Workplace Investigations

Non-disclosure agreements, also known as confidentiality agreements, can be used to maintain the confidentiality of the investigation. In this agreement, the employee will be directed to maintain confidentiality concerning the investigation and matters that are the subject of the investigation, and not speak to anyone outside the investigation team about the investigation without authorisation.

Confidentiality agreements are legal documents. Employees should be informed that a breach of the confidentiality agreement could result in disciplinary action being taken against them, up to and including termination of their employment.  

According to section 6(1) of the DSG, employees who have access to personal data in the course of their professional activities must maintain data confidentiality and continue to do so even after termination of their employment.

Non-disclosure agreements can generally be used to achieve this but are subject to certain restrictions. They may not be used to conceal criminal activity, violate the privacy rights of individuals, circumvent legal disclosure obligations, prevent the exercise of legal rights or contain clauses that violate existing laws, in particular data protection regulations.

In principle this is possible. However, these NDAs do have their limits and cannot prevent involved persons from, for example, bringing a legal claim or filing a report if they are legally entitled to do so. Under whistleblower rules, a reporter can even publish his or her complaint under certain circumstances.

Yes, NDAs may be executed to reinforce the confidentiality obligations outlined in the company's policies and reinforced in interviews.

Yes. In practice, before conducting a compliance investigation, we recommend that the employer and the investigator enter into a confidentiality agreement to require the investigator to keep confidential the facts and the substance of the investigation. This will not only better protect the personal information of the complainant, the witness and the investigated employee, but also help the investigation to proceed smoothly.

Yes, however, the need for an NDA is assessed always on a case-by-case basis.

Most of the time, the legal protection afforded by the legally prescribed confidentiality obligation that applies to whistleblowing is sufficient. This is all the more so given every person involved is bound by an obligation of discretion. However, there is no legal obstacle to the creation of an NDA between the employer and the people involved.

NDAs setting out a strict and reinforced obligation of confidentiality and discretion during the investigation should be signed by any external parties involved (eg, translation agency, IT expert) or when the internal investigation is outside the scope of whistleblowing regulations.

In principle, it is possible to conclude non-disclosure agreements with external consultants of the investigation or with employees involved in the investigation. However, regarding external lawyers, a non-disclosure agreement is not necessary since lawyers are already subject to professional confidentiality. Concerning employees, it is rare in Germany to conclude confidentiality agreements in connection with a workplace investigation.

NDAs are an option, especially to outline in detail the obligations of the persons conducting the investigation, which is also provided for in law. On the other hand, NDAs will not prevent persons involved from providing information to the competent authorities in the context of criminal or other similar procedures, where they must do so by law. Moreover, they may not protect confidentiality if persons who report breaches of Union law decide to make an external or public report, according to the provisions of L. 4990/2022.

In general terms, NDAs can be used and indeed are commonly used to keep the fact and substance of a workplace investigation confidential. However, NDAs will not be effective in preventing the disclosure of information which is in the public interest or is important for safeguarding public welfare in matters of health and safety. Further, several laws in Hong Kong provide that disclosures as a result of compliance with a requirement made by the relevant authorities will not be treated as a breach of any restriction imposed by contract or otherwise by law.[1]

Yes. While it is common for employees to be bound by general confidentiality obligations at the beginning of employment, it is advisable to reiterate such confidentiality obligations through NDAs during an investigation.

There is no legislation regarding NDAs, but there is a Bill before the legislature proposing to “restrict the use of non-disclosure agreements as they relate to incidents of workplace sexual harassment and discrimination”. It is currently at the report stage. Whether it passes remains to be seen, but there has in recent times been strong criticism of the use of NDAs to cover up matters that ought to be fully investigated and dealt with in an organisation.

Settlement agreements, however they arise, may include confidentiality clauses which may, depending on the terms of the agreement, extend to the fact and substance of an investigation, but as in the UK an employee's right to make a protected disclosure or report a criminal offence cannot be waived by signing an NDA.

Yes, in principle, NDAs can be used to keep the fact and substance of an investigation confidential, even if it is not strictly necessary (and not often done in our experience).

It is possible to use NDAs in investigations.

Yes, NDAs can be used for this purpose. However, employers in the Netherlands often rely on general confidentiality obligations that the relevant employee already has to adhere to vis-à-vis their employer, for example in the employment agreement or collective labour agreement, if applicable. It is good practice to reiterate the confidential nature of any interview and its contents, and the existence of the investigation as such, to avoid any alleged confusion as to the confidential nature of investigative procedures later on.

NDAs are usually part of an employee’s contract and, as such, create a contractual obligation between the parties privy to it. However, where the subject matter of an investigation borders on matters of a criminal nature, it might be impossible for parties to the NDA to continually uphold the obligation under the NDA because the parties have an obligation to the state to disclose facts of a criminal nature.

The practice of stipulating matters to ensure adherence to confidentiality is not uncommon. As such, NDAs are executed as a means of added protection for both the company and the employees involved.

Yes, but it may not stop the disclosure of information at the request of relevant law enforcement authorities.

Please see question 12 above. NDAs are not admissible.

Yes, NDAs can be used to keep the fact and substance of an investigation confidential. There are no express prohibitions against such NDAs under Singapore law. However, information or evidence covered by the NDA may still be discoverable in court or arbitration proceedings; and may also be subject to disclosure requests or directions by the police or statutory authorities, including the MOM.   

Some companies require an employee subject to investigation to sign an NDA or other similar documents (eg, a pledge of confidentiality) agreeing not to disclose information relating to the investigation to outside parties.

Yes. NDAs are the preferred instrument to ensure that employees conducting the investigation, as well as those who participate as witnesses or collaborators, will keep the enquiry and its existence confidential.

NDAs can be used for some investigations carried out in the private sector. However, under the Swedish Whistleblowing Act, a contract is void to the extent it retracts or restricts a person’s rights under the Swedish Whistleblowing Act. An NDA that restricts the right to report irregularities to authorities or the media would, therefore, typically be void.

In addition to the above-mentioned statutory confidentiality obligations, separate non-disclosure agreements can be signed. In an internal investigation, the employee should be expressly instructed to maintain confidentiality.

Non-disclosure agreements can be made between an employer and employees who are involved in an investigation. This may include investigators and witnesses, apart from the employee under investigation. This minimises the risk of information being leaked, which can affect all parties related to the workplace investigation. However, an NDA is not absolute means to prevent the disclosure of confidential information, as the court has the authority to compel disclosure.

It is crucial to keep the events and facts of a workplace investigation confidential for the integrity of the process. It may be necessary to consider appropriate confidentiality measures to protect the complainant, mitigate risks, and preserve evidence. Damage to the confidentiality of the case can prevent the investigation team from bringing the case to a correct and complete conclusion. Although the labour legislation imposes a general confidentiality obligation on employees, NDAs can still be used as supplementary documents that may emphasise the confidentiality obligations of employees in workplace investigations and provide additional contractual protections such as penalties if there is a breach.

Only to a limited extent. As a matter of law, NDAs cannot prevent a worker from making a protected disclosure, or reporting a crime to the police. As a matter of the regulatory obligations of solicitors, NDAs should not be used in other ways, including as a means of influencing the content of disclosures, or by using warranties, indemnities and clawback clauses in a way that is designed to, or has the effect of, improperly preventing or inhibiting permitted reporting or disclosures (see the SRA’s warning notice on the use of NDAs).

This is a fact-specific inquiry that depends on the specific circumstances and laws of the relevant state. In general, NDAs are frowned upon but can be used to an extent to keep certain facts and the substance of an investigation confidential. NDAs can never prevent employees from assisting in official agency investigations, however. NDAs also cannot lawfully prohibit employees from officially reporting illegal conduct by their employer.

Generally, NDAs can be used to keep the facts and substance of a workplace investigation confidential. There are no express prohibitions against such NDAs. However, there are cases set out under Decree No. 13/2023/ND-CP on personal data protection where personal data is allowed or required to be disclosed without the data subject’s consent, in instances that are necessary to serve the public interest or to protect the life and health of the data subject.

If a respondent raises a grievance during the investigation this should be dealt with under any employment contract, grievance policy or industrial instrument. This may involve investigating and responding accordingly. The content of the grievance should be carefully considered, but in many circumstances it is appropriate for the initial investigation to continue. Multiple investigations can be run simultaneously.

Provided the employer complies with labour law and data protection regulations, internal investigations are lawful and are not regarded as administrative or judicial proceedings. If legal consequences for not cooperating, such as dismissal, are threatened by the employer or his investigators, the offence of coercion under section 105 of the Austrian Criminal Code could be fulfilled.

This will depend on where the employee raises a grievance and the content of the grievance. If it is against the employer, the investigation can take this into account and continue from there. If the grievance is raised against the authorities, it will depend on the steps taken by the authorities.

If the object of the grievance is connected to the ongoing investigation, the investigator may pursue that grievance within the same procedure or open a separate matter, under the company’s rules governing such a situation.

If the object of the grievance is not connected to the investigation, the employee must report the matter, or the investigator can do it, if the company’s policies allow it.

There is no specific provision on this in relevant laws and regulations in the PRC. In practice, the employer will usually stipulate the relevant grievance procedure and process in its internal rules and regulations, and provide the employee with the relevant grievance rights in accordance with the grievance regulations. Alternatively, even if there is no provision on grievance procedure and process in their internal rules and regulations, from the perspective of fairness and rationality, we recommend that the employer should review and evaluate the grievance raised by the employee. If it is confirmed that irregularities exist in the investigation, which may directly affect the conclusions of the investigation (e.g. a past conflict between the employee and the investigator or the employee was unfairly treated in the investigation), the employer shall suspend the investigation and resume the investigation after timely resolution of such complaint. If the grievance does not affect the normal conduct of the investigation, the employer can still proceed with the investigation.

If the nature of the grievance relates to the employer's obligations to handle such matters in general, the grievance will be investigated either separately or as a part of the ongoing investigation.

The grievance may also have to be investigated (eg, moral/sexual harassment reported by an employee under investigation).

As seen in question 6, the employee must participate in interviews requested by the employer under certain circumstances. Generally, the employee must provide truthful information even if it is incriminating.

The raising of a grievance by the employee does not directly affect the workplace investigation (ie, the investigation does not have to be stopped and the employee's obligation to provide truthful information continues). This may change, however, once the court decides that certain measures were conducted unlawfully and must, therefore, cease.

Employees under investigation frequently raise grievances during investigation procedures that are dealt with on a case-by-case basis. The grievances raised by the employee under investigation are examined by the employees responsible for the investigation. They may either pause the relevant proceedings and review the grievance, especially if the claims of the employee under investigation are linked to a breach of his or her data or hearing rights, or they may continue the investigation.

As discussed in question 11, an employer owes an implied obligation of trust and confidence towards its employees under common law. This means that an employer cannot disregard a genuine complaint made by an employee even if the employee is under internal investigation. The employer may have put in place an employee grievance handling policy, which should be followed when handling the employee’s grievance.

If the grievance raised relates to how the workplace investigation is being conducted (for example, it is alleged that the investigator has a conflict of interest or is biased), the employer should consider suspending the investigation until this grievance is properly addressed to ensure fairness. However, if the grievance is nothing but an attempt to delay or hinder the investigation, the employer may be entitled to proceed with the investigation regardless. The employer should therefore carefully assess the nature and validity of any grievance raised in each case. The employer should also consider its rights under the employment contract if the employee is being uncooperative or obstructive.

Indian labour statutes do not prescribe any particular process to be followed if the accused raises any grievances during the investigation and such situations would need to be dealt with on a case-by-case basis. For example, if the grievances relate to the fairness of the investigation or inquiry process, the lack of impartiality of the investigators or the inquiry officer, those may need to be addressed upfront before proceeding further. Where grievances may be unrelated to the investigation or inquiry at hand (and potentially also a method to distract the employer from the core issues or delay or confuse the main investigative proceedings), it may be advisable to communicate to the employee that such grievances will have to be dealt with separately and other safeguards adopted to avoid calling the main investigation or inquiry proceedings into question (eg identifying an independent team to review the grievances).   

If the subject of the grievance relates to the subject of the investigation, the employee should be reassured that all the matters that they wish to raise concerning the matter under investigation will be dealt with in full as part of the investigation.

If the employee raises a grievance that is unrelated to the matter under investigation, then that can be dealt with concurrently, albeit by a separate investigator.

The initial investigation does not automatically need to be halted upon receipt of a grievance. Frequently, grievances are submitted in the hope that they derail or delay the original investigation. Careful consideration should be given as to the nature of the grievance and the appropriate course of action adopted.

Generally speaking, grievances from the employee do not per se automatically entail an interruption of the investigation. This conclusion, however, should be double-checked on a case-by-case basis, depending on what kind of grievance the employee under investigation raises, and on the potential effect of that grievance (if grounded): for example, should the grievance concern alleged unlawful processing of personal data, the employer could consider suspending the investigation while checking if the grievance has grounds, to avoid collecting data that cannot be used.

Grievances may be raised “internally” vis-à-vis the employer, possibly through procedures regulated by internal policies or codes (including, for example, whistleblowing procedures), if any, or brought to external authorities (which, depending on the kind of issue, could be a labour court, the Data Privacy Authority, law enforcement authorities, etc).

Whether or not an investigation should be suspended when an employee under investigation files a complaint depends on the specific circumstances. There is no legal requirement to suspend the investigation.

There are a lot of possibilities for grievances that employees can raise during an investigation. A grievance, for instance, could be that a certain person is not interviewed, while the employee wanted this person to be interviewed in order to have a thorough investigation. In such a case the investigator needs to assess this grievance.

There is no general rule how to react to a grievance and there is also no general obligation to respond to a grievance. There needs to be a case by case assessment based on which further action is or isn't needed.

It is not unusual for an employee under investigation to raise a grievance during the investigation. This grievance may be on the same subject matter as the complaint being investigated or may disclose new facts outside the scope of the matter being investigated.

Where the issue discloses new facts, the employer is required to investigate those facts without suspending the investigation. However, where the grievance relates to the same subject matter as the complaint being investigated, the employer may either suspend the investigation to allow the investigation to recognise the grievance and the complaint against the employer or proceed with the investigation while noting that the matter disclosed is being or will be investigated.

If an employee under investigation raises a grievance during an ongoing investigation, the employer must ensure that the employee under investigation is treated reasonably and fairly. Thus, the employer must also give attention to the complaint made by the employee and determine if there are reasonable grounds for the concern of the employee. If the employer determines the validity of the grievance raised, the employer may conduct a separate investigation for it.

It depends on the internal policies in force in the organisation. Most often, it constitutes the basis for separate proceedings.

Grievance procedures are not specifically provided for under Portuguese law. There is no formal procedure for an employee to raise a complaint against the employer. Nonetheless, a potential claim brought by the employee under investigation and subject to a disciplinary procedure should not have any impact.

The employer should require the employee to raise the grievance under the company’s existing grievance reporting, disciplinary and investigation processes so that the grievance, to the extent that it is relevant to the current investigation, can be investigated together. Otherwise, the grievance can be dealt with separately and independently of the existing investigation.

It is not uncommon for an employee under investigation to raise grievances during or after the investigation. Below are some examples of claims an employee may raise:

• that the company reviewed the employee’s electronic data without obtaining the requisite consent;
• that witnesses or the company committed defamation in violation of the Criminal Code;
• that the employee was coerced to comply with the investigation in violation of the Criminal Code;
• that the employee was disciplined without just cause; or
• that the employee was harassed by other employees for providing information during the investigation.

The actions the company should take would vary depending on the grievance raised.

Spanish law does not regulate grievance processes and most companies do not have an internal grievance procedure. The only way in which an employee can formally challenge an investigation is by filing a lawsuit or lodging a claim with the Labour Inspectorate (see question 5).

To the extent that the company can show that the investigation is unrelated to the complaint (ie, that the investigation is not retaliation for filing the complaint), the claim should be seen as neutral from the perspective of the enquiry.

There are no formal rules or processes for handling grievances in Sweden. Depending on the nature of the grievance, such a complaint may also have to be investigated (unless the grievance is deemed to be trivial). This could, for example, be the case if the grievance concerns new or other work environment issues that the employer is obliged to investigate.

In the context of private internal investigations, grievances initially raised by the employee do not usually have an impact on the investigation.

However, if the employer terminates the employment contract due to a justified legal complaint raised by an employee, a court might consider the termination to be abusive and award the employee compensation in an amount to be determined by the court but not exceeding six months’ pay for the employee (article 336 paragraph 1 (lit. b) and article 337c paragraph 3, Swiss Code of Obligations). Furthermore, a termination by the employer may be challenged if it takes place without good cause following a complaint of discrimination by the employee to a superior or the initiation of proceedings before a conciliation board or a court by the employee (article 10, Federal Act on Gender Equality).

The investigator should guide the employee who has raised the grievance to properly raise their concerns through the grievance protocols or whistleblowing policy (if any). It is acceptable to preliminarily hear their concerns, but the investigation should be initiated separately and subject to the employer’s discretion.

If, during the investigation, the employee under investigation raises a grievance, the investigator will be expected to temporarily stop the investigation to assess the situation. The investigation team will evaluate whether the employee is raising a grievance as a defence mechanism or in good faith and with sincere concerns. If the subject of the grievance is related to the pending investigation, the investigation may be extended to cover this new item. Otherwise, a new investigation can be initiated by the investigation team.

This is a relatively common tactic. The employer will need to decide whether to suspend the investigation to deal with the grievance, or conclude the investigation first, depending on the circumstances. It would usually be difficult to deal with both the grievance and the investigation concurrently, unless the facts overlap significantly.

If the employee becomes uncooperative and refuses to take part in the investigation, they should be told that the investigator may need to make a decision in the absence of their account based on all the other evidence available. The employer may decide to treat it as failure to comply with a reasonable management instruction and take disciplinary action on that basis.

Where an employee who is the subject of a workplace investigation raises his or her grievance during the investigation, the investigator should follow the same steps outlined above to triage new issues or claims. The investigator should also discuss with in-house counsel whether any particular steps should be taken to avoid the perception that any disciplinary measures taken against the employee (in the event the original claims are substantiated) were retaliatory.

The employer should require the employee to raise any grievance under the company’s existing policy on grievance reporting, disciplinary, and investigation processes, so that it can determine if the grievance is relevant to the current investigation. The grievance can be investigated together with the ongoing investigation. It can also be dealt with separately and independently from the existing investigation.

There are legal requirements related to the time you must keep certain employee records in Australia, such as pay slips and time sheets. However, there are no laws concerning disciplinary records.

Employers can rely on previous misconduct to justify an employee’s termination of employment where it can be shown it is part of a course of conduct. Accordingly, if complaints have been substantiated, and disciplinary action has been taken, these records should be maintained. However, if a significant period has elapsed since the misconduct, an employer should carefully consider whether it is appropriate to rely on this past behaviour to justify future disciplinary action for similar conduct.

Data protection law requires that personal data should not be kept longer than necessary for the purpose it was collected. Once the purpose of the internal investigation is fulfilled and the data is no longer needed, it should be deleted or anonymised. Regulations regarding this matter may also be subject to WCAs or internal policies. In any case, it is advisable to keep the results for as long as they may be needed in possible subsequent administrative or judicial proceedings.

According to the GDPR, personal data should only be stored for a proportionate amount of time. Usually, this means that it can be stored as long as it is relevant for the employment contract, and even afterwards, if there is a risk of legal proceedings (ie, regarding the dismissal of the employee).

The existence of the investigation should be kept on file for at least five years from the date of its conclusion. All information related to the investigation should be kept on file for the same period, but not on the employee’s record, to avoid the risk of accidental access by unauthorised individuals.

The relevant laws and regulations in the PRC have not clarified the retention period of the investigation findings. According to Article 19 of the Personal Information Protection Law of the PRC, unless otherwise required by laws or administrative regulations, the retention period of personal information shall be the shortest period necessary to achieve the purpose of handling the information. Since the employee's personal information is very likely to be involved in the investigation findings, such report should be retained for the shortest period necessary to achieve the purpose of handling the information. In general, once the investigation is completed, the purpose of the internal investigation has been achieved or it is no longer necessary to achieve the purpose, and the employer may, in accordance with Article 22 of the Administrative Regulations of the PRC on Network Data Security (Draft for Comments), delete or anonymize the personal information within fifteen (15) working days. If it is technically difficult to delete the personal information, or it is difficult to do so within fifteen (15) working days due to business complexity or other reasons, the employer shall not conduct any processing other than storing the personal information and adopting necessary security measures, and shall give reasonable explanations to the employee.

Please see question 7. The outcome of the investigation involving personal data may be retained only for as long as is necessary considering the purposes of the processing. In general, the retention of investigation-related data may be necessary while the investigation is still ongoing and even then the requirements of data minimization and accuracy should be considered. The data concerning the outcome of an investigation should be registered to the employee's record merely to the extent necessary in light of the employment relationship or potential disciplinary measures. In this respect, the applicable retention time depends on labour law-related rights and limitations, considering eg, the applicable periods for filing a suit.

If the outcome of the internal investigation has led to the sanctioning of an employee, this sanction may no longer be invoked to support a new sanction after three years. Moreover, under the GDPR principles, the duration of retention must be proportional to the use of the data. Therefore, the data must be retained only for a period that is “strictly necessary and proportionate”. If the employer wants to keep information about the investigation in the longer term, it is possible to archive the employee’s record even though the employer will no longer be able to use it against the employee after three years.

If there is no special statutory storage period (which is the case for investigative reports and findings), personal data may only be stored for as long as is necessary for the purposes for which they are collected. As soon as the data is no longer required, it must be deleted. In connection with workplace investigations, the question arises as to how this obligation to delete personal data relates to the company's corporate interests. From the company's perspective, there may well be legitimate interests that speak in favour of retaining existing data for as long as possible. Under the data protection regulations of the DSGVO and the BDSG, data can be stored for as long as it is required for the assertion, exercise or defence of (civil) legal claims. This means that the data can, in any event, be saved at least as long as any measures related to the workplace investigation have not yet been completed and any legal disputes have not yet been concluded.

Under the General Data Protection Regulation, employees’ personal details and information must be kept in the business records for as long as is necessary for the purposes of the employment relationship. Otherwise, stored data must be deleted. However, under L.4990/2022[14], reports remain in the relevant record for a reasonable and necessary time, and in any case until the completion of investigations or proceedings before the courts that have been initiated as a consequence of a complaint against the employee under investigation, the complainant or any third parties.

There is no legal requirement in Hong Kong on this. However, since the investigation records will likely contain personal data, employers should be mindful of the requirement under the PDPO that personal data should not be kept for longer than necessary.[1]

According to the Code of Practice on Human Resources Management published by the Privacy Commissioner for Personal Data, generally, employment data about an employee can be kept for the entire duration of his or her employment, plus a recommended period of no more than seven years after the employee leaves employment unless there is a subsisting reason that justifies a longer retention period. A longer retention period may be justified where there is ongoing litigation or a parallel investigation. Even where it is deemed necessary to retain the outcome of the investigation concerning a departed employee, the employer should ensure that other personal data on the employee’s record (that is unrelated to the purpose of retention) are erased after the expiry of the recommended retention period.

There is no statutory guidance on this. It is common for employers to retain details of disciplinary proceedings on an employee's record for the entire duration of their employment.

It is also advisable to retain the details of any investigations or disciplinary proceedings for at least three years after an individual has been dismissed on account of such proceedings, as this is the general limitation period for raising claims of unfair dismissal. In labour matters, courts in India often allow delays in filing suit after the limitation period, meaning organisations sometimes make a practical call to retain details of investigations and disciplinary proceedings for longer.

Irrespective of the outcome of the investigation, the fact that an employee was subject to an investigation is not the key issue. The key concern is whether any further action was taken as a result of the investigation. If a disciplinary process ensued, then it is the outcome of that disciplinary record and any subsequent appeal that would or would not be noted on an employee's record. If a disciplinary sanction were imposed then the length of time the sanction remains on the employee's record would depend on what is specified in the disciplinary policy.

The employer would normally keep the outcomes of the investigation for the entire duration of the employment relationship with the involved employee.

After the termination of the employment relationship, it appears reasonable to conclude that the employer would be entitled to retain this information for the time necessary to exercise its defence rights in litigation (taking into account that 10 years is the statute of limitations for contractual liability). Further requirements or restrictions under general privacy laws (and particularly the GDPR) should also be checked.

According to Art. 14 WB Decree, internal and external whistleblowing reports (including related documents) must be kept for as long as necessary for report processing, but no more than five years from the date of transmission of the procedure's final outcome.

Records related to responses to whistleblowing must be kept for an appropriate period, but there is no legal stipulation on the retention period. Each entity is required to set an appropriate period after considering the need for evaluation and inspection, and the handling of individual cases. There is no legally stipulated retention period for other investigation results.

The outcomes are usually kept in the records until termination of the employment agreement and only deleted when personal records are deleted.

The law does not provide for the time the outcome of the investigation may remain on the employee’s record. However, this will depend on the employer’s record-retention policies, which must comply with applicable data protection laws.

The outcome of the investigation should only remain on the employee’s record for as long as is necessary, but shall not be less than three years as this is the record-keeping requirement under the Philippine Labor Code. If circumstances deem that such a report ceases to have any purpose whatsoever, it should be struck out of the employee’s record.

Neither Polish law nor the Draft Law specifically provide for a mandatory period during which the outcome of the investigation should be kept on the employee’s record.

At the same time, the Draft Law indicates that the register of whistleblowing reports, which should also contain information about follow-up actions undertaken as a result of the report, should be kept for 15 months starting from the end of the calendar year in which the follow-up actions have been completed, or the proceedings initiated by those actions have been terminated.

Also, while determining how long the outcome of an internal investigation should be kept, additional legal considerations can be taken into account, especially data privacy.

The GDPR does not specify precise storage time for personal data. The employer must assess what will be an appropriate time for storage of the data, taking into consideration the necessity of keeping personal data concerning the purpose of the processing in question. Employees' personal data should be kept for the period necessary for the performance of the employment relationship and may be kept for a period appropriate for the statute of limitations for claims and criminal deeds. A longer retention period may result from applicable laws. Following the Regulation of the Minister of Family, Labour and Social Policy on employee documentation, the employer may keep a copy of the notice of punishment and other documents related to the employee’s incurring of disciplinary responsibility in the employee record.

There are different retention periods for the data contained in employee files:

• 10 years if the employee was hired on or after 1 January 2019;
•  if the employment relationship began between 1 January 1999 and 1 January 2019, the retention period is 50 years, but may be reduced to 10 years if the employer provides the Polish Social Insurance Institution with certain mandatory information; and
•  for 50 years if the employee was hired before 1 January 1999. It does not matter whether the person is still working or not.

There are no specific rules in the Portuguese Labour Code on this matter.

However, article 332 of the PLC states that the employer should keep an updated record of disciplinary sanctions, so the competent authorities can easily verify compliance with applicable provisions. Accordingly, it is advisable to maintain a record of disciplinary sanctions during the entire employment relationship.

Also, please note that some collective bargaining agreements state that the disciplinary register must be deleted from the employee’s record periodically.

This depends on the company’s internal disciplinary policy and the severity of the offence. For instance, a written warning issued against an employee for minor misconduct is usually kept in the respondent employee’s file for one year and if the employee does not commit any further breaches during this time, the written warning will be expunged. However, if there is a finding of serious misconduct, particularly if such a determination results in the dismissal of the employee, these records are generally kept in the employee’s file for the duration of time such records are statutorily required to be maintained.  

There is no legal requirement on how long the records of the investigation (eg disciplinary action) should be maintained by the company. Many companies maintain a record of disciplinary action throughout the employment period.

The outcome of the investigation will contain personal data of the affected employee. For this reason, this information should only be kept for as long as a legal obligation or liability in connection with the information could arise for the company. Since the general statute of limitations for employment liability is one year, this is a good guideline.

In addition to the above, two specific rules apply:

• once the information becomes irrelevant for the purpose for which it was obtained and processed, the information should no longer be stored on the employee’s record or elsewhere; and
• the employees’ information (including those of the reporter and the affected employees) should only be stored in whistleblower systems during the time that is necessary to decide on whether the facts need to be investigated or not and, in any case, for a maximum period of three months.

Under the GDPR personal data may not, according to the general principle on storage limitation, be retained for longer than is necessary for the purposes for which the personal data are processed. The GDPR does not stipulate a generally applicable storage limitation period. Such a regulation is, on the other hand, included in the Swedish Whistleblowing Act. If the Swedish Whistleblowing Act applies, the outcome of the investigation and all personal data should be retained for as long as necessary, but not for longer than two years after the investigation has been closed.

From an employment law point of view, there is no statute of limitations on the employee's violations. Based on the specific circumstances (eg, damage incurred, type of violation, basis of trust or the position of the employee), a decision must be made as to the extent to which the outcome should remain on the record.

From a data protection point of view, only data that is in the interest of the employee (eg, to issue a reference letter) may be retained during the employment relationship. In principle, stored data must be deleted after the termination of the employment relationship. Longer retention may be justified if rights are still to be safeguarded or obligations are to be fulfilled in the future (eg, data needed regarding foreseeable legal proceedings, data required to issue a reference letter or data in relation to a non-competition clause).[1]

There is no period required by law for keeping the outcome of the investigation on the employee’s record. However, if termination of employment is the outcome of the investigation, an employer should keep details of the investigation for at least 10 years, in line with the prescribed period for an employee to file an unfair dismissal claim against an employer. An employer may use the details of an investigation to defend such a claim. For other disciplinary action, the retention of investigation details on the employee’s record is at the employer’s discretion.

There is no provision in the legislation setting forth a specific duration for keeping the outcome of the investigation findings in personnel files. However, based on general principles, the outcome of the investigation can remain on the employee’s personnel files as long as the employer has a lawful interest in such processing without unnecessarily harming the privacy rights of the employee.

The investigation outcome may not need to be noted on the accused employee’s record at all. Usually only the outcome of any subsequent disciplinary or grievance process would be noted, rather than the prior investigation.

The employer should keep the investigation report for as long as it remains relevant. This would usually be no longer than six years, unless regulatory obligations dictate otherwise. The report along with all documentation and witness statements gathered during the investigation should be retained securely and confidentially but for no longer than is absolutely necessary under the requirements of the DPA 2018 and the employer's data protection policies and procedures. There may be additional retention requirements in a regulated context; the position for each particular business and employee should be checked.

There is no requirement for the results of a workplace investigation to remain on an employee’s record for any specific period. It is often helpful, however, for information relating to the outcome of such an investigation (regardless of whether the allegations are substantiated) to be accessible to the human resources or legal functions such that during the initial complaint intake process described above, any prior complaints and investigations relating to the same individual or group of individuals can be taken into account to identify any recurring issues or systemic violations.

Vietnamese law does not provide for a period during which the outcome of the investigation should remain on the employee’s records and files. However, this will depend on the employer’s record-retention policies, which must comply with applicable data protection laws.