Workplace Investigations

To ensure procedural fairness, the allegations must be put to the respondent in writing in advance of the investigation interview. The allegations must be specific, but the respondent does not need to be provided with a copy of the original complaint. The respondent should also be informed that if the allegations are substantiated they may result in disciplinary action up to and including the termination of the employee’s employment.

The purpose of internal investigations would be jeopardised by fully informing a suspected employee beforehand, as it would allow him or her to hide or destroy possible evidence, plan his testimony or coordinate with other employees.

There is no legal requirement to inform the employee of the allegations or suspicions.

In general, the employee should be informed that there is an ongoing investigation (unless this could jeopardise the investigation, in which case disclosure could be postponed until this is no longer the situation). Next, before imposing measures or sanctions, the employee should be allowed to be heard or to give his or her version of the facts. Of course, the employee can only do this if he or she is aware of the facts being investigated. It is not necessary to give the employee a full insight into the investigation, only the necessary facts that allow him or her to offer a defence are sufficient.

There is no obligation to inform an employee under investigation that this is the case, and it should not happen automatically.

While some policies require that the investigated employee be informed about the allegations against them at the beginning of the investigation, from a local perspective it is recommended that the accused employee be notified about the existence of the allegations if, after a reasonable review, there are elements that suggest that the accusation may be material.

In this context, the employee should be informed about the accusation and be allowed to confirm, deny, provide further context or justify each reported or identified event; offer evidence; and indicate persons or sources of information that could corroborate his or her defence. Information about the accusation must be focused on facts rather than on how the company obtained the information.

If the accusation is found to be groundless after initial review, involving the accused employee at the beginning of the process may have triggered unjust and unnecessary stress and a disruption in the employment relationship that may not be satisfactorily repaired by a determination that the accusation was void. This may result in a legal liability for the company or HR issues that could otherwise have been avoided.

Although there are no explicit provisions of law or policy requiring employers to provide specific information of allegations to investigated employees, in practice, at the early stage of investigation, in order to avoid alerting the investigated employee and reduce the possibility that the investigated employee may destroy the relevant evidence, the employer usually will not disclose the information of allegations to the investigated employee at the beginning of investigation. At the later stage of an investigation, when the employer has already obtained main evidence, the employer usually will properly disclose to the investigated employee the allegations that are clearly known by the employer and have sufficient evidence, and listen to the counterparty's opinions or argument, for the purpose of obtaining more information or getting the employee's confession.

The process must be transparent and impartial, and therefore all the information that may influence the conclusions made during the investigation should be shared with the employee.

According to the French data protection authority, the employee under investigation must be informed of the name of the person in charge of the investigation, the alleged facts that have led to the whistleblowing alert and their rights to access and rectify data collected about them. This information must be given as soon as the data collection starts, before the interviews, as per GDPR principles.

In principle, the employer does not have to inform the employees about the investigation. Furthermore, there is no obligation to inform the "suspect" about the specific content of the workplace investigation itself and the allegations against him.

However, if personal data relating to the employee is collected and reviewed, the employee must be informed under German data protection principles (see question 7).

If the employer considers issuing a notice of termination based on the suspicion of wrongdoing, the employee must be allowed to comment on the allegations against him before receiving the termination notice. This requires that the employee be properly informed about the allegations and evidence against him. However, until the time of such a hearing, which usually follows the workplace investigation, there is no obligation on the part of the employer to inform the employee concerned about ongoing investigations.

As a matter of general principle, employees under investigation must have access to the necessary information to be able to defend themselves, in the context of their fundamental right to a fair trial and hearing.

Moreover, from a data protection perspective, they may be entitled to access their personal data in the respective files.

The above rights must be balanced with confidentiality and the need to safeguard the completion of the investigation and to protect the complainant from retaliation.

According to L.4990/2022, all data and information as well as the identity of the complainant are confidential, and any disclosure is only permitted where required by the EU or national legislation or during court proceedings, and only if it is necessary for the protection of the defence rights of the employee under investigation. The section of L.4808/2021 for the elimination of workplace violence and harassment does not regulate this specifically but provides a general obligation for confidentiality.

An employer’s internal policies or the employment contract may provide that an employee under investigation should be given certain information concerning the allegations raised against him or her. Such policies or terms should be followed and failure to do so may result in a claim for breach of contract or constructive dismissal by the employee. Even where there are no express provisions, the employer still owes an implied obligation of trust and confidence towards the employee at common law, which requires the employer not to, without reasonable and proper cause, conduct itself in a manner calculated and likely to destroy or seriously damage the relationship of confidence and trust between itself and the employee.[1] In the context of an internal investigation, the implied duty would require the employer to conduct the investigation and reach its findings reasonably and rationally following the evidence available and in good faith. This would normally require that sufficient information about the allegations made against the employee be provided to him or her such that he or she has the opportunity to properly respond to the allegations before any disciplinary action is taken or any decision about his or her employment is made.

As mentioned earlier, workplace investigations are normally a precursor to the actual disciplinary process against an employee. If the individual is being suspended during the investigation, the employer is only expected to inform the individual that they are being suspended on account of an ongoing investigation along with the broad nature of allegations or concerns, and does not need to disclose specific details about the allegations until the appropriate time. Further details may be provided at the investigation stage itself when the employee may be interviewed, or at the subsequent disciplinary inquiry.

Where a disciplinary process is necessary and initiated (after the investigation), the employee will have to be given a charge sheet or notice setting out the allegations against the individual in detail and be provided with an opportunity to submit an explanation. 

In sexual harassment investigations, the SH Act mandatorily requires the IC to submit a copy of the complaint to the accused. Further, the accused should be informed of the requirement to file his or her reply to the complaint along with a list of supporting documents, evidence, names and addresses of witnesses, etc, and the timelines for submitting his response in defence.

Under the fair procedures outlined above, details of the allegations or complaints against the employee should be put to them to enable them to fully respond to the allegations raised. The employee should also be provided with any relevant policies pertaining to the allegations against them, along with all documentary evidence of the allegations and the specific terms of reference that define the scope of the investigation. The employee should also be informed of their right to be represented, see question 15.

From an employment law perspective, our legal system does not provide a specific duty for an employer to inform employees that a workplace investigation is in progress.

In addition, disclosing such information could put at risk the outcome of the workplace investigation (eg, destruction of evidence), and it would therefore be arguable that no information should be provided to employees.

On the other hand, if, upon completion of the investigation, the employer decides to bring disciplinary action against the employee, then the latter must be informed of the complaints with a letter stating the procedure (see questions 3 and 12).

There are no specific legal stipulations or requirements regarding information, etc, that must be provided to employees who are the subject of an investigation.

An implicated person is typically provided with a summary description of the scope of the investigation and, hence, the allegations against such an employee (if any). This is usually done in the interview invite sent to the relevant interviewee, which also provides an opportunity to prepare for an interview and (if relevant) seek legal advice.

An employee must be given the full details of the allegations against him or her to enable the employee to make adequate representations against the complaints made against him or her.

During the fact-finding stage of the investigation, the employees under investigation are not generally entitled to information concerning the conduct of the investigation. It is the prerogative of management to involve the employee under investigation during the fact-finding stage. When, however, the employer determines that an administrative disciplinary process must proceed, the employee’s right to due process attaches. As such, due process includes the right to be informed of the grounds relied upon by the employer and the opportunity to be heard. The first notice or notice to explain should specifically inform the employee of the charge against him or her.

There is no specific mandatory information that should be given to an employee who is the subject of an internal investigation. However, it is common practice that he or she must know what the allegations against them are, on what grounds these allegations are formulated and be given a right to discuss these allegations and the evidence or grounds for these allegations.

If, before taking disciplinary action, the employer decides to open a preliminary investigation phase, the employee does not have to be informed.

Only when the preliminary investigation leads to a formal accusation will the employee be entitled to know that enquiries were carried out and the source of the facts (eg, witnesses, documents).

However, if an employer does not need to open a formal preliminary investigation phase, it only has to serve the accusation notice to the employee.

As a rule, employees will only know that they are being investigated if they are suspended or when they are notified of the accusation.

There is no specific list of information about the allegations against the employee under investigation that must be provided to the employee under investigation. However, the information provided to the employee must be sufficiently clear and specific so that the employee understands the case being made against him or her and can respond to it. The employee should also be made aware of the evidence against him or her and be given a reasonable opportunity to respond.

There is no requirement to notify an employee under investigation concerning the allegations against him or her when requesting cooperation with a workplace investigation (eg, requesting the employee’s consent to review electronic data, or requesting an interview).

However, the company may strategically consider explaining the general purpose of the investigation before requesting consent to review electronic data or when requesting an interview. This may help increase the likelihood of cooperation and also reduce the risk of the employee raising objections to the company’s findings from the investigation by saying he or she was not properly informed of the purpose of the investigation, or that the investigation was conducted in a coercive manner.

It is not necessary to inform an investigated employee about an enquiry or of the allegations made against him or her. The obligation to disclose would only arise when:

• interviewing the employee would be the least intrusive means to investigate the facts; or
• if disciplinary measures are implemented as a result of the investigation. Since employees are entitled to challenge all disciplinary measures against them, they could request a court of law to disclose all the findings of the investigation, to assess if these findings could be useful to challenge the disciplinary measure.

According to article 14 of the GDPR, no information must be provided. The exemption in article 14.5(b) applies to the extent the obligation to provide such information is likely to render impossible or seriously impair the objectives of the processing of the personal data of the employee under investigation (ie, to diligently investigate the suspected irregularity).

If the Swedish Whistleblowing Act applies, information about where the personal data processed originates from may not be provided under article 14 of the GDPR, as the personal data must remain confidential subject to obligations under the Swedish Whistleblowing Act.

In addition to the above, an investigation should, to the extent possible and suitable, be characterised by the principles in ECHR (particularly articles 6 and 8). The employee under investigation should, among other things, be presented with sufficient information to safeguard his or her interests and be allowed to respond to the allegations. The investigation must also be compliant with the work environment responsibilities that the employer has concerning the involved parties (see questions 17 and 20).

As a result of the employer's duty of care (article 328, Swiss Code of Obligations), employees under investigation have certain procedural rights. These include, in principle, the right of the accused to be heard. In this context, the accused has the right to be informed at the beginning of the questioning about the subject of the investigation and at least the main allegations and they must be allowed to share their view and provide exculpatory evidence.[1] The employer, on the other hand, is not obliged to provide the employee with existing evidence, documents, etc, before the start of the questioning.[2]

Covert investigations in which employees are involved in informal or even private conversations to induce them to provide statements are not compatible with the data-processing principles of good faith and the requirement of recognisability, according to article 4 of the Swiss Federal Act on Data Protection.[3]

Also, rights to information arise from the Swiss Federal Act on Data Protection. In principle, the right to information (article 8, Swiss Federal Act on Data Protection) is linked to a corresponding request for information by the concerned person and the existence of data collection within the meaning of article 3 (lit. g), Swiss Federal Act on Data Protection. Insofar as the documents from the internal investigation recognisably relate to a specific person, there is in principle a right to information concerning these documents. Subject to certain conditions, the right to information may be denied, restricted or postponed by law (article 9 paragraph 1, Swiss Federal Act on Data Protection). For example, such documents and reports may also affect the confidentiality and protection interests of third parties, such as other employees. Based on the employer's duty of care (article 328, Swiss Code of Obligations), the employer is required to protect them by taking appropriate measures (eg, by making appropriate redactions before handing out copies of the respective documents (article 9 paragraph 1 (lit. b), Swiss Federal Act on Data Protection)).[4] Furthermore, the employer may refuse, restrict or defer the provision of information where the company’s interests override the employee’s, and not disclose personal data to third parties (article 9 paragraph 4, Swiss Federal Act on Data Protection). The right to information is also not subject to the statute of limitations, and individuals may waive their right to information in advance (article 8 paragraph 6, Swiss Federal Act on Data Protection). If there are corresponding requests, the employer must generally grant access, or provide a substantiated decision on the restriction of the right of access, within 30 days (article 8 paragraph 5, Swiss Federal Act on Data Protection and article 1 paragraph 4, Ordinance to the Federal Act on Data Protection).

The subject employee(s) should be informed of the details of the allegations, such as the details of wrongdoing or violations, made against them. This creates a fair opportunity for them to clarify themselves and defend against such allegations properly. Also, if there is any evidence that needs clarification from the employee, it should be shown to the employee.

Informing the employee under investigation on the subject, purpose and possible consequences of the investigation need to be evaluated by the investigation team before the interview. As a general principle, the interviewer is expected to share the information he obtained on the case with the employee, and ask for confirmation or clarification on these matters. The employee under investigation may be subject to an interview to gain information or as a confrontation if there is concrete evidence. If the evidence in hand is not based on concrete and material grounds, it would be more appropriate not to lead the interview to a confession, but inform the employee of the possible allegations. However, if the available evidence is based on concrete and material grounds, the interviewer may confront the interviewee by sharing the information that was gathered during the investigation in an attempt to obtain a confession.

The employee must be able to effectively challenge the allegations against them. They should be given the terms of reference for the investigation, and any relevant documentary evidence, including copies of witness statements.

The investigator must disclose to the employee under investigation the purpose of the investigation and, where the investigator is in-house or outside counsel, he or she should disclose that the company is the client.

There is no legal requirement as to what particular information should be stated in the allegations; however, such information must be provided to the employee under investigation. The information provided by the employer to the employee must be sufficiently clear and specific so that the latter understands the case or alleged issues against him or her and can respond to it.

Non-disclosure agreements, also known as confidentiality agreements, can be used to maintain the confidentiality of the investigation. In this agreement, the employee will be directed to maintain confidentiality concerning the investigation and matters that are the subject of the investigation, and not speak to anyone outside the investigation team about the investigation without authorisation.

Confidentiality agreements are legal documents. Employees should be informed that a breach of the confidentiality agreement could result in disciplinary action being taken against them, up to and including termination of their employment.  

According to section 6(1) of the DSG, employees who have access to personal data in the course of their professional activities must maintain data confidentiality and continue to do so even after termination of their employment.

Non-disclosure agreements can generally be used to achieve this but are subject to certain restrictions. They may not be used to conceal criminal activity, violate the privacy rights of individuals, circumvent legal disclosure obligations, prevent the exercise of legal rights or contain clauses that violate existing laws, in particular data protection regulations.

In principle this is possible. However, these NDAs do have their limits and cannot prevent involved persons from, for example, bringing a legal claim or filing a report if they are legally entitled to do so. Under whistleblower rules, a reporter can even publish his or her complaint under certain circumstances.

Yes, NDAs may be executed to reinforce the confidentiality obligations outlined in the company's policies and reinforced in interviews.

Yes. In practice, before conducting a compliance investigation, we recommend that the employer and the investigator enter into a confidentiality agreement to require the investigator to keep confidential the facts and the substance of the investigation. This will not only better protect the personal information of the complainant, the witness and the investigated employee, but also help the investigation to proceed smoothly.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

Most of the time, the legal protection afforded by the legally prescribed confidentiality obligation that applies to whistleblowing is sufficient. This is all the more so given every person involved is bound by an obligation of discretion. However, there is no legal obstacle to the creation of an NDA between the employer and the people involved.

NDAs setting out a strict and reinforced obligation of confidentiality and discretion during the investigation should be signed by any external parties involved (eg, translation agency, IT expert) or when the internal investigation is outside the scope of whistleblowing regulations.

In principle, it is possible to conclude non-disclosure agreements with external consultants of the investigation or with employees involved in the investigation. However, regarding external lawyers, a non-disclosure agreement is not necessary since lawyers are already subject to professional confidentiality. Concerning employees, it is rare in Germany to conclude confidentiality agreements in connection with a workplace investigation.

NDAs are an option, especially to outline in detail the obligations of the persons conducting the investigation, which is also provided for in law. On the other hand, NDAs will not prevent persons involved from providing information to the competent authorities in the context of criminal or other similar procedures, where they must do so by law. Moreover, they may not protect confidentiality if persons who report breaches of Union law decide to make an external or public report, according to the provisions of L. 4990/2022.

In general terms, NDAs can be used and indeed are commonly used to keep the fact and substance of a workplace investigation confidential. However, NDAs will not be effective in preventing the disclosure of information which is in the public interest or is important for safeguarding public welfare in matters of health and safety. Further, several laws in Hong Kong provide that disclosures as a result of compliance with a requirement made by the relevant authorities will not be treated as a breach of any restriction imposed by contract or otherwise by law.[1]

Yes. While it is common for employees to be bound by general confidentiality obligations at the beginning of employment, it is advisable to reiterate such confidentiality obligations through NDAs during an investigation.

There is no legislation regarding NDAs, but there is a Bill before the legislature proposing to “restrict the use of non-disclosure agreements as they relate to incidents of workplace sexual harassment and discrimination”. It is currently at the report stage. Whether it passes remains to be seen, but there has in recent times been strong criticism of the use of NDAs to cover up matters that ought to be fully investigated and dealt with in an organisation.

Settlement agreements, however they arise, may include confidentiality clauses which may, depending on the terms of the agreement, extend to the fact and substance of an investigation, but as in the UK an employee's right to make a protected disclosure or report a criminal offence cannot be waived by signing an NDA.

Yes, in principle, NDAs can be used to keep the fact and substance of an investigation confidential, even if it is not strictly necessary (and not often done in our experience).

It is possible to use NDAs in investigations.

Yes, NDAs can be used for this purpose. However, employers in the Netherlands often rely on general confidentiality obligations that the relevant employee already has to adhere to vis-à-vis their employer, for example in the employment agreement or collective labour agreement, if applicable. It is good practice to reiterate the confidential nature of any interview and its contents, and the existence of the investigation as such, to avoid any alleged confusion as to the confidential nature of investigative procedures later on.

NDAs are usually part of an employee’s contract and, as such, create a contractual obligation between the parties privy to it. However, where the subject matter of an investigation borders on matters of a criminal nature, it might be impossible for parties to the NDA to continually uphold the obligation under the NDA because the parties have an obligation to the state to disclose facts of a criminal nature.

The practice of stipulating matters to ensure adherence to confidentiality is not uncommon. As such, NDAs are executed as a means of added protection for both the company and the employees involved.

Yes, but it may not stop the disclosure of information at the request of relevant law enforcement authorities.

Please see question 12 above. NDAs are not admissible.

Yes, NDAs can be used to keep the fact and substance of an investigation confidential. There are no express prohibitions against such NDAs under Singapore law. However, information or evidence covered by the NDA may still be discoverable in court or arbitration proceedings; and may also be subject to disclosure requests or directions by the police or statutory authorities, including the MOM.   

Some companies require an employee subject to investigation to sign an NDA or other similar documents (eg, a pledge of confidentiality) agreeing not to disclose information relating to the investigation to outside parties.

Yes. NDAs are the preferred instrument to ensure that employees conducting the investigation, as well as those who participate as witnesses or collaborators, will keep the enquiry and its existence confidential.

NDAs can be used for some investigations carried out in the private sector. However, under the Swedish Whistleblowing Act, a contract is void to the extent it retracts or restricts a person’s rights under the Swedish Whistleblowing Act. An NDA that restricts the right to report irregularities to authorities or the media would, therefore, typically be void.

In addition to the above-mentioned statutory confidentiality obligations, separate non-disclosure agreements can be signed. In an internal investigation, the employee should be expressly instructed to maintain confidentiality.

Non-disclosure agreements can be made between an employer and employees who are involved in an investigation. This may include investigators and witnesses, apart from the employee under investigation. This minimises the risk of information being leaked, which can affect all parties related to the workplace investigation. However, an NDA is not absolute means to prevent the disclosure of confidential information, as the court has the authority to compel disclosure.

It is crucial to keep the events and facts of a workplace investigation confidential for the integrity of the process. It may be necessary to consider appropriate confidentiality measures to protect the complainant, mitigate risks, and preserve evidence. Damage to the confidentiality of the case can prevent the investigation team from bringing the case to a correct and complete conclusion. Although the labour legislation imposes a general confidentiality obligation on employees, NDAs can still be used as supplementary documents that may emphasise the confidentiality obligations of employees in workplace investigations and provide additional contractual protections such as penalties if there is a breach.

Only to a limited extent. As a matter of law, NDAs cannot prevent a worker from making a protected disclosure, or reporting a crime to the police. As a matter of the regulatory obligations of solicitors, NDAs should not be used in other ways, including as a means of influencing the content of disclosures, or by using warranties, indemnities and clawback clauses in a way that is designed to, or has the effect of, improperly preventing or inhibiting permitted reporting or disclosures (see the SRA’s warning notice on the use of NDAs).

This is a fact-specific inquiry that depends on the specific circumstances and laws of the relevant state. In general, NDAs are frowned upon but can be used to an extent to keep certain facts and the substance of an investigation confidential. NDAs can never prevent employees from assisting in official agency investigations, however. NDAs also cannot lawfully prohibit employees from officially reporting illegal conduct by their employer.

Generally, NDAs can be used to keep the facts and substance of a workplace investigation confidential. There are no express prohibitions against such NDAs. However, there are cases set out under Decree No. 13/2023/ND-CP on personal data protection where personal data is allowed or required to be disclosed without the data subject’s consent, in instances that are necessary to serve the public interest or to protect the life and health of the data subject.

There are legal requirements related to the time you must keep certain employee records in Australia, such as pay slips and time sheets. However, there are no laws concerning disciplinary records.

Employers can rely on previous misconduct to justify an employee’s termination of employment where it can be shown it is part of a course of conduct. Accordingly, if complaints have been substantiated, and disciplinary action has been taken, these records should be maintained. However, if a significant period has elapsed since the misconduct, an employer should carefully consider whether it is appropriate to rely on this past behaviour to justify future disciplinary action for similar conduct.

Data protection law requires that personal data should not be kept longer than necessary for the purpose it was collected. Once the purpose of the internal investigation is fulfilled and the data is no longer needed, it should be deleted or anonymised. Regulations regarding this matter may also be subject to WCAs or internal policies. In any case, it is advisable to keep the results for as long as they may be needed in possible subsequent administrative or judicial proceedings.

According to the GDPR, personal data should only be stored for a proportionate amount of time. Usually, this means that it can be stored as long as it is relevant for the employment contract, and even afterwards, if there is a risk of legal proceedings (ie, regarding the dismissal of the employee).

The existence of the investigation should be kept on file for at least five years from the date of its conclusion. All information related to the investigation should be kept on file for the same period, but not on the employee’s record, to avoid the risk of accidental access by unauthorised individuals.

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

Please see question 7. The outcome of the investigation involving personal data may be retained only for as long as is necessary considering the purposes of the processing. In general, the retention of investigation-related data may be necessary while the investigation is still ongoing and even then the requirements of data minimization and accuracy should be considered. The data concerning the outcome of an investigation should be registered to the employee's record merely to the extent necessary in light of the employment relationship or potential disciplinary measures. In this respect, the applicable retention time depends on labour law-related rights and limitations, considering eg, the applicable periods for filing a suit.

If the outcome of the internal investigation has led to the sanctioning of an employee, this sanction may no longer be invoked to support a new sanction after three years. Moreover, under the GDPR principles, the duration of retention must be proportional to the use of the data. Therefore, the data must be retained only for a period that is “strictly necessary and proportionate”. If the employer wants to keep information about the investigation in the longer term, it is possible to archive the employee’s record even though the employer will no longer be able to use it against the employee after three years.

If there is no special statutory storage period (which is the case for investigative reports and findings), personal data may only be stored for as long as is necessary for the purposes for which they are collected. As soon as the data is no longer required, it must be deleted. In connection with workplace investigations, the question arises as to how this obligation to delete personal data relates to the company's corporate interests. From the company's perspective, there may well be legitimate interests that speak in favour of retaining existing data for as long as possible. Under the data protection regulations of the DSGVO and the BDSG, data can be stored for as long as it is required for the assertion, exercise or defence of (civil) legal claims. This means that the data can, in any event, be saved at least as long as any measures related to the workplace investigation have not yet been completed and any legal disputes have not yet been concluded.

Under the General Data Protection Regulation, employees’ personal details and information must be kept in the business records for as long as is necessary for the purposes of the employment relationship. Otherwise, stored data must be deleted. However, under L.4990/2022[14], reports remain in the relevant record for a reasonable and necessary time, and in any case until the completion of investigations or proceedings before the courts that have been initiated as a consequence of a complaint against the employee under investigation, the complainant or any third parties.

There is no legal requirement in Hong Kong on this. However, since the investigation records will likely contain personal data, employers should be mindful of the requirement under the PDPO that personal data should not be kept for longer than necessary.[1]

According to the Code of Practice on Human Resources Management published by the Privacy Commissioner for Personal Data, generally, employment data about an employee can be kept for the entire duration of his or her employment, plus a recommended period of no more than seven years after the employee leaves employment unless there is a subsisting reason that justifies a longer retention period. A longer retention period may be justified where there is ongoing litigation or a parallel investigation. Even where it is deemed necessary to retain the outcome of the investigation concerning a departed employee, the employer should ensure that other personal data on the employee’s record (that is unrelated to the purpose of retention) are erased after the expiry of the recommended retention period.

There is no statutory guidance on this. It is common for employers to retain details of disciplinary proceedings on an employee's record for the entire duration of their employment.

It is also advisable to retain the details of any investigations or disciplinary proceedings for at least three years after an individual has been dismissed on account of such proceedings, as this is the general limitation period for raising claims of unfair dismissal. In labour matters, courts in India often allow delays in filing suit after the limitation period, meaning organisations sometimes make a practical call to retain details of investigations and disciplinary proceedings for longer.

Irrespective of the outcome of the investigation, the fact that an employee was subject to an investigation is not the key issue. The key concern is whether any further action was taken as a result of the investigation. If a disciplinary process ensued, then it is the outcome of that disciplinary record and any subsequent appeal that would or would not be noted on an employee's record. If a disciplinary sanction were imposed then the length of time the sanction remains on the employee's record would depend on what is specified in the disciplinary policy.

The employer would normally keep the outcomes of the investigation for the entire duration of the employment relationship with the involved employee.

After the termination of the employment relationship, it appears reasonable to conclude that the employer would be entitled to retain this information for the time necessary to exercise its defence rights in litigation (taking into account that 10 years is the statute of limitations for contractual liability). Further requirements or restrictions under general privacy laws (and particularly the GDPR) should also be checked.

According to Art. 14 WB Decree, internal and external whistleblowing reports (including related documents) must be kept for as long as necessary for report processing, but no more than five years from the date of transmission of the procedure's final outcome.

Records related to responses to whistleblowing must be kept for an appropriate period, but there is no legal stipulation on the retention period. Each entity is required to set an appropriate period after considering the need for evaluation and inspection, and the handling of individual cases. There is no legally stipulated retention period for other investigation results.

The outcomes are usually kept in the records until termination of the employment agreement and only deleted when personal records are deleted.

The law does not provide for the time the outcome of the investigation may remain on the employee’s record. However, this will depend on the employer’s record-retention policies, which must comply with applicable data protection laws.

The outcome of the investigation should only remain on the employee’s record for as long as is necessary, but shall not be less than three years as this is the record-keeping requirement under the Philippine Labor Code. If circumstances deem that such a report ceases to have any purpose whatsoever, it should be struck out of the employee’s record.

Neither Polish law nor the Draft Law specifically provide for a mandatory period during which the outcome of the investigation should be kept on the employee’s record.

At the same time, the Draft Law indicates that the register of whistleblowing reports, which should also contain information about follow-up actions undertaken as a result of the report, should be kept for 15 months starting from the end of the calendar year in which the follow-up actions have been completed, or the proceedings initiated by those actions have been terminated.

Also, while determining how long the outcome of an internal investigation should be kept, additional legal considerations can be taken into account, especially data privacy.

The GDPR does not specify precise storage time for personal data. The employer must assess what will be an appropriate time for storage of the data, taking into consideration the necessity of keeping personal data concerning the purpose of the processing in question. Employees' personal data should be kept for the period necessary for the performance of the employment relationship and may be kept for a period appropriate for the statute of limitations for claims and criminal deeds. A longer retention period may result from applicable laws. Following the Regulation of the Minister of Family, Labour and Social Policy on employee documentation, the employer may keep a copy of the notice of punishment and other documents related to the employee’s incurring of disciplinary responsibility in the employee record.

There are different retention periods for the data contained in employee files:

• 10 years if the employee was hired on or after 1 January 2019;
•  if the employment relationship began between 1 January 1999 and 1 January 2019, the retention period is 50 years, but may be reduced to 10 years if the employer provides the Polish Social Insurance Institution with certain mandatory information; and
•  for 50 years if the employee was hired before 1 January 1999. It does not matter whether the person is still working or not.

There are no specific rules in the Portuguese Labour Code on this matter.

However, article 332 of the PLC states that the employer should keep an updated record of disciplinary sanctions, so the competent authorities can easily verify compliance with applicable provisions. Accordingly, it is advisable to maintain a record of disciplinary sanctions during the entire employment relationship.

Also, please note that some collective bargaining agreements state that the disciplinary register must be deleted from the employee’s record periodically.

This depends on the company’s internal disciplinary policy and the severity of the offence. For instance, a written warning issued against an employee for minor misconduct is usually kept in the respondent employee’s file for one year and if the employee does not commit any further breaches during this time, the written warning will be expunged. However, if there is a finding of serious misconduct, particularly if such a determination results in the dismissal of the employee, these records are generally kept in the employee’s file for the duration of time such records are statutorily required to be maintained.  

There is no legal requirement on how long the records of the investigation (eg disciplinary action) should be maintained by the company. Many companies maintain a record of disciplinary action throughout the employment period.

The outcome of the investigation will contain personal data of the affected employee. For this reason, this information should only be kept for as long as a legal obligation or liability in connection with the information could arise for the company. Since the general statute of limitations for employment liability is one year, this is a good guideline.

In addition to the above, two specific rules apply:

• once the information becomes irrelevant for the purpose for which it was obtained and processed, the information should no longer be stored on the employee’s record or elsewhere; and
• the employees’ information (including those of the reporter and the affected employees) should only be stored in whistleblower systems during the time that is necessary to decide on whether the facts need to be investigated or not and, in any case, for a maximum period of three months.

Under the GDPR personal data may not, according to the general principle on storage limitation, be retained for longer than is necessary for the purposes for which the personal data are processed. The GDPR does not stipulate a generally applicable storage limitation period. Such a regulation is, on the other hand, included in the Swedish Whistleblowing Act. If the Swedish Whistleblowing Act applies, the outcome of the investigation and all personal data should be retained for as long as necessary, but not for longer than two years after the investigation has been closed.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]

There is no period required by law for keeping the outcome of the investigation on the employee’s record. However, if termination of employment is the outcome of the investigation, an employer should keep details of the investigation for at least 10 years, in line with the prescribed period for an employee to file an unfair dismissal claim against an employer. An employer may use the details of an investigation to defend such a claim. For other disciplinary action, the retention of investigation details on the employee’s record is at the employer’s discretion.

There is no provision in the legislation setting forth a specific duration for keeping the outcome of the investigation findings in personnel files. However, based on general principles, the outcome of the investigation can remain on the employee’s personnel files as long as the employer has a lawful interest in such processing without unnecessarily harming the privacy rights of the employee.

The investigation outcome may not need to be noted on the accused employee’s record at all. Usually only the outcome of any subsequent disciplinary or grievance process would be noted, rather than the prior investigation.

The employer should keep the investigation report for as long as it remains relevant. This would usually be no longer than six years, unless regulatory obligations dictate otherwise. The report along with all documentation and witness statements gathered during the investigation should be retained securely and confidentially but for no longer than is absolutely necessary under the requirements of the DPA 2018 and the employer's data protection policies and procedures. There may be additional retention requirements in a regulated context; the position for each particular business and employee should be checked.

There is no requirement for the results of a workplace investigation to remain on an employee’s record for any specific period. It is often helpful, however, for information relating to the outcome of such an investigation (regardless of whether the allegations are substantiated) to be accessible to the human resources or legal functions such that during the initial complaint intake process described above, any prior complaints and investigations relating to the same individual or group of individuals can be taken into account to identify any recurring issues or systemic violations.

Vietnamese law does not provide for a period during which the outcome of the investigation should remain on the employee’s records and files. However, this will depend on the employer’s record-retention policies, which must comply with applicable data protection laws.