Internal investigations – Comprehensive planning and preparation is essential

von Nadja-Maria

It happens in the best companies that employees are suspected of misconduct. This becomes particularly relevant as soon as there is a suspicion of a criminal offense or other serious misconduct in the employment relationship.

There is then no doubt that the company has a justifiable interest in clarifying the suspicion internally and, if the suspicion is substantiated, also in initiating appropriate (labor law) measures.

Observe data protection

As soon as the processing of personal data is associated with the internal investigations, the requirements of data protection law must also be observed here. It is particularly important to be able to demonstrate a legal basis for each step of the data processing in accordance with Art. 6 of the GDPR or § 26 of the BDSG, insofar as the persons affected are employees, and to document this completely.

Evidence in court?

The conclusion of the internal investigation is often followed by a judicial clarification of the facts. Be it that the employee takes legal action against a dismissal or that he disputes the liability for financial damages in court.

For this reason, internal investigations must always be designed in such a way that the evidence found can also be used in court and is not excluded on the basis of any prohibitions on the use of evidence.

Rights of the person concerned

It should also be remembered that the data subject also has judicial and extrajudicial options to influence the investigation or to obtain information about the status of the investigation. In addition to the right to inspect the personnel file, the right to information pursuant to Art. 15 GDPR should also be mentioned here, which can also be applied in such a situation.

Third party interests

In the case of more serious incidents, the investigation may not remain a purely internal matter for the company. If, for example, the facts constitute a reportable data breach pursuant to Art. 33 GDPR, the competent data protection supervisory authority must also be involved in good time. If the triggering suspicion is relevant under criminal law, state authorities can also initiate their own investigations. In addition, aggrieved persons may file civil claims against the company. It is also possible that the facts of the case will be picked up in press reports.

Comprehensive planning required

This brief description already shows that a large number of interests and specifications must be taken into account in internal investigations. Internal investigations cannot therefore be carried out satisfactorily without comprehensive planning that takes the above points into account. In order to be prepared in the event of an emergency, we recommend planning the necessary steps in advance with all relevant internal units and drafting a standard process for internal investigations.

We will be happy to support you with any questions you may have about data protection. Simply call us at our headquarters in Hutthurm at +49 (0) 8505 91927 – 0 or at our branch office in Munich at +49 (0) 89 413 2943 – 0 or use our contact form.


Nadja-Maria leitet unser Inhouse-Juristen-Team. Sie studierte an der Universität Passau Rechtswissenschaften mit anschließendem Referendariat sowie erstem und zweitem Staatsexamen. Ihr Spezialgebiet ist Datenschutzrecht. Ihr fundiertes Wissen hält sie jederzeit aktuell. Für unsere Kunden und unser Team hat sie so immer einen Rat für eine passgenaue Lösung parat.

Schlagworte: GDPR, Data protection