paying the statutory transition payment. Only if the court rules that the employee has shown serious culpable behaviour, will the notice period not be taken into account and the transition payment will not be due.

If the employee has come into contact with the judicial authorities or is suspected of a criminal offence, but has not been convicted or detained (yet), the employer – when requesting the dissolution of the employment contract – will have to make a plausible case that, based on this suspicion alone, it can no longer be reasonably expected that the employment contract is upheld. This may be the case in a situation where the offence the employee is suspected of has repercussions on the employer, colleagues or customers and relations of the employer. In this situation, the court will assess whether a less drastic measure than dismissal, such as suspension, is sufficient to the interests of the employer.

If there is still no conviction but the employee is unable to perform his or duties due to being detained, the court reviews a request for dissolution in the same way as above. In this case, if the employee's payment of wages is discontinued, justice may already have been done to the employer's interests.

The final stage involves the conviction and detention of the employee. Although the dissolution of the employment contract under section 7:669 (3) under h DCC – which includes conviction and detention – is the most obvious option, it is still necessary to assess whether termination of the employment contract is reasonable because of the employee's conviction and detention. Although the seriousness of the offence, the duration of the detention and how this reflects on the employer are important factors, the court also takes the age, duration of the employment contract and the position of the employee on the labour market into account.

The most far-reaching dismissal method that can be considered is instant dismissal for an urgent reason (section 7:678 paragraph 1 in conjunction with section 7:677 paragraph 1 DCC). According to the case law of the Dutch Supreme Court, the question of whether there are compelling reasons must be answered based on all the circumstances of the case – to be considered together – including the nature and seriousness of what the employer considers to be compelling reasons, the nature and duration of the employment, how the employee performed their duties and the personal circumstances of the employee, such as age and the consequences for the employee of an instant dismissal.

Mere suspicion of a criminal offence will not easily qualify as an urgent reason, as follows from jurisprudence. At the same time, an employer can, instead of criminal suspicion as grounds for dismissal, also base its claim on the behaviour that underlies it. If the behaviour of the employee is already factually established, for example, because the employee has disclosed it to their employer or the employer has established it, the employer does not have to wait for the criminal proceedings before dismissing the employee.

Upon the completion and receipt of the findings of the investigation, the employer may affirm the employee’s innocence or take disciplinary action against them.

After the investigation has been concluded, the next steps of the employer will depend on the result of the investigation. If there are reasonable grounds to hold the employee for an administrative hearing, the employer may issue a Notice To Explain containing the charges against him or her and allowing the employee to explain his or her side. Otherwise, the employer may terminate the investigation immediately.

It depends on the outcome of the investigation: imposing penalties; reporting to a regulator; notifying a suspected offence or civil claim; termination of an employment contract with or without notice; and changes to the work organisation. Following the investigation, the employer must make some legal, business or HR corrective actions.

Once the preliminary investigation ends, the employer must decide whether or not, in its view, there are grounds to bring an accusation against the employee and enforce disciplinary action or if it should be dismissed due to a lack of evidence.

When the employer decides to enforce disciplinary action, the following sanctions may be applied:

• verbal warning;
• written warning;
• financial penalty;
• loss of holiday;
• suspension with loss of pay and length of service;
• dismissal with cause and without compensation.

The first five penalties are usually called conservatory sanctions, enabling the continuity of the employment relationship, as opposed to dismissal, which is deemed a measure of last resort.

The employer should take any follow-up steps required and keep track of whether any appeal against the outcome of the investigation is lodged. If any appeal is lodged, the employer should handle this appeal following its internal procedure. To the extent necessary, any disciplinary measures against the respondent employee should be stayed pending the outcome of the appeal.

After completing an investigation, the company may consider the following measures, among others:

1. taking disciplinary action against the relevant employees;
2. taking legal action (eg, criminal action, civil action) against the relevant employees; and
3. taking appropriate remedial measures (eg, strengthening existing policies and establishing new policies, and conducting training).

The company may also consider making a voluntary report to the relevant authorities as discussed in question 25.

After the conclusion of the enquiry, a company may choose to:

• close the investigation without taking any additional action; or
• adopt disciplinary measures against the employee.

These could range from a verbal or written warning to the suspension of work and pay for a set period. Disciplinary dismissals are also possible, but they are reserved for very serious offences.

Note that any disciplinary measure will have to follow the procedures that might be established in the applicable collective bargaining agreement, such as informing employee representatives or following a grievance procedure before adopting the measure.

An investigation may result in employment law measures (eg, support, training, relocation, warning, termination or dismissal). An investigation may also be inconclusive and not result in any action.

If the investigation uncovers misconduct, the question arises as to what steps should be taken. Of course, the severity of the misconduct and the damage caused play a significant role. Furthermore, it must be noted that the cooperation of the employee concerned may be of decisive importance for the outcome of the investigation. The possibilities are numerous, ranging, for example, from preventive measures to criminal complaints.[1]

If individual disciplinary actions are necessary, these may range from warnings to ordinary or immediate termination of employment.

Upon completion of the investigation, the employer can decide to take proper disciplinary action against the employee if it is found that the employee committed an offence or violated the work rules. An employer may also file a report with the police if the findings of the investigation amount to a criminal offence.

The employer may take various legal remedies against the employee whose infringement is discovered as a result of the internal investigation. Depending on the outcome of the investigation, the employer:

• may provide the employee with a written warning requesting him or her not to repeat the same conduct;
• terminate the employment relationship based on either just cause, without paying any compensation immediately, or valid reason by observing statutory notice periods or making payment in lieu of notice and paying severance compensation if applicable; or
• not take any action if the investigation concludes that no fault is attributable to the employee.

The investigator may recommend further action, but should not decide whether allegations are true, or suggest a possible sanction or prejudge what the outcome of any subsequent disciplinary process would be.

The employer will need to consider whether it is necessary to commence disciplinary proceedings. For regulated businesses, there may be an obligation to inform their regulator of the investigation outcome. In some circumstances, the employer may feel the need to make an internal or external announcement about the outcome, and any action it intends to take to implement any recommendations made by the investigator. There may also need to be certain updates to policies or procedures as a result of the investigation.

Where the misconduct alleged is substantiated in whole or in part by an internal investigation, the human resources function, potentially in consultation with in-house or outside counsel, should agree on disciplinary or remedial action to be implemented.

After the completion of the investigation, the employer may:

• take the appropriate labour disciplinary action against the employee;
• proceed with legal action against the employee (eg, reporting the criminal violations of the employee to the proper authority or filing a civil lawsuit against the employee before the court); or
• adopting preventive or remedial measures on how to avoid these violations and to mitigate the damage to the company (eg, reviewing internal policies and conducting employee training).