Final report from internal company investigation

If there are indications of compliance violations in companies, these must be investigated by the company itself or by external investigators. This results in extensive documentation, particularly in the form of a final investigation report. Whether and to what extent the persons affected by such an investigation have a right to receive these documents (in copy) has been highly controversial for years. In a recently published ruling, the Munich Regional Labour Court (LAG) deals with this issue in detail and provides helpful clarifications for practical application.

Action for disclosure of two versions of a report

In one company, there were several internal reports of problematic management behaviour by a senior employee. A law firm was commissioned to conduct an internal investigation into the allegations. There was a preliminary version of the final report with identical content, which contained additional legal explanations and client information that were missing from the final version. The senior employee sued for the disclosure of both versions of the report (in copy) or at least for access to the preliminary version. She justified this with Article 15 of the General Data Protection Regulation (GDPR). Paragraph 1 of the article states that a data subject has the right to know whether personal data relating to them has been processed. If this is the case, they also have the right to obtain information about this data. Paragraph 3 adds to this the right to receive a copy of this data. In its ruling of 12 June 2025 (Ref. 2 SLa 70/25), the Munich Regional Labour Court granted the plaintiff the right to inspect the final version of the report and dismissed the rest of the claim.

No entitlement to a complete copy of the report under Article 15 of the GDPR

The court justified its ruling by stating that Article 15 GDPR only grants data subjects the right to information about their processed personal data and to a copy of this data, but not to the disclosure of entire documents that also contain additional data.

Referring to recent case law of the European Court of Justice (ECJ), the Munich Regional Labour Court clarified that a claim to document excerpts or even entire documents can only exist in exceptional cases. The prerequisite is that the data subject can demonstrate and justify that it is otherwise impossible for them to effectively exercise their rights as a data subject. However, this was not the case here. The plaintiff could therefore only request a copy of the report in which "all content other than her personal data is redacted".

In this regard, the Regional Labour Court allowed an appeal against the ruling due to its fundamental importance, which the plaintiff made use of. The case is therefore now pending before the Federal Labour Court (BAG) (Ref. 8 AZR 169/25), which must clarify the issue at the highest level.

Ready to talk? Contact us

Right to inspect the investigation report as part of the personnel file

Although the plaintiff is not entitled to a copy of the entire investigation report, her request to inspect the investigation report – based on labour law provisions – was granted by the Munich Regional Labour Court. Employees and senior executives have the right to inspect their personnel files, which also include the final report of any internal investigation concerning them. According to the Regional Labour Court, if access to the report could jeopardise the success of the investigation, it is generally possible to refuse access. However, this was not an issue in this case, as the investigations had been completed. The right of access only applies to the final report; the legal statements contained in the preliminary version are not part of the personnel file.

In addition, employers are not permitted to disclose any data from whistleblowers and witnesses that could reveal their identity if they had previously been promised anonymity. It is therefore the employer's responsibility to redact the relevant sections before access is granted in order to ensure the protection of the legitimate interests of third parties.

Consequences for the practice of internal company investigations

The ruling is significant for those affected by internal company investigations, for companies that commission such investigations, and for the internal or external investigators conducting them.

Significance for the commissioning companies:

Companies remain responsible for investigation reports within the meaning of the GDPR, even if they commission external investigators.
They must allow data subjects access to the personal data concerning them after the investigation has been completed, but they are not required to provide a complete – and certainly not unredacted – copy of the report.
Further requests for disclosure only have to be complied with if the data subject has specifically explained and provided comprehensible reasons why the copy of additional parts of the report is essential for the exercise of their GDPR rights – which, according to the Munich Regional Labour Court, is not usually the case.
Once the investigation has been completed, data subjects may also request access to the investigation report concerning them, as this is part of their personnel file.
Refusal of access on the grounds of protecting trade secrets is not possible.
Before access is granted, all information that could lead to the identification of whistleblowers and witnesses who have been promised anonymity must be removed, redacted or otherwise anonymised.
Company data protection officers should be actively involved in matters of data provision and anonymisation in order to reduce risks.
As long as the investigation is ongoing, the right of access may be restricted if this would jeopardise the success of the investigation – for example, if there is a risk of witness tampering or suppression of evidence.

Significance for appointed investigators:

Reports should be prepared in such a way that personal information is clearly identifiable and separable, and non-personal statements are presented separately.
Multi-relational data should be avoided in reports as far as possible, especially data in which information about suspects is inextricably linked to information about witnesses or informants that must be protected.
Legal assessments, client advice or comments on possible litigation strategies should be kept in separate documents or a separate version of the report, as they are not part of the personnel file.
This also applies to other information that the persons affected by the investigation should not be aware of, even after the investigation has been completed; investigators should consult with the client in good time regarding the specific form of documentation and reporting.
Contractors should point out to companies that they are responsible for anonymising and redacting information before it is accessed.

Conclusion and outlook

The ruling of the Munich Regional Labour Court is of considerable importance for the practice of internal company investigations. It contains important clarifications regarding the tension between data protection, whistleblower and witness protection, and transparency obligations under labour law, which ultimately lead to an appropriate balance between the interests of those affected and those of the company.

Overall, the decision highlights the need to conduct internal investigations in compliance with data protection regulations, as data subjects are entitled to sufficient information, access and provision rights in order to have the lawfulness of the processing of information concerning them reviewed. Data protection violations in internal investigations not only entail fines and liability risks, but also jeopardise the admissibility of the investigation results in court. Data protection expertise should therefore not only be consulted when data subjects ultimately assert their rights, but also before the investigation begins and throughout its entire duration.