Internal Investigations in Germany

Internal investigations are company-led inquiries into potential violations of law, compliance policies, or internal regulations. They allow companies to clarify matters quickly, confidentially, and in a legally defensible manner — before regulatory authorities intervene or the damage grows. Unlike official regulatory investigations, the company retains control over the process and can take targeted steps to limit harm.

Common triggers for internal investigations in Germany include suspected corruption, fraud, and breach of fiduciary duty, as well as antitrust violations and reports submitted through whistleblower systems. Other frequent grounds include violations of the Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, “LkSG”), data protection breaches under the General Data Protection Regulation (GDPR), balance sheet manipulation, and breaches of anti-money laundering regulations. Internal investigations are also conducted in response to allegations of discrimination and sexual harassment, environmental offenses, and ESG violations.

Every internal investigation is unique and must be tailored to the specific circumstances of the case. There is no rigid procedure that applies equally in all situations. The type of allegation, the size of the company, the individuals involved, and the potential legal consequences all shape the approach. That said, several core elements feature in most internal investigations conducted in Germany.

The first step is to evaluate the allegation and define the boundaries of the investigation. What violations are alleged? Which individuals, departments, or time periods are affected? How urgently must the facts be established? This initial assessment determines the scale and intensity of the subsequent inquiry.

A central element of any internal investigation in Germany is the proper preservation of relevant documents, emails, data, and other evidence. German data protection law — including the GDPR and the Federal Data Protection Act (Bundesdatenschutzgesetz, “BDSG”) — and employee co-determination rights governed by the Works Constitution Act (Betriebsverfassungsgesetz, “BetrVG”) must be observed throughout. The chain of custody must be documented without gaps so that findings remain admissible before courts or regulatory authorities. Premature or legally flawed data collection can compromise the entire investigation. Our approach includes immediate preservation orders to prevent data deletion, encrypted secure storage, coordination with IT departments to maintain business continuity, and forensic analysis for deleted or concealed files — all conducted in compliance with German data protection requirements.

The preserved information is then systematically analyzed, including a review of financial transactions, contractual documents, and communications. All investigative steps are carefully documented throughout. The process concludes with a final report that summarizes findings, provides legal assessment, and sets out recommendations for action. Whether and to what extent this report is disclosed to authorities, business partners, or other third parties depends on the specific circumstances and any applicable reporting obligations under German law.

Interviews with employees are frequently a decisive element of internal investigations. They serve to clarify facts, hear witnesses, and give those under suspicion an opportunity to respond to allegations. However, employee interviews in Germany are legally sensitive and must be conducted in compliance with employment law, data protection law, and criminal law principles.

As a general rule, employees in Germany are required to comply with an employer’s request for a meeting concerning their work and to provide information. However, where an employee is themselves subject to the allegation, the criminal law principle of nemo tenetur — the right not to be compelled to incriminate oneself — applies in internal investigations as it does in criminal proceedings. An employee cannot be coerced into making statements that incriminate them, and employment law consequences may not be imposed solely on the basis that an employee has declined to answer questions. Employees under suspicion also have the right to legal representation and may request the presence of a works council (Betriebsrat) member.

In complex or sensitive cases, it is advisable to have employee interviews conducted by external lawyers. This creates a neutral environment and increases the likelihood of candid responses. External counsel is familiar with the relevant legal requirements and can conduct interviews in a manner that will withstand challenge before German courts and regulatory authorities.

Legal requirements applicable to companies in Germany continue to evolve. New legislation and tightened compliance standards mean that internal investigations are becoming increasingly complex and require specialist knowledge. Our interdisciplinary team combines expertise in white-collar criminal law, employment law, data protection law, and international compliance standards to provide legally sound solutions across all aspects of internal investigations.

Since the Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, “LkSG”) came into force in January 2023, companies with 3,000 or more employees — and since 2024, those with 1,000 or more — have been required to systematically monitor their supply chains for human rights and environmental risks. Where indications of violations by suppliers or business partners emerge — whether through complaint mechanisms, media reporting, or NGO alerts — companies are required to immediately initiate appropriate remedial action. This often demands complex cross-border investigations conducted under difficult conditions, and non-compliance can result in significant fines.

The Whistleblower Protection Act (Hinweisgeberschutzgesetz, “HinSchG”), in force since July 2023, requires all companies with more than 50 employees to establish internal reporting systems. Reports submitted through these systems must be processed in a structured manner and within strict deadlines — in particular, the three-month deadline for providing feedback to the reporting person must not be missed. We assist not only with establishing legally compliant reporting systems but also with handling incoming reports in a legally defensible way, ensuring that whistleblower protections and the rights of those under suspicion are both upheld and that all statutory requirements are met.

In certain cases, German law requires companies to report investigation findings to regulatory authorities. The relevant framework depends on the sector and the nature of the violation. Financial services companies subject to oversight by the Federal Financial Supervisory Authority (Bundesanstalt für Finanzdienstleistungsaufsicht, “BaFin”) face specific prudential reporting obligations and may be required to notify BaFin of material findings. Anti-money laundering legislation (Geldwäschegesetz, “GwG”) imposes suspicious activity reporting duties in defined circumstances. GDPR data breach notification requirements set strict timelines for reporting to data protection authorities. We evaluate reporting obligations at the outset of every investigation and develop a strategic approach that meets compliance requirements while protecting the company’s legitimate interests.

International business relationships, global supply chains, and cross-border payment flows mean that internal investigations increasingly touch multiple legal systems. Coordinating investigations across jurisdictions presents companies with significant challenges: different data protection standards, divergent employee protection rules, varying procedural laws, and cultural differences in the conduct of employee interviews must all be taken into account. Failure to account for GDPR requirements when collecting data from European operations, for example, can render evidence inadmissible and expose the company to additional regulatory liability. Our experience in international white-collar matters enables us to navigate these complexities and conduct investigations efficiently even in the most complex cross-border structures.

If you suspect a compliance violation or have received concrete indications of potential wrongdoing, prompt and measured action is essential under German law.

Evidence preservation should begin without delay. This means securing email accounts, restricting IT access for individuals under suspicion, and physically securing relevant documents. Every delay significantly increases the risk of evidence being destroyed, and destroyed evidence can itself constitute an offense under German criminal law.

Confidentiality must be maintained from the outset. Information should be shared only with those who have an absolute need to know it, and all individuals involved should be reminded of their obligation of discretion. Premature disclosure — internal or external — can jeopardize the investigation and amplify reputational damage.

Terminations or other personnel measures carried out without prior legal review may be invalid under German employment law and can expose the company to additional liability. Even in emotionally charged situations, the presumption of innocence applies and the procedural requirements of German labor law must be strictly observed. An overhasty response can cause more damage than the original incident.

A compliance incident that is mishandled in its early stages can trigger media attention, employee panic, and stakeholder damage that far exceeds the original violation. For international companies operating in Germany, the risk is compounded by unfamiliarity with how quickly German regulatory proceedings can become public and how little control a company has over that process once it begins. Early, well-structured legal counsel on communications is not a reputational nicety — it is a substantive legal matter.

The foundation of any crisis communications strategy in a German internal investigation is the protection of attorney-client privilege. We establish privileged communication channels from the outset, advise on which communications are protected and which are not, and create documentation systems that maintain legal protection throughout the investigation. All participants — internal and external — are advised of their confidentiality obligations, and information is shared strictly on a need-to-know basis. Premature internal circulation of findings is one of the most common and most damaging errors companies make at this stage.

Employee communications must comply with German employment law and data protection requirements while protecting investigation integrity — a balance that requires careful legal judgment at each stage. For external stakeholders, we advise on disclosure obligations, regulatory notification requirements, and the legal constraints on public statements. Where media engagement becomes unavoidable, we coordinate with external communications specialists without waiving privilege, and we advise on what can and cannot be said publicly without prejudicing the investigation or creating additional legal exposure.

Where an internal investigation runs alongside regulatory or criminal proceedings — a situation that arises more frequently than many companies anticipate — the communications and legal strategy must account for both simultaneously. Statements made in one context can have direct consequences in another. We manage the interaction between processes, advise on the sequencing of disclosures, and ensure that cooperation with authorities does not inadvertently undermine the company’s legal position elsewhere.

Investigation findings are of limited value without proper analysis and a structured response. Many companies make critical errors at this stage — misinterpreting evidence, implementing ineffective corrective measures, or failing to address the root causes that allowed a problem to develop. A well-managed remediation process transforms an investigation from a cost centre into a demonstrable commitment to compliance that regulatory authorities and business partners can see and assess.

We conduct thorough analysis of all evidence and testimony to establish clear fact patterns and assess their legal implications under German law. This includes evaluating the credibility of different sources, identifying potential regulatory exposure and personal liability risks for directors and officers, assessing the business impact on operations and stakeholder relationships, and identifying the systemic failures that enabled the compliance problem to arise. Where additional investigation or clarification is required, we identify those gaps before the formal process concludes.

Effective remediation requires both immediate corrective action and longer-term systemic improvement. Immediate steps typically include personnel decisions — whether discipline, reassignment, or termination, each of which must be handled in compliance with German employment law — process corrections to stop ongoing harm, and any required notifications to stakeholders or authorities. Longer-term improvements address the underlying conditions: policy updates, enhanced monitoring and detection systems, training programs, and where necessary, cultural and governance change. We develop comprehensive remediation plans that address both levels and remain realistic about what each company can implement.

The final report and remediation documentation serve a specific legal function: they demonstrate to German regulatory authorities that the company discovered a problem, investigated it thoroughly, and took genuine corrective action. How that documentation is structured, what it includes, and how it is presented to authorities can materially influence regulatory outcomes. We prepare executive summaries for leadership, detailed reports for regulatory purposes, and compliance certifications that demonstrate completed corrective actions — all structured with German regulatory expectations in mind.

Our lawyers have extensive experience conducting complex internal investigations for mid-sized and large companies across a wide range of industries. What distinguishes us is the interdisciplinary collaboration between our criminal law, employment law, and corporate law specialists, together with IT forensics experts and compliance professionals.

Absolute confidentiality and discretion are the foundations of our work. We understand that every investigation places a burden on a company, and we therefore prioritize clear processes and regular communication. Our client-oriented approach means we engage closely with your business and develop pragmatic, commercially sound solutions that reflect your operational realities. Companies that handle compliance incidents professionally, with early legal guidance and thorough internal investigation, are demonstrably better positioned when regulatory authorities become involved — and better placed to protect their reputation in the long term.