Internal Investigations

Internal investigations in Germany: when and why

Internal investigations are fact-finding exercises that a company carries out, usually with external lawyers and forensic specialists, when there are indications of misconduct such as bribery, fraud, cartel conduct, sanctions breaches, accounting irregularities or harassment. In Germany, the duty to investigate follows from management's duty of care and from the supervisory duty in § 130 of the Administrative Offences Act (OWiG): once management learns of concrete indications of a breach, it must clarify the facts, stop ongoing misconduct, remedy its consequences and consider sanctions and claims. Ignoring red flags can expose directors to personal liability towards the company.

There is no statute that regulates internal investigations as such. Instead, investigators must navigate data protection law, employment and works constitution law, criminal procedure, professional secrecy and, where authorities are involved, the expectations of prosecutors and regulators. Mistakes in one of these areas can make evidence unusable in employment proceedings, trigger data protection fines or hand prosecutors material that the company had hoped to keep confidential.

A well-run investigation protects the company in several ways. It provides the basis for decisions on disclosure, cooperation, dismissals, damages claims and remediation; it can reduce corporate fines and confiscation; and it supports self-cleaning in public procurement. This page explains how internal investigations are planned and conducted in Germany, with a focus on data, interviews, the works council, privilege and cooperation. For the wider compliance framework, see our page on compliance management systems.

Planning and scoping the investigation

The first decisions shape everything that follows. Who commissions the investigation, the management board, the supervisory board or a committee, depends on who might be implicated: where members of the management board may be involved, the supervisory board should take control. The mandate should define the questions to be answered, the period and entities covered, the reporting lines and the expected deliverables, and should be documented in writing. A small steering group, kept separate from the people under suspicion, takes the key decisions.

Immediate measures often cannot wait. Data must be preserved through litigation holds and forensic copies before it is deleted; suspicious payments or shipments may need to be stopped; and access rights of suspects may need to be restricted. At the same time, management must check external obligations: notification of D&O and other insurers, information of auditors, ad hoc disclosure for listed issuers, reporting obligations to supervisory authorities in regulated sectors, and data breach notifications where personal data are affected.

Who conducts the investigation

Smaller matters can be handled by internal audit or the compliance function, but internal investigations into serious allegations, or allegations involving senior management, are usually led by external counsel. External counsel bring independence, experience with authorities and a better (though not absolute) position on confidentiality. Forensic accountants analyse payment flows and books, and e-discovery providers collect and process data. Their engagement should run through counsel where possible, with clear confidentiality and data processing terms. The in-house legal team remains essential as the link to the business, but people from the affected unit should not steer the investigation.

Cross-border investigations

Many investigations in German companies extend to subsidiaries abroad, or are triggered by foreign authorities such as the US Department of Justice. Each country brings its own rules on data protection, employee rights, works councils and privilege, and some have blocking statutes that restrict cooperation with foreign authorities. Transfers of personal data from Germany to a third country require a legal basis and safeguards under Chapter V GDPR. Coordinating parallel requests from authorities in several countries, so that the company tells the same story to all of them, is one of the main tasks of investigation counsel.

Data protection and the works council

Reviewing emails, chats, files and device data involves processing employees' personal data. Section 26(1) of the Federal Data Protection Act (BDSG) allows processing to uncover crimes only where documented facts give rise to a suspicion that the person has committed a crime in the employment relationship, the processing is necessary and the employee's legitimate interests do not prevail (§ 26 BDSG). However, the Court of Justice of the European Union held on 30 March 2023 that national rules on employee data must be disregarded if they do not satisfy Article 88 GDPR (CJEU, Hauptpersonalrat der Lehrerinnen und Lehrer, C-34/21), which has raised doubts about § 26 BDSG as a stand-alone legal basis.

In practice, companies therefore base investigative processing on Article 6(1)(c) and (f) GDPR as well, and apply the proportionality requirements of § 26 BDSG as a benchmark. That means documenting the suspicion, choosing the least intrusive effective measure, using search terms and date ranges, separating private communications where private use of email was permitted, involving the data protection officer, and informing data subjects as soon as this no longer jeopardises the investigation. Transfers of data to authorities or advisers outside the EU, for example to a US parent or a foreign regulator, require a separate assessment.

The works council has rights too. The introduction and use of technical tools that are capable of monitoring employee behaviour or performance, such as e-discovery platforms, requires its consent (§ 87(1) no. 6 BetrVG), and standardised interview questionnaires or rules on cooperation can affect conduct in the establishment under § 87(1) no. 1 BetrVG. Many companies conclude a framework works agreement on investigations in advance, so that the works council's involvement is settled before an urgent case arises; see our page on works councils.

Employee interviews in internal investigations

Interviews are often the most important source of information in internal investigations, and the most sensitive. Employees generally have a contractual duty to provide information about matters within their area of work, and refusals can have employment consequences. There is no general privilege against self-incrimination in an employer interview, but the extent to which employees must answer questions that incriminate them personally is debated, and information given under pressure may raise questions about its later use in criminal proceedings.

Good practice in Germany includes advance notice of the interview and its subject where possible, an explanation at the start that the interviewers represent the company and not the employee, that the company may pass information to authorities and that the employee should keep the interview confidential, and the option of having a lawyer present, often paid by the company.

Where the works council requests it, or the employee asks for a works council member, the company should consider their attendance. Interview memoranda are usually prepared by counsel rather than verbatim transcripts, and their status and distribution should be decided in advance. Interviews should be held by two people, one leading and one taking notes, in a neutral setting and in a language the employee is comfortable with, using an interpreter where needed. Amnesty or leniency programmes for employees who cooperate can be useful but must be designed carefully.

Directors, former employees and third parties

Interviews with members of the management board or managing directors raise additional questions, because they owe duties to the company under corporate law and may themselves become defendants in liability claims. Former employees have no continuing duty to cooperate unless their termination or settlement agreement provides for one, so cooperation clauses in severance agreements are valuable. Business partners such as distributors or agents can be asked for information on the basis of audit rights in their contracts. In all cases, interviewers should avoid any impression of pressure or promises that could later be used to challenge the evidence.

Privilege, seizure and cooperation with authorities

German law does not have legal professional privilege in the common-law sense. Protection comes from rules of criminal procedure: written communications between an accused person and their defence lawyer cannot be seized, and investigative measures against lawyers are restricted where they would yield information covered by the right to refuse testimony (§ 97 StPO, § 160a StPO). Whether documents created in an internal investigation are protected depends on who holds them, who commissioned the work and whether there is already a defence relationship with the company as a party to proceedings.

The Federal Constitutional Court did not accept constitutional complaints against the seizure, at a law firm, of documents from an internal investigation commissioned by a parent company in connection with proceedings concerning a subsidiary (BVerfG, order of 27 June 2018 – 2 BvR 1405/17). The practical lesson is that investigation materials, including interview memoranda, can be seized in many constellations. Companies should structure the engagement carefully, keep work product focused, and assume that sensitive documents may eventually be read by prosecutors.

Cooperation with prosecutors and authorities is often in the company's interest. It can lead to lower fines under § 30 OWiG, more lenient treatment in confiscation, closure of proceedings against individuals under § 153a StPO, and in antitrust matters it is formalised through leniency. But cooperation has costs: waiving confidentiality, sharing interview results and potentially exposing employees. The decision should be taken early, after a first assessment of the facts, and coordinated with white-collar defence counsel for the company and for individuals.

Closing internal investigations and remediation

Internal investigations end with a report to the body that commissioned them, which should state the facts established, the evidence, open questions and recommendations. Whether the report is written or oral, and how widely it is shared, depends on the risk of disclosure in litigation or criminal proceedings. The company must then decide on consequences: employment measures, damages claims against employees or directors (including the question whether the supervisory board must pursue claims against the management board), notifications to insurers, voluntary disclosure and corrections of tax returns or financial statements.

Communication needs a plan of its own. Employees, customers, banks, auditors and sometimes the press will ask questions, and statements made early in internal investigations are hard to correct later. Leaks can undermine the investigation and expose the company to claims by the persons concerned, so confidentiality agreements with all participants and a need-to-know principle are standard. A small group should approve all internal and external communications, and messages should be limited to what is established.

Where the investigation concerns a listed company, the ad hoc disclosure obligation under Article 17 of the Market Abuse Regulation must be assessed at each stage, including whether disclosure can be delayed. Employees who are interviewed or whose data is reviewed should receive consistent information, and managers should be told how to respond to questions from their teams.

Remediation completes the cycle. A root-cause analysis should identify why controls failed, and the compliance management system should be adjusted accordingly, with documented changes to processes, controls, training and, where needed, personnel. These steps are also the core of self-cleaning in public procurement and are taken into account by authorities when setting fines. Where the investigation started with a whistleblower report, the company must give feedback within the deadlines of the Whistleblower Protection Act and protect the whistleblower against retaliation.

Illustration: a German manufacturer receives an anonymous report through its whistleblowing channel alleging that a sales manager has paid kickbacks to a purchasing employee of a customer. The compliance function acknowledges the report within seven days, the management board instructs external counsel, and IT preserves the sales manager's mailbox under an existing works agreement. A targeted email review and two interviews confirm the payments. The company stops the payments, terminates the sales manager's employment within two weeks of establishing the facts, assesses a voluntary disclosure to the prosecutor and strengthens its controls on discounts and commissions. The whistleblower receives feedback within three months.

How TRW & Co helps

We conduct internal investigations in Germany for management boards, supervisory boards and audit committees, and advise companies on investigations led by others. We define the mandate and governance, secure data in compliance with the GDPR and works constitution law, plan and conduct employee interviews, coordinate forensic accountants and e-discovery providers, and prepare investigation reports. We advise on disclosure and cooperation with prosecutors, the Federal Cartel Office, BaFin, customs and other authorities, and on employment measures and claims against employees and directors. We then support remediation and self-cleaning. To discuss a matter in confidence, please contact us.