eDiscovery in the DACH region: workflow, data protection and staffing

Short answer: eDiscovery in Germany and Switzerland follows the same stages as elsewhere: identify, preserve, collect, process, review and produce. The difference is the law. In Switzerland, art. 271 and 273 Criminal Code and art. 16 and 17 FADP limit disclosure abroad; in Germany, Chapter V GDPR applies. Review needs the most people.

This guide is for general counsel, heads of legal and heads of compliance who run litigation, an investigation or a regulatory request involving large data volumes. It explains the eDiscovery workflow in Germany and Switzerland, the data protection and criminal law limits, and which roles you need for each stage.

What eDiscovery means in the DACH region

eDiscovery is the identification, preservation, collection, review and production of electronically stored information for proceedings or an investigation. The term comes from US civil procedure. In Germany, Switzerland and Austria, the same work arises in four typical situations.

• Foreign proceedings: a US court or a foreign authority asks for documents held by a group company in Switzerland or Germany.
• Internal investigations: a whistleblower report, an audit finding or a suspicion requires a review of emails, chats and files.
• Regulatory requests: supervisory, competition or criminal authorities request records.
• Transactions and disputes: due diligence, arbitration or mass claims with many similar documents.

How to staff an internal investigation is covered in internal investigations: which support fits which task.

The workflow: nine stages of the EDRM model

The EDRM model is the common reference framework for eDiscovery projects and describes nine stages. They do not run strictly one after another: review findings often lead to new search terms or further data sources.

1. Analysis: assessing information throughout the project, using human judgement, technology or both.
2. Identification: defining the scope of the matter and the relevant data sources, such as mailboxes, file shares, chats and business systems.
3. Preservation: protecting relevant data from alteration or deletion, for example with a legal hold.
4. Collection: gathering potentially relevant data in a forensically sound way.
5. Processing: standardising, de-duplicating and indexing data so it can be searched and reviewed.
6. Review: assessing documents for relevance, privilege, confidentiality, privacy and issues.
7. Production: delivering documents in agreed or defensible formats.
8. Presentation: preparing and displaying data and documents in proceedings.
9. Disposition: retaining, deleting, transferring or returning data in a documented way after the project.

Two points matter for planning. Preservation and collection are technical tasks for your IT team or a forensic provider. Review and preparing the production are legal work and account for most of the person-days.

Switzerland and Germany: data protection and limits on disclosure

The main hurdle for eDiscovery in the DACH region is not technology but whether, and by which route, data may leave the country. The table lists the provisions to check before any production.

A working method follows from this that holds up in both countries: review data in-country where possible, produce only what is needed, redact or pseudonymise third-party personal data and document every step. Whether the route must go through mutual legal assistance or an authorisation is for your legal department and outside counsel to decide before collection. Who may see privileged correspondence during review is explained in legal privilege for in-house and interim lawyers.

Staffing: the roles an eDiscovery project needs

An eDiscovery project needs both legal and technical roles, and the legal part grows with the document volume. The table shows who does what and where these people usually come from.

Alpinum Solutions provides document review lawyers, review leads and data protection specialists through staff leasing or freelancing, part-time or full-time, as individuals or teams. Under staff leasing, the client generally holds the right to give professional instructions and the professionals are integrated into its organisation. Direction and responsibility for the outcome stay with your company or law firm. The review roles Alpinum fills are described on the document review lawyers and review teams page.

How to plan an eDiscovery project in seven steps

An eDiscovery project works when legal, technical and staffing questions are settled before the first collection. This sequence has proven practical:

1. Define the mandate: which proceedings or authority, which deadline, which questions the review must answer.
2. Check the legal route: may the data be produced, and how? Review art. 271 and 273 StGB, art. 16 and 17 FADP or Chapter V GDPR before collection.
3. Data sources and legal hold: define mailboxes, chats, file shares and systems, suspend deletion routines and inform custodians where required.
4. Collect and process in-country: process data in Switzerland or the EU where possible and reduce it with filters and de-duplication.
5. Team and protocol: size the team from document volume, throughput and deadline; write a protocol with coding fields for relevance, privilege, business secrets and personal data.
6. Review with calibration: reference sample, calibration round, ongoing quality control.
7. Production and close-out: redact, prepare the privilege log, approve the production, revoke access and delete or return data as instructed.

How law firms set up review projects with contract lawyers is covered in document review for law firms.

Limits and risks

• Criminal law before deadlines: a foreign deadline does not justify a production that could breach art. 271 or 273 StGB. Settle the route before collection.
• Over-collection: collecting too much lengthens the review and increases data protection risk.
• Responsibility: the protocol, privilege decisions and production are the responsibility of your legal department or outside counsel. Alpinum is not a law firm and does not provide legal advice.
• Throughput assumptions: figures from other projects rarely fit. Measure throughput in the first days and adjust team size and forecast.

FAQ: eDiscovery in Germany and Switzerland

When do companies in Germany and Switzerland need eDiscovery?

Typical triggers are foreign proceedings in which documents of a group company are requested, internal investigations after a report, requests from supervisory, competition or criminal authorities, and large disputes or transactions. The method under the EDRM model is the same as elsewhere. In addition, you check the criminal and data protection law of the country where the data sits before any production.

Why does art. 271 of the Swiss Criminal Code matter for eDiscovery?

Art. 271(1) StGB makes it an offence to carry out acts on Swiss territory, without authorisation, for a foreign state or foreign party where those acts are reserved to a public authority. Gathering evidence for foreign proceedings can fall within this provision. Your legal department and outside counsel should therefore decide before collection whether the route must be mutual legal assistance or an authorisation.

Can personal data be transferred for US litigation?

Under conditions, yes. From Switzerland, disclosure is permitted where it is necessary to enforce legal claims before a foreign court (art. 17(1)(c) FADP). In the EU, art. 49(1)(e) GDPR allows a transfer where it is necessary for legal claims. Necessary means producing only what is needed, redacted where possible, and documenting the assessment.

How many reviewers does an eDiscovery project need?

The number follows from document volume after filtering, throughput per person and the deadline. Treat throughput as an assumption, measure it in the first days and add second-level review, quality control and a review lead. Selected profiles are usually available within 48 hours; the start date is agreed between the company and Alpinum.

Who is responsible for the outcome?

Your legal department, compliance function or outside counsel. They approve the search strategy and protocol and decide on privilege and production. Under staff leasing, interim professionals work to your professional instructions; as freelancers, they work independently within the agreed mandate. Alpinum provides the team and does not offer managed review with responsibility for the outcome.

Next step

Alpinum Solutions is the leading provider of interim legal & compliance in the DACH region and provides document review lawyers, review leads and data protection specialists for eDiscovery projects in Germany and Switzerland. Tell us the data volume, languages, platform and deadline.

• Litigation support lawyers and investigation teams for legal departments
• Document review lawyers and review teams for law firms and companies
• Legal support for data protection projects: tasks, roles and workflow
• Roles & practice areas: all guides on roles and practice areas
• Discuss your needs

Last updated: 10 November 2026.