Internal investigations: choosing the right support

Short answer: An internal investigation works when a company separates four tasks: the lead, usually outside counsel or the legal or compliance function, sets the investigation question and scope and assesses the results; forensics secures and processes the data; a review team, in-house or with interim professionals, reviews documents against a protocol; and whistleblower reports are handled through the reporting channel. In Germany, employers with as a rule at least 50 employees must run an internal reporting channel, confirm receipt of a report within seven days and give feedback within three months (Sections 12 and 17 HinSchG, German Whistleblower Protection Act).

This guide is for heads of compliance, general counsel and HR in Switzerland and Germany. It sets out the internal investigation process, the support each party provides and what data protection and employment law require.

Phases of an internal investigation

An internal investigation runs in eight phases, from triage to implementing the remedial measures. The sequence protects evidence, the rights of those involved and the later usability of findings.

1. Intake and triage: record the report, audit finding or suspicion, set responsibility and urgency, check for conflicts of interest.
2. Immediate measures: preserve evidence, suspend deletion routines, restrict access where needed.
3. Investigation plan: define the question, date range, permitted document set, roles, reporting line and confidentiality.
4. Data collection and processing: forensically collect emails, files and chats, filter them and load them onto a review platform.
5. Document review: code documents against the protocol, escalate relevant hits, build a chronology.
6. Interviews: interview witnesses and those concerned, keep records, respect the rights of those concerned.
7. Assessment and report: establish the facts, assess them legally, report to the responsible body.
8. Measures and close-out: employment law steps, process improvements, reports to authorities, feedback to the whistleblower.

When planning, time-critical steps come first. In Germany, termination for cause must take place within two weeks of learning the relevant facts (Section 626(2) BGB, German Civil Code). In Switzerland, Art. 337 of the Code of Obligations sets no fixed deadline. Summary dismissal must nevertheless follow promptly once the facts are sufficiently established; waiting without reason risks the cause no longer being accepted. The fact-finding itself should therefore move quickly.

Who does what: law firm, forensics, interim team

Leading an investigation and carrying it out operationally belong in different hands. The table shows a typical division of work in a larger case.

When do you need outside counsel?

Outside counsel makes sense where officers or the legal department are themselves involved, authorities or courts may become involved, there is a criminal law risk, or documents need the best possible protection. In Swiss civil proceedings, documents of the in-house legal department are only protected under the conditions of Art. 167a of the Civil Procedure Code, for example where the department is headed by a person with a bar qualification.

Interim professionals complement outside counsel and the in-house team where volume arises: in review, case handling and implementing measures. Possible assignments in disputes and investigations are described on the page litigation, investigations and eDiscovery.

Document review in an investigation

In many investigations, document review is the largest block of work, and this is where interim teams provide the most relief. It requires a clear separation between legal direction, data processing and operational review. Before the first review, the lead clarifies:

• which information may be reviewed and which date range applies
• which categories apply and how sensitive or legally relevant hits are handled
• access rights, confidentiality and documentation requirements
• a review protocol with categories, escalations and quality criteria
• calibration of reviewers on a shared sample

External support does not replace these decisions. Responsibility for the legal conclusions and the report follows the agreed roles. Roles, team size and calibration are covered in the guide document review for law firms.

Handling whistleblower reports

In Germany, the Whistleblower Protection Act governs case handling; Switzerland has no general whistleblowing law for the private sector. In Germany, the obligations include:

• Reporting channel: mandatory for employers with as a rule at least 50 employees; certain financial and securities firms regardless of size (Section 12(2), (3) HinSchG).
• Agency workers too: reporting channels must also be open to agency workers placed with the employer (Section 16(1) HinSchG).
• Deadlines: confirmation of receipt within seven days, feedback within three months (Section 17 HinSchG).
• Confidentiality: the identity of whistleblowers and of the persons concerned may only be known to the responsible persons and those supporting them (Section 8(1) HinSchG).
• Third parties: the reporting channel can be entrusted to a third party; the duty to stop violations stays with the employer (Section 14(1) HinSchG).
• Retaliation: it is prohibited (Section 36 HinSchG). Obstructing reports or retaliation can lead to fines of up to EUR 50,000; failing to set up a reporting channel up to EUR 20,000 (Section 40 HinSchG).

An interim compliance professional can reinforce the reporting channel as a supporting person, for example when reports pile up or during a vacancy. They record cases, monitor deadlines and prepare follow-up measures; the reporting channel makes the decisions. See the page interim compliance.

In Switzerland, courts decide case by case, based on the employee's duty of loyalty, whether a report was permissible. Many companies still run internal reporting channels on similar principles. The comparison is covered in the guide whistleblowing in Germany and Switzerland.

Data protection and employment law

An internal investigation involves processing personal data and must be proportionate. The key rules:

Germany

• To detect criminal offences, employee data may only be processed where documented facts give rise to a suspicion, the processing is necessary and the employee's interests do not prevail (Section 26(1) sentence 2 BDSG, Federal Data Protection Act). Since the CJEU judgment of 30 March 2023 (C-34/21) on Article 88 GDPR, it is disputed whether Section 26 BDSG works as a stand-alone legal basis; also base and document the processing under Article 6(1) GDPR.
• The works council has a co-determination right over technical tools that monitor conduct or performance (Section 87(1) no. 6 BetrVG, Works Constitution Act).
• Where private use of email is permitted, reviewing it is more sensitive because private content may be affected. Clarify in advance with data protection and employment law advisers whether and under which conditions a review is permissible; a policy or works agreement on private use creates clarity.

Switzerland

• The employer may only process employee data that concerns their suitability for the job or is needed to perform the employment contract (Art. 328b OR).
• Processing must be limited to its purpose and proportionate (Art. 6 FADP, Federal Act on Data Protection).
• Systems designed to monitor employees' behaviour at work may not be used (Art. 26 ArGV 3, Ordinance 3 to the Employment Act). Where monitoring or control systems are needed for other reasons, they must be designed so that employees' health and freedom of movement are not impaired (Art. 26(2) ArGV 3). Whether a targeted review based on a specific suspicion is permissible in the individual case should be clarified in advance with data protection and employment law advisers.
• Data subjects have a right of access; it can be restricted or deferred where overriding interests require (Art. 25, 26 FADP).

In both countries, a data protection impact assessment is required where a high risk is likely (Art. 35 GDPR; Art. 22 FADP). Bulk reviews of mailboxes should therefore be assessed and documented in advance.

Limits and risks

• Alpinum Solutions provides companies and law firms with legal and compliance professionals for review, case handling and remediation, through staff leasing or freelancing. Alpinum is not a law firm and does not conduct investigations on its own responsibility.
• Anyone who is involved or has a conflict of interest must not lead the investigation. This also applies to interim professionals with earlier links to the facts.
• Mistakes in evidence preservation and data protection are hard to correct later. The investigation plan comes first.

Frequently asked questions on internal investigations

May employees' emails be reviewed?

Yes, but only for a specific reason and proportionately. In Germany, Section 26(1) sentence 2 BDSG requires documented indications, necessity and a balancing of interests to detect criminal offences, and the works council may have a say. In Switzerland, Art. 328b OR and Art. 6 FADP limit processing, and behavioural monitoring is prohibited under Art. 26 ArGV 3. Search terms, date range and custodians should be fixed in advance.

May an interim team handle reports from the whistleblowing channel?

Yes, as persons supporting the reporting channel. The German Whistleblower Protection Act allows people who support the reporting channel in its tasks to know the identity of those involved (Section 8(1)). Clear roles, confidentiality undertakings and access limited to assigned cases are prerequisites. Decisions on follow-up measures stay with the reporting channel and the company.

How quickly can a review or case team be set up?

At Alpinum, selected profiles are usually available within 48 hours; the company and Alpinum agree the start date together. The actual start usually depends on conflict checks, confidentiality undertakings and access to the review platform. Share only a description of the matter at first; confidential case data belongs in approved channels.

Can an investigation be run remotely?

Document review works well remotely if the platform allows it and downloads are blocked. Interviews on sensitive allegations usually take place in person. Remote, on-site or hybrid assignments are agreed to suit the case.

Next step

Describe the trigger, data volume, languages, timetable and the roles you need. That shows which tasks an interim team can take on.

• Litigation, investigations and eDiscovery
• Whistleblowing in Germany and Switzerland
• Interim compliance
• Discuss your needs

Last updated: 30 October 2026.