Workplace Investigations

Confidentiality protects the interests of the persons involved in the investigation as well as the integrity of the investigation. Before providing information as part of the investigation, employers should direct the complainant, respondent or witnesses to sign confidentiality agreements. This agreement should direct the person to refrain from discussing the investigation or matters that are the subject of the investigation with any person other than the investigator.

It is also best practice for participants in the investigation to be directed not to victimise (threaten or subject to any detriment) any persons who are witnesses to or are otherwise involved in the investigation.

After an investigation, employers should write to the complainant, respondent and any witnesses reminding them of their ongoing confidentiality obligations.

If the report and the whistleblower fall within the scope of the Whistleblowing Directive, his or her identity must be protected. From a data protection perspective, the principles of the DSG must be observed to protect the legitimate confidentiality of the individuals concerned.

Furthermore, the employer should ensure that information is only disclosed to trustworthy persons to avoid pre-judgements.

A workplace investigation is often a sensitive matter that requires necessary confidentiality to find out the truth discreetly and objectively. Nevertheless, there is often pressure from employees, trade unions or even the media and general public to be transparent and communicate about the case. From a legal perspective, it is not recommended to communicate openly about an ongoing investigation, as this can jeopardise the investigation or the possibility of taking disciplinary measures.

Whistleblower investigations will be bound by a strict duty of confidentiality regarding anything that could reveal the identity of the reporter.

In complaints due to sexual harassment, violence or bullying at work, the prevention adviser is bound by professional secrecy. Consequently, he or she may not disclose to third parties any information about individuals that have come to his or her knowledge in the performance of his or her duties. However, he or she still has the freedom to inform the people concerned to carry out his or her tasks in the procedure.

Law 14.457/2022 states that companies must guarantee the anonymity of accusers. As a result, it is best practice that companies allow for anonymous submissions, or allow accusers to voluntarily disclose their identity while acknowledging that they agree that it will be kept confidential to the extent required by the investigation.

Also, companies should have internal rules stating that all parties involved in an investigation (accusing party, accused party, witnesses, investigators, and any other person that has any contact with the investigation) must keep the existence of the investigation and of the events related to the investigation confidential to the extent required by the investigation, and discipline any individuals that violate this.

Although there are no specific laws or regulations regulating the extent of confidentiality obligation employers or the investigators shall comply with, in practice, the confidentiality obligation of both parties usually originates from the confidentiality agreement between the employee and the employer, as well as general provisions on protection of personal information and right of privacy, etc.

In this regard, it is advisable to require the relevant personnel responsible for handling the suspension for investigation to sign a confidentiality agreement or a letter of commitment, and require them to pay attention to the protection of the personal information and privacy of the complainant and other relevant personnel, for the purpose of avoiding extra losses caused by the occurrence of disputes relating to right of reputation, right of privacy and personal information leakage during the investigation.

Concerning a workplace investigation, there is no specific legislation in force at the moment regarding confidentiality obligations. All normal legal confidentiality obligations (eg, obligations outlined in the Trade Secrets Act (595/2018)), and if using an external investigator, the confidentiality obligations outlined in the agreement between the employer and the external investigator, apply. Attorneys-at-law always have strict confidentiality obligations as per the Advocates Act (496/1958).

Interviewers, investigators, interviewees or any others involved in the investigation are often bound by a reinforced confidentiality obligation, particularly when the internal investigation is triggered by a whistleblower alert. In addition, every person that comes to know of the investigation, facts or people involved is bound by an obligation of discretion. Furthermore, investigators should specifically be trained for interviews and be reminded of their obligations relating to the investigation.

The investigators will need to determine the order of the tasks to be carried out in the investigation, as this will have a significant impact on confidentiality management. Should they start with the hearings or a review of documents? The answer may depend on the subject matter of the investigation. It is advisable to first review the documentation before organising interviews, particularly to avoid the destruction of certain documents by employees acting in bad faith or by those wishing to erase the traces of alleged wrongdoing. Sometimes, however, it is possible to start with the interviews, especially in the case of harassment, as there may be no documents to review. If the decision is taken to conduct the documentation review after the interviews, it could be useful to ask the employees involved to sign a document stating that they must preserve and retain documents, meaning that if they delete or destroy documents, they would be acting against the company and in breach of the law.

Depending on the subject of the investigation and the severity and significance of the suspected violation, employees who are involved in the workplace investigation may already have to maintain confidentiality based on their contractual duties. The prerequisite for this is that the employer has a legitimate interest in maintaining confidentiality. Criminal acts are not subject to confidentiality, but there is also no general obligation for the employee to report or disclose a criminal act to the authorities or the public prosecutor. However, reporting to the competent authorities may be required in certain cases (see question 25).

Lawyers are bound by professional confidentiality and are generally not allowed to provide information about any information they receive from their clients. An exception exists, for example, if the lawyer must provide information to defend himself in court proceedings. There is also no absolute protection against the seizure of documents at an attorney’s office (see question 14).

Confidentiality applies as a general principle in disciplinary investigations.

Moreover, L. 4990/2022, which transposed EU Directive 2019/1937 into Greek Law, regulates the issue of confidentiality during investigations that start based on an internal report. The managers conducting the investigation must respect and abide by the rules of confidentiality regarding the information they have become aware of when exercising their duties[1]. They must also protect the complainant’s and any third party’s (referred to in the report) confidentiality by preventing unauthorised persons from accessing the report[2].

Finally, L. 4808/2021 provides that employers must create a procedure that should be communicated to employees regarding all the necessary steps of an investigation following a complaint. Throughout the whole process, the employer, managers and the employer’s representatives responsible for the investigation must respect and abide by the rules of confidentiality in a manner that safeguards the dignity and personal data of the complainant and the person under investigation[3].

Workplace investigations should usually be conducted on a confidential basis to preserve the integrity of the investigation, avoid cross-contamination of evidence and maintain the confidentiality of the employee under investigation. This means that those involved in the investigation (ie, the subject employee and any material witnesses) should be made aware of the fact and substance of the investigation on a need-to-know basis.

While the extent of the confidentiality obligations are usually governed by the employer’s internal policies and the employment contract, there are circumstances where the employer has a statutory duty to keep information unearthed in the investigation confidential. For instance, if it is found that certain property represents proceeds of an indictable offence[1] or drug trafficking[2], or is terrorist property[3], the employer should report its knowledge or suspicion to the Joint Financial Intelligence Unit (JFIU) as soon as is reasonably practicable and avoid disclosure to any other person as such disclosure may constitute “tipping off”. Another example is if a workplace investigation is commenced in response to a regulatory enquiry, the employer may be bound by a statutory secrecy obligation and may not be at liberty to disclose anything about the regulatory enquiry to anyone including those who are subject to the workplace investigation. For example, section 378 of the Securities and Futures Ordinance (SFO) imposes such a secrecy obligation on anyone who is under investigation or assists the Securities and Futures Commission (SFC) in an investigation.[4]

Indian labour statutes do not contain any specific confidentiality obligations concerning investigations. However, in practice, the records of investigative or disciplinary proceedings should be kept confidential and shared only on a need-to-know basis to ensure that the parties do not suffer prejudice. The internal policies should also include provisions on confidentiality.

The SH Act, however, provides that certain information must not be published or made known to the public, press and media such as:

• the contents of the SH complaint;
• the identity and addresses of the complainant, accused and witnesses;
• any information on the conciliation and inquiry process;
• the recommendations of the IC; and
• action to be taken by the employer.

The SH Act permits the dissemination of information regarding remedies extended to any victim without disclosing the name, address or identity of the victim or witnesses. The SH Act also outlines punishments for violating confidentiality obligations.

This will depend on the nature of the investigation but, generally, investigations should be conducted on a confidential basis. All who participate in the investigation should be informed and reminded that confidentiality is a paramount consideration taken very seriously. However, it should be borne in mind that confidentiality cannot be guaranteed by an employer as the respondent in an investigation is entitled to know who has made complaints against them. Furthermore, the respondent is entitled to cross-examine the complainant and any witnesses, although in practice this right is rarely invoked strictly and is facilitated by the investigator, with questions from the respondent being put to the complainant and other witnesses.

On occasion, a breach of confidentiality may warrant disciplinary action, but this will depend on the circumstances. Exceptions to the requirement to keep matters confidential will of course apply where employees seek support and advice from others such as companions, trade union representatives or legal advisors. It may also not be possible to maintain confidentiality where regulators or the authorities are informed of the investigation.

Also, confidentiality may not be maintained if it is in the interests of the employer to communicate the complaint and any subsequent investigation, for example on a health and safety basis.

From an employment law perspective, confidentiality obligations may be seen from two different points of view:

• as a general duty of the employee related to the employment relationship, according to article 2105 of the Italian Civil Code, a “loyalty obligation”, which includes confidentiality obligations. On top of these, there are usually further confidentiality clauses in individual employment contracts; and
• as a general duty (linked to the outcome of the investigation) of the employer to keep confidential the identity of the employee who cooperates during the investigation (as whistleblower or a witness) to protect him or her.

In defensive criminal law investigations, the witness can’t reveal questions or answers given in his or her interview to a third party.

With regards to the confidentiality applicable to the whistleblower, see above under question 9 and below under question 12.

See question 9 for the confidentiality obligations of a whistleblower response service employee.

Other than the above, there is no specific legal obligation to maintain confidentiality for persons in charge of investigations, etc. However, if the information falls under the category of confidential information obtained by employees in the course of their work, compliance is required as an obligation attached to a labour contract, and many employment regulations stipulate a duty to keep information obtained in the course of work confidential.

The principle of due care requires employers to act prudently when it comes to sharing the identity of persons involved, such as complainants and implicated persons; and investigative findings, notably when certain employees may be implicated. As a result, such information is usually shared within an employer to designated departments on a need-to-know basis only. Additional safeguards as to the protection of whistleblowers' identities apply since the Whistleblower Directive (see question 9) was implemented in Dutch law. Also, see question 13 for the confidentiality obligations of employees vis-à-vis their employer.

Workplace investigations should be kept strictly confidential to protect the parties involved in the investigation from victimisation. Some of the confidential obligations that apply during investigations are the identities of the parties involved in the process (whether as a complainant, respondent or witnesses), the confidentiality of reports, recordings and other documents generated or discovered during the investigation, as well as attorney-client privilege between the employee and his or her attorney, provided that such privilege is within the bounds of the law.

Since the right to investigate ultimately belongs to the employer, it may impose strict confidentiality obligations upon the individuals involved, not only to ensure unhampered investigation proceedings but also and more importantly for the protection of the company and employees involved.

The law does not cover this issue, apart from whistleblower regulations, as it should be regulated by the employer in their internal rules. The employer should ensure all participants of the investigation keep information related to it secret, as long as is necessary for the investigation (or even longer, if required by law concerning personal data or other specially protected information). Reputation, personal data and the personal rights of other people cannot be breached during the proceedings and this should be protected.

Moreover, according to the Draft Law – a whistleblower’s personal data should be kept confidential. It can only be disclosed if law enforcement authorities require it. Also, confidentiality should be guaranteed for the subject and other interested persons.

The Portuguese Labour Code does not specifically provide for any confidentiality obligations concerning disciplinary procedures. On the contrary, it states that the employee should have access to any information included in the disciplinary procedure. Otherwise, the employee’s defence rights could be jeopardised, which would make the disciplinary procedure (and possible disciplinary sanctions) null and void.

As for the witnesses, even though there is no specific provision on confidentiality, employees are generally bound by a duty of loyalty vis-a-vis the employer, which includes not disclosing information that should be kept reserved,

However, in the cases of whistleblowing, it is mandatory to ensure the confidentiality of the complainant, as per question 9.

The existence and scope of any confidentiality obligations would generally depend on the specific terms of the employment contract, employee handbook or the employer’s internal policies and procedures in dealing with the investigations.

In the context of investigations into workplace harassment issues, the Tripartite Advisory on Managing Workplace Harassment issued by the MOM provides that the identities of the alleged harasser, affected persons and the informant should be protected unless the employer assesses that disclosure is necessary for safety reasons.

This may change with the enactment of the Workplace Fairness Legislation referred to in question 1. The Tripartite Committee on Workplace Fairness recommended, among other things, that employers should protect the confidentiality of the identity of persons who report workplace discrimination and harassment, where possible. As such, it is expected that the upcoming Workplace Fairness Legislation may impose certain confidentiality obligations on an employer during an investigation.

It is general practice in Korea for a company to require interviewees to maintain confidentiality concerning a workplace investigation and instruct them that they are not permitted to discuss the matter under investigation with other employees, etc. If an employee violates this instruction, it may be possible for the company to take disciplinary action against them under the company’s rules.

Further, the company or its employees who have engaged in an investigation for sexual harassment or workplace harassment in the workplace are obliged to maintain the confidentiality of the investigation. Failure to comply with such requirements may lead to an administrative fine from the Ministry of Employment and Labour for the company or its registered representative.

There may be some exceptions to the confidentiality obligation, such as when an employee is required by government authorities to provide relevant information in a parallel investigation.

Companies and employees are not bound by any statutory confidentiality obligation in the context of workplace investigations. However, if a company’s enquiry has the potential to examine employees’ private affairs, then the company must ensure the confidentiality of the investigation.

This confidentiality obligation would not arise from the investigation itself, but from the company’s obligation to safeguard its employees’ rights.

If the Swedish Whistleblowing Act applies, the persons or entities handling the investigation have a duty of confidentiality and may not, without permission, disclose any information that could reveal the identity of the reporting person, any person subject to the report or any other person mentioned in the report or during the investigation of the report. Access to personal data is limited to designated competent entities or persons. Investigative material including personal data may not be shared with other persons or entities during the investigation. Once the investigation has reached actionable conclusions, investigative material may be shared with other persons or entities, such as HR or the police, provided that such sharing is necessary to take action on the outcome of the investigation. Investigative material may also be shared if it is necessary for the use of reports as evidence in legal proceedings or under the law or other regulations.

If the Swedish Whistleblowing Act does not apply, there are no particular confidentiality obligations for employers. Yet, an employer needs to consider what information is suitable to share during an investigation, how this is done and to whom it is shared. An employer must also respect employees’ privacy in line with what is generally considered good practice in the labour market. This means that an employer should be careful as to what sensitive and personal information is shared during an investigation. Furthermore, the spreading of damaging information (even if true) about an employee to a wider group may be a criminal offence under the Swedish Criminal Code.

Besides the employee's duty of performance (article 319, Swiss Code of Obligations), the employment relationship is defined by the employer's duty of care (article 328, Swiss Code of Obligations) and the employee's duty of loyalty (article 321a, Swiss Code of Obligations). Ancillary duties can be derived from the two duties, which are of importance for the confidentiality of an internal investigation.[1]

In principle, the employer must respect and protect the personality (including confidentiality and privacy) and integrity of the employee (article 328 paragraph 1, Swiss Code of Obligations) and take appropriate measures to protect the employee. Because of the danger of pre-judgment or damage to reputation as well as other adverse consequences, the employer must conduct an internal investigation discreetly and objectively. The limits of the duty of care are found in the legitimate self-interest of the employer.[2]

In return for the employer's duty of care, employees must comply with their duty of loyalty and safeguard the employer's legitimate interests. In connection with an internal investigation, employees must therefore keep the conduct of an investigation confidential. Additionally, employees must keep confidential and not disclose to any third party any facts that they have acquired in the course of the employment relationship, and which are neither obvious nor publicly accessible.[3]

Unless the investigation is handled by a qualified professional (eg, attorney or auditor) where certain privileges apply, confidentiality obligations are generally subject to the contractual arrangement between the parties involved in the investigation. The employers need to inform any persons, including the investigators, to respect confidentiality obligations because a leak of the information gathered from the investigations could cause damage to relevant parties.

As a general practice, workplace investigations need to be kept confidential for the integrity of the process. In some cases, employees can specifically request their identity or involvement be kept confidential. In such cases, additional measures need to be taken to protect confidentiality. In any case, obligations and rights arising from the DPL and Labour Law must be respected and complied with by the employer and the investigation team.

Workplace investigations should usually be conducted on a confidential basis, so that only those involved in the investigation are aware of its existence and subject matter. The need to maintain confidentiality about both the fact of the investigation, and any content discussed with an investigator, should be emphasised to all those involved. It may also be necessary to explain that a breach of confidentiality could be viewed as a disciplinary matter. Appropriate exceptions must, however, be made to allow employees to speak to any relevant employee or trade union representative, legal adviser and potentially the police or other regulators. Confidentiality provisions cannot override the rights of workers to make protected disclosures (see question 9).

In some situations, such as those involving a wide-ranging investigation into the organisation’s working practices and culture, it may be more appropriate to investigate a more “open” basis, and inform employees and other stakeholders.

Information arising from the initial complaint, interviews and records should be kept as confidential as practically possible while still permitting a thorough investigation. Although an employer must maintain confidentiality to the best of its ability, it is often not possible to keep confidential the identity of the complainant or all information gathered through the investigation process. An employer should therefore not promise absolute confidentiality to any party involved in an internal investigation, including the complainant. The investigator should instead explain at the outset to the complaining party and all individuals involved that information gathered will be maintained in confidence to the extent possible, but that some information may be revealed to the accused or potential witnesses on a need-to-know basis to conduct a thorough and effective investigation.

Workplace investigations should be conducted in a strictly confidential manner to preserve the integrity and professionalism of the investigation and to protect the identity of the employee under investigation. This means that all information gathered, received, and shared during the investigation (ie, the subject employee and any material witnesses) should only be disclosed on a need-to-know basis.

Non-disclosure agreements, also known as confidentiality agreements, can be used to maintain the confidentiality of the investigation. In this agreement, the employee will be directed to maintain confidentiality concerning the investigation and matters that are the subject of the investigation, and not speak to anyone outside the investigation team about the investigation without authorisation.

Confidentiality agreements are legal documents. Employees should be informed that a breach of the confidentiality agreement could result in disciplinary action being taken against them, up to and including termination of their employment.  

According to section 6(1) of the DSG, employees who have access to personal data in the course of their professional activities must maintain data confidentiality and continue to do so even after termination of their employment.

Non-disclosure agreements can generally be used to achieve this but are subject to certain restrictions. They may not be used to conceal criminal activity, violate the privacy rights of individuals, circumvent legal disclosure obligations, prevent the exercise of legal rights or contain clauses that violate existing laws, in particular data protection regulations.

In principle this is possible. However, these NDAs do have their limits and cannot prevent involved persons from, for example, bringing a legal claim or filing a report if they are legally entitled to do so. Under whistleblower rules, a reporter can even publish his or her complaint under certain circumstances.

Yes, NDAs may be executed to reinforce the confidentiality obligations outlined in the company's policies and reinforced in interviews.

Yes. In practice, before conducting a compliance investigation, we recommend that the employer and the investigator enter into a confidentiality agreement to require the investigator to keep confidential the facts and the substance of the investigation. This will not only better protect the personal information of the complainant, the witness and the investigated employee, but also help the investigation to proceed smoothly.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

Most of the time, the legal protection afforded by the legally prescribed confidentiality obligation that applies to whistleblowing is sufficient. This is all the more so given every person involved is bound by an obligation of discretion. However, there is no legal obstacle to the creation of an NDA between the employer and the people involved.

NDAs setting out a strict and reinforced obligation of confidentiality and discretion during the investigation should be signed by any external parties involved (eg, translation agency, IT expert) or when the internal investigation is outside the scope of whistleblowing regulations.

In principle, it is possible to conclude non-disclosure agreements with external consultants of the investigation or with employees involved in the investigation. However, regarding external lawyers, a non-disclosure agreement is not necessary since lawyers are already subject to professional confidentiality. Concerning employees, it is rare in Germany to conclude confidentiality agreements in connection with a workplace investigation.

NDAs are an option, especially to outline in detail the obligations of the persons conducting the investigation, which is also provided for in law. On the other hand, NDAs will not prevent persons involved from providing information to the competent authorities in the context of criminal or other similar procedures, where they must do so by law. Moreover, they may not protect confidentiality if persons who report breaches of Union law decide to make an external or public report, according to the provisions of L. 4990/2022.

In general terms, NDAs can be used and indeed are commonly used to keep the fact and substance of a workplace investigation confidential. However, NDAs will not be effective in preventing the disclosure of information which is in the public interest or is important for safeguarding public welfare in matters of health and safety. Further, several laws in Hong Kong provide that disclosures as a result of compliance with a requirement made by the relevant authorities will not be treated as a breach of any restriction imposed by contract or otherwise by law.[1]

Yes. While it is common for employees to be bound by general confidentiality obligations at the beginning of employment, it is advisable to reiterate such confidentiality obligations through NDAs during an investigation.

There is no legislation regarding NDAs, but there is a Bill before the legislature proposing to “restrict the use of non-disclosure agreements as they relate to incidents of workplace sexual harassment and discrimination”. It is currently at the report stage. Whether it passes remains to be seen, but there has in recent times been strong criticism of the use of NDAs to cover up matters that ought to be fully investigated and dealt with in an organisation.

Settlement agreements, however they arise, may include confidentiality clauses which may, depending on the terms of the agreement, extend to the fact and substance of an investigation, but as in the UK an employee's right to make a protected disclosure or report a criminal offence cannot be waived by signing an NDA.

Yes, in principle, NDAs can be used to keep the fact and substance of an investigation confidential, even if it is not strictly necessary (and not often done in our experience).

It is possible to use NDAs in investigations.

Yes, NDAs can be used for this purpose. However, employers in the Netherlands often rely on general confidentiality obligations that the relevant employee already has to adhere to vis-à-vis their employer, for example in the employment agreement or collective labour agreement, if applicable. It is good practice to reiterate the confidential nature of any interview and its contents, and the existence of the investigation as such, to avoid any alleged confusion as to the confidential nature of investigative procedures later on.

NDAs are usually part of an employee’s contract and, as such, create a contractual obligation between the parties privy to it. However, where the subject matter of an investigation borders on matters of a criminal nature, it might be impossible for parties to the NDA to continually uphold the obligation under the NDA because the parties have an obligation to the state to disclose facts of a criminal nature.

The practice of stipulating matters to ensure adherence to confidentiality is not uncommon. As such, NDAs are executed as a means of added protection for both the company and the employees involved.

Yes, but it may not stop the disclosure of information at the request of relevant law enforcement authorities.

Please see question 12 above. NDAs are not admissible.

Yes, NDAs can be used to keep the fact and substance of an investigation confidential. There are no express prohibitions against such NDAs under Singapore law. However, information or evidence covered by the NDA may still be discoverable in court or arbitration proceedings; and may also be subject to disclosure requests or directions by the police or statutory authorities, including the MOM.   

Some companies require an employee subject to investigation to sign an NDA or other similar documents (eg, a pledge of confidentiality) agreeing not to disclose information relating to the investigation to outside parties.

Yes. NDAs are the preferred instrument to ensure that employees conducting the investigation, as well as those who participate as witnesses or collaborators, will keep the enquiry and its existence confidential.

NDAs can be used for some investigations carried out in the private sector. However, under the Swedish Whistleblowing Act, a contract is void to the extent it retracts or restricts a person’s rights under the Swedish Whistleblowing Act. An NDA that restricts the right to report irregularities to authorities or the media would, therefore, typically be void.

In addition to the above-mentioned statutory confidentiality obligations, separate non-disclosure agreements can be signed. In an internal investigation, the employee should be expressly instructed to maintain confidentiality.

Non-disclosure agreements can be made between an employer and employees who are involved in an investigation. This may include investigators and witnesses, apart from the employee under investigation. This minimises the risk of information being leaked, which can affect all parties related to the workplace investigation. However, an NDA is not absolute means to prevent the disclosure of confidential information, as the court has the authority to compel disclosure.

It is crucial to keep the events and facts of a workplace investigation confidential for the integrity of the process. It may be necessary to consider appropriate confidentiality measures to protect the complainant, mitigate risks, and preserve evidence. Damage to the confidentiality of the case can prevent the investigation team from bringing the case to a correct and complete conclusion. Although the labour legislation imposes a general confidentiality obligation on employees, NDAs can still be used as supplementary documents that may emphasise the confidentiality obligations of employees in workplace investigations and provide additional contractual protections such as penalties if there is a breach.

Only to a limited extent. As a matter of law, NDAs cannot prevent a worker from making a protected disclosure, or reporting a crime to the police. As a matter of the regulatory obligations of solicitors, NDAs should not be used in other ways, including as a means of influencing the content of disclosures, or by using warranties, indemnities and clawback clauses in a way that is designed to, or has the effect of, improperly preventing or inhibiting permitted reporting or disclosures (see the SRA’s warning notice on the use of NDAs).

This is a fact-specific inquiry that depends on the specific circumstances and laws of the relevant state. In general, NDAs are frowned upon but can be used to an extent to keep certain facts and the substance of an investigation confidential. NDAs can never prevent employees from assisting in official agency investigations, however. NDAs also cannot lawfully prohibit employees from officially reporting illegal conduct by their employer.

Generally, NDAs can be used to keep the facts and substance of a workplace investigation confidential. There are no express prohibitions against such NDAs. However, there are cases set out under Decree No. 13/2023/ND-CP on personal data protection where personal data is allowed or required to be disclosed without the data subject’s consent, in instances that are necessary to serve the public interest or to protect the life and health of the data subject.