Part V: Tool for Internal Investigations: Data Processing
This Part of the Briefing Series outlines what employers in Germany may lawfully do in practice with personal data in internal investigations.
Each processing step must be based on a valid legal basis under the General Data Protection Regulation (GDPR), supplemented by the German Federal Data Protection Act (Bundesdatenschutzgesetz–BDSG) where it provides more specific safeguards. In practice, employers should follow a proportionate and well-documented approach throughout the investigation.
From a litigation perspective, courts generally admit evidence obtained through transparent and proportionate measures, whereas covert or excessive monitoring without concrete suspicion may lead to exclusion.
Employee data subject rights remain applicable but must be balanced against the rights of the employer and the integrity of the investigation. Retention must be limited to what is necessary for the investigation and potential follow-up proceedings.
Scope, roles, and investigation data map
Investigation context and responsibility
In internal investigations, the employer will typically act as the controller for all data processing, including scoping, evidence collection, review, and any resulting HR measures. Forensic providers typically act as processors, unless they determine purposes and means independently, in which case they may qualify as separate controllers for limited purposes. These roles should be clearly documented in processing agreements, privacy notices, and records of processing activities. Where a works council exists, the use of technical tools capable of monitoring employee behavior or performance will generally trigger co-determination requirements (see Part VI of our Series).
Scope of “investigation data”
Legal bases for data processing in internal investigations
GDPR as the primary framework
Each processing activity requires a legal basis. Processing of personal data is generally prohibited, unless there is a legal basis that permits or even requires it. In internal investigations, the most relevant bases are Art. 88 GDPR in connection with Sec. 26 BDSG, i.e., processing is necessary for the performance of the employment contract, which includes monitoring of conduct and performance and detection of violations or crimes, as well as legitimate interests (Art. 6 para. 1 lit. f GDPR) for fact-finding, fraud detection, and IT security, provided the processing is proportionate and not overridden by employee rights.
Legitimate interests and “processing for other purposes”
Where data initially collected for operational purposes is later used in an investigation, the rules on compatibility and further processing become decisive.
In practice, this allows employers to re-use, for example, time-stamp or system log data where a documented and concrete suspicion exists, provided the analysis is necessary and proportionate. Where datasets are combined, controllers should document the compatibility assessment, including the link to the original purpose, employee expectations, sensitivity of the data, and implemented safeguards such as access restrictions or pseudonymization.
Special categories of personal data
If the dataset includes special-category data, processing must meet the requirements of Article 9 GDPR. In employment contexts, this typically involves Article 9(2)(b) (employment and social security obligations) or Article 9(2)(f) (legal claims), alongside safeguards under Section 22 BDSG.
Collective agreements and co-determination
Under Section 26(4) BDSG, collective agreements may provide a framework for data processing in the workplace. However, following the CJEU’s clarification, such agreements must fully comply with GDPR standards and cannot dilute core principles under Articles 5 and 6 GDPR.
In practice, robust agreements should address necessity, transparency, access controls, retention periods, and effective remedies, ensuring both compliance and operational usability.
A compact scenarios table
|
Scenario |
Primary GDPR basis |
German overlay |
Notes |
|
Scoping, keyword searches in company mailboxes for specific allegations |
Art. 6(1)(f) legitimate interests |
§ 26 BDSG (employment context) or, where applicable, § 24 BDSG (further processing for legal claims or investigation of misconduct)
|
Narrow search strings; logs; masking of privileged or special‑category content where feasible |
|
Forensic imaging of a work laptop upon concrete suspicion |
Art. 6(1)(f) |
§ 26 BDSG (employment context) or, where applicable, § 24 BDSG (further processing for legal claims or investigation of misconduct) |
Consider sequencing: volatile capture, targeted review, segregation of non‑responsive personal content |
|
Using attendance logs to verify suspected time fraud |
Art. 6(1)(f) |
§ 26 BDSG (employment context) or, where applicable, § 24 BDSG (further processing for legal claims or investigation of misconduct)
|
Document compatibility assessment; restrict reviewers; avoid bulk exports |
|
Health or trade‑union data surface in evidence |
Art. 9(2)(b) or (f) |
§ 22 BDSG safeguards |
Minimize, mask non‑essential elements; raise protection level (encryption, very limited access) |
Notes: This table assumes private‑sector employers. Public bodies must also track Sections 23-25 BDSG.
Evidence use: when data become unusable in employment litigation
Open monitoring and the admissibility baseline
German employment courts have clarified that there is generally no automatic exclusion of evidence obtained through open and transparent workplace monitoring, such as visible video surveillance. Instead, courts apply a balancing test based on the GDPR and national procedural and constitutional principles.
In its judgment of 29 June 2023, the Federal Labor Court (Bundesarbeitsgericht, “BAG”, docket number: 2 AZR 296/22) confirmed that footage from open surveillance may be used to prove intentional misconduct, even where data protection rules were not fully complied with, provided the measure was proportionate and did not seriously infringe fundamental rights. This builds on earlier case law confirming that even delayed evaluation of such recordings does not, in itself, render their use unlawful, particularly where deliberate misconduct affecting employer property is at issue.
Covert or disproportionate measures
By contrast, the BAG has drawn a clear line in cases involving covert or excessive monitoring. The keylogger decision confirms that evidence obtained through comprehensive, covert surveillance without a concrete suspicion of serious misconduct is generally inadmissible.
In practice, employers must refrain from broad “just in case” monitoring. Where suspicion becomes concrete and documented, narrowly tailored covert measures may be considered, but only as a last resort, subject to strict proportionality, limited scope and duration, and clear documentation of why less intrusive means were insufficient.
A breach of co-determination requirements under the German Works Constitution Act (Betriebsverfassungsgesetz–BetrVG) does not automatically lead to exclusion of evidence if it is otherwise admissible. However, such breaches create separate legal risks and should be managed carefully (see Part VI and Part VII).
Practical rule of thumb on admissibility
- Open, targeted, and proportionate monitoring → generally usable evidence, especially if it shows intentional misconduct
- Covert or blanket monitoring without concrete suspicion → high risk of exclusion
- Always: even lawfully collected data may still be tested against proportionality in court
Handling sensitive datasets
- Where special-category data is involved, apply:
- data minimisation (use only what is strictly necessary)
- masking/redaction of irrelevant sensitive elements
→ This helps preserve admissibility while protecting employee rights.
Employee rights during investigations
Access and copies: scope and limits
Employees are entitled to request access to their personal data under Article 15 GDPR, including a “copy” where necessary to ensure a clear and intelligible understanding of the data processed. In an investigation context, this may extend to extracts from documents or databases, but only to the extent required for effective rights exercise.
In practice, this right is not unlimited. It must be balanced against the rights and freedoms of others, including the protection of third-party data, whistleblower identities, and trade secrets. Similarly, employees may request information on data recipients and internal access (e.g., audit trails), but disclosure may be restricted where identifying individuals is not necessary or would unduly affect others.
A pragmatic approach is to treat Article 15 as a structured disclosure exercise: provide meaningful, well-organized extracts, explain any redactions, and, where appropriate, offer alternative forms of access (such as on-site inspection). Where disclosure would jeopardize an ongoing investigation or legal claims, limitations should be clearly justified and documented.
Erasure and restriction
The right to erasure under Article 17 GDPR is limited where data is required for legal claims or compliance purposes. In the context of ongoing investigations or anticipated litigation, employers will typically be justified in deferring deletion.
Instead, restriction of processing under Article 18 GDPR may serve as a practical interim solution, for example, where the accuracy of data is contested or the investigation has concluded but legal risks remain. Any refusal or deferral should be communicated transparently, documented internally, and revisited once the relevant legal exposure has passed.
Practical limits: safeguarding the investigation
Internal investigation files typically contain data relating to multiple individuals. The integrity and confidentiality of the process therefore set important limits on employee rights.
In particular, redactions to protect witnesses, complainants, or privileged material are consistent with the GDPR, provided the requesting employee still receives a meaningful account of the data concerning them. Where disclosure may create risks of retaliation or undermine whistleblowing mechanisms, controllers should carry out and document a careful balancing exercise, and consider anonymized or staged disclosures where appropriate.
These considerations should be aligned with internal whistleblowing frameworks and co-determination requirements (see Part VI) as well as overall litigation strategy (see Part VII).
Retention and deletion: setting, pausing, and lifting the hold
Storage limitation and investigation phases
Under the GDPR, personal data may only be retained in identifiable form for as long as necessary for the purposes pursued. In internal investigations, this assessment evolves over time, typically moving from initial assessment and fact-finding to decisions on measures and subsequent follow-up, including potential litigation or regulatory inquiries.
In practice, controllers should define clear retention milestones for each phase and implement structured “litigation hold” mechanisms. Such holds should be triggered by identifiable events (e.g., initiation of disciplinary action or anticipated claims) and lifted once objective criteria are met, such as the final resolution of employment measures and the expiry of relevant limitation periods.
Case law confirms that retention must be assessed in light of the underlying purpose. In particular, the Federal Labor Court has clarified that, in the context of open video surveillance, relevant data does not become disproportionate solely due to the passage of time, as long as it remains necessary to pursue legitimate remedies.
Special categories and enhanced safeguards
Where special-category data is involved, retention practices should reflect the heightened protection requirements under the GDPR and the BDSG. In practical terms, this includes shorter review cycles, stricter access controls, and, where feasible, segregation or masking of sensitive information.
Where data is further processed for legal claims, retention should be limited to the strictly necessary subset and closely aligned with the expected duration of related proceedings.
A working checklist for lawful processing in internal investigations
→ Fix the controller–processor allocation in writing before evidence collection starts; ensure processor terms cover forensic capture, hosting, and review.
→ For each processing step, record the legal basis.
→ Prefer open, signposted monitoring to covert tools; if covert steps are contemplated, document concrete suspicion, narrow scope and duration, and ineffectiveness of milder options. See Part IV for collection constraints and Part VI for co‑determination.
→ Build an access‑rights model and audit trail for the review workspace; segregate special‑category and privileged content.
→ Implement a rights‑request playbook for Article 15 access and copies, with redaction protocols and balancing templates.
→ Define retention milestones, litigation‑hold triggers, and release criteria; log decisions and execute deletions or anonymization promptly when holds lift.
→ Cross‑reference your approach to Part VII’s litigation‑risk section; missteps at collection or retention stage frequently drive fines or adverse in‑court inferences.
Conclusion
The success and legality of internal investigations largely depends on the quality of the data-related decisions.
Controllers must justify each processing step directly under the GDPR. German case law sets clear boundaries: open, proportionate monitoring is generally acceptable, while covert, intrusive measures without concrete suspicion carry real exclusion risk.
At the same time, employee rights must be actively managed through structured disclosure, reasoned limitations, and targeted redactions.
Retention should follow investigation phases and the horizon of legal claims, with enhanced safeguards for special-category data.
As always, align your data‑processing playbook with Part IV’s guidance on lawful collection methods, consult Part VI before deploying any monitoring technology in a co‑determination setting, and treat this Part’s safeguards as a precondition for the balanced risk‑management strategy discussed in Part VII.
