HR Internal Investigations 2025 Comparisons

HR internal investigations are typically opened in circumstances involving complaints or concerns regarding:

• breaches of employment contracts or company policies;
• procedures or practices;
• suspected wrongdoing on the part of an employee; or
• workplace issues, accidents or disputes.

The legal bases for carrying out HR internal investigations may be derived from legislation and contracts, namely:

• Employment Contracts and Other Employment-Related Policies and Documentation: These may set out terms and rules on circumstances warranting HR internal investigations and inquiry.
• Collective Agreements: These may include terms detailing the conduct of investigations and inquiries if employees are members of a trade union.
• The Employment Act, 1955 (EA): Section 14(1) of the EA states that “due inquiry” is required before an employer imposes disciplinary action on an employee on grounds of misconduct. Similarly, for sexual harassment complaints, an employer is required to conduct an inquiry into a sexual harassment complaint before imposing disciplinary action. “Due inquiry” is not defined in the EA. While the conduct of a domestic inquiry (ie, a disciplinary hearing presided over by an impartial tribunal) after an HR internal investigation is commonly performed, this may not necessarily be needed in every case depending on the nature and seriousness of a complaint, the facts of the same, the nature and scope of evidence, fairness in the investigation process and the right accorded to the accused employee to be heard, including the substance of the employee’s response.
• The Personal Data Protection Act, 2010 (PDPA): The PDPA includes requirements to ensure that any personal data and/or sensitive personal data collected is properly stored and safeguarded to protect and preserve its confidentiality, including such data collected in the course of HR internal investigations.
• The Occupational Safety and Health Act 1994 (OSHA): The OSHA imposes an obligation on the part of the employer to ensure that, as far as reasonably practicable, the health, safety and welfare of all employees at work are protected, and the employer is required to establish a health and safety committee to investigate any threats to the health or safety of employees at their place of work.
• Case Law and Judicial Precedents: Another important legal basis is case law and judicial precedents where the Malaysian courts have generally applied the rules and principles of natural justice in assessing whether an employer’s inquiry processes and decision to terminate an employee are fair. They also provide guidance on acceptable methods and procedures in the handling of investigations and inquiries.

There is no legislative requirement for an employer to provide specific channels for employees to report concerns.

Employers may issue policies providing for effective communication channels, procedures and processes on raising a complaint (whether anonymously or otherwise), the safeguarding of confidentiality and data privacy, and preservation of impartiality.

The determination of persons responsible to carry out an HR internal investigation would depend on the nature of the complaint, company policies, the role or seniority of an accused employee (“respondent”), the principles of natural justice and fairness in the management of an investigation and inquiry, and due process in the management of the investigations and employee misconduct.

The impartiality of the investigations should be preserved to ensure that any determinations of misconduct are not tainted with bias or conflicts of interest. Employers should ensure that such persons responsible for carrying out HR internal investigations are objective, with no affiliation to the subject matter of the complaint and any potential persons involved in the investigations. If the circumstances do not enable a fully objective person to take part in the investigation process, employers should prudently consider safeguards to preserve the impartiality of the investigation and inquiry process, which may include the inclusion of a neutral third party (whether from another department or an external adviser) to monitor or supervise the process.

Typically, the HR department would be responsible for the management and conduct of HR internal investigations. However, depending on the complexity or technicalities of the complaint, some employers may engage other specialised departments in the company (eg, audit or IT departments) or seek the advice or assistance of external legal counsel or auditors on the investigative process.

As “due inquiry” is required under Section 14 of the EA before an employer can take disciplinary action against an employee on grounds of misconduct, an HR internal investigation and inquiry would be necessary to ascertain the validity of a complaint of misconduct.

Failure to carry out due inquiry prior to the issuance of a disciplinary action on grounds of misconduct may lead to an aggrieved employee referring a complaint to the Industrial Relations Department and a likely finding by the Industrial Court that due process and natural justice were not observed in the employer’s handling of and decision made on the misconduct.

Further, there may be statutory obligations on the part of an employer to carry out investigations within its organisation, for example investigations on workplace safety concerns under OSHA. As OSHA is regulated by the Minister of Human Resources in Malaysia, any concerns or investigations of a workplace or safety concern may also fall within the purview of an HR internal investigations, depending on the employer’s organisation and departments to monitor, supervise and regulate the enforcement of OSHA-related compliance within its workplace.

While there are no statutory restrictions on the carrying out of an HR internal investigation, there may be practical circumstances due to which it is either not possible or inappropriate to carry out or continue an HR internal investigation. This may include:

• where a complaint raised is unsubstantiated, vague or lacks evidence upon initial review;
• if the conduct of the HR internal investigations may interfere with ongoing investigations by the relevant authorities; and/or
• the alleged misconduct contains elements constituting a criminal offence and/or a violation of regulatory laws, requiring the involvement of the relevant authorities.

In deciding whether to move ahead with carrying out an HR internal investigation, an employer should generally consider the following matters:

• compliance with company policies to address complaints or grievances;
• understanding the nature of the complaint made and the complexity of the same;
• ascertaining the gravity of the complaint (ie, whether it may involve a minor infraction or serious misconduct);
• evaluating the manner in which the complaint was received, including the anonymity of such complaints and the extent of facts and evidence provided to supplement such complaints;
• whether the nature of the complaint made to the employer requires further evidence before an assessment may be made on its validity;
• whether the complaint concerns a breach or violation of the employment contract, company policies and/or employment-related documentation;
• whether the complaint concerns a breach or violation of statutory provisions or applicable laws;
• ascertaining the prior conduct of the respondent to determine if there are any recurring pattern(s) of behaviour; and
• whether there is a necessity to engage legal advisers or external auditors to ascertain the scope and strength of the complaint based on available material and facts, before determining if an investigation should be carried out.

While there is no legal obligation for the employer to inform the reporter whether an HR internal investigation will be opened, there are certain factors for an employer to consider in determining whether to communicate the opening of an HR internal investigation and, if so, the extent of such communication:

• compliance with company policies if there are rules requiring the reporter to be informed of the outcome or status of their complaint;
• ensuring that the confidentiality of information in the course of investigations is not prejudiced;
• prudence and caution on the details provided to the reporter to avoid risks of retaliation, whether by or against the reporter;
• ensuring a fair balance and transparency in the conduct of investigations;
• preservation of workplace harmony pending the initiation and progress of investigations; and
• allaying any concerns on the part of the reporter as to whether the complaint is being treated seriously.

There is no legal obligation for an employer to inform the respondent whether an HR internal investigation will be opened against them. If the company policies contain procedures or processes on whether the respondent is informed of the opening of an HR internal investigation, this should be followed.

Once an internal HR investigation is underway, the respondent should be notified of the allegations made against them. This ensures that the principles of natural justice are upheld, granting them a fair opportunity to respond and present their justification.

Generally, an employer has no obligation to communicate the opening of HR internal investigations to the authorities unless the nature and seriousness of the complaint warrant intervention from the authorities for the administration of justice, namely where the alleged offence is criminal in nature or a violation of statutory requirements.

Some employers do require parties involved in the HR internal investigation or inquiry process to sign confidentiality agreements or NDAs. The necessity to do so would depend on the nature and severity of the complaints being investigated, the identity of parties involved in the internal investigations and inquiry, and the scope and nature of evidence or information which may be disclosed to such parties as part of the investigations requiring an obligation of confidence to be imposed on them.

While employers may choose, for commercial or procedural reasons, to require parties to sign confidentiality agreements or NDAs, such agreements should not prevent or restrict individuals from lawfully reporting matters of a criminal nature or breaches of statutory requirements to the relevant authorities. Additionally, they should not hinder individuals from pursuing legal remedies or claims arising from the investigation.

In most cases, parties involved in internal investigations are employees of the company. As a result, they are typically bound by their employment contracts and company policies, which often impose a duty of confidentiality and fidelity. These obligations require employees to protect the employer’s confidential information and prohibit its disclosure to third parties without express authorisation. Employees remain subject to these duties, particularly when they have been informed of the confidentiality of the facts, information, and data disclosed during the investigation.

If individuals involved in the investigation breach a confidentiality agreement or NDA, the employer may have the right to pursue a claim against them for any loss or damage suffered as a result. Furthermore, depending on the terms of the confidentiality agreement or NDA, employees who commit such a breach may also be subject to disciplinary action in accordance with company policies.

It is possible for a preliminary investigation to be conducted before assessing if a full HR internal investigation is warranted.

Such preliminary investigation may be undertaken:

• where the complaint received is an anonymous one, which raises questions regarding its credibility;
• where a complaint is vague and unsupported by evidence, requiring scrutiny to determine if a full HR internal investigation is needed;
• to assess whether the allegations and concerns brought to the employer’s attention are serious enough to justify a more thorough investigation;
• to identify the scope of the suspected misconduct and the relevant next steps required for the purposes of ensuring due process; and/or
• to assess the scope of investigations that may be needed to assess the complaint.

Individuals typically interviewed in the course of an HR internal investigation would include those directly or indirectly involved in the complaint and/or are able to provide an account to address any gaps within the complaint.

The number of individuals interviewed would depend on the nature and severity of the complaint and may include:

• the reporter (if identified);
• witnesses who were present during an alleged incident or have relevant knowledge of it;
• persons named by other witnesses who may be involved in the incident or have knowledge of it; and/or
• the respondent.

In cases where the nature and gravity of the complaint raise concerns about potential interference in the investigation, the respondent’s account may be obtained in a different manner. Instead of an immediate investigative interview, their response could be provided in reply to a show cause letter issued after the investigation has concluded, provided there is sufficient evidence to substantiate the complaint. Additionally, during a domestic inquiry, the respondent should be given the opportunity to present evidence and call witnesses in response to the allegations made against them.       

If the interviewee is an employee, reliance may be placed on company policies, clauses within the employee contract and/or the interviewee’s implied employment duties of good faith and fidelity, which may extend to co-operating with the employer where required for such investigations.

While an interviewee cannot be compelled to participate in an interview, the employer may seek to address any concerns they have about their involvement. The employer can explain that their participation supports the company’s commitment to due process and that refusing to participate may result in their account not being considered. This could have implications for them, particularly if they are later found to have been involved in the matter under investigation. If an employee refuses to co-operate, this should be properly documented for record-keeping purposes.

Depending on the nature of information expected to be gathered from the interviewee and the nature, gravity or sensitivity of the complaint being investigated, interviews may be conducted remotely.

However, there are some practical considerations in handling interviews remotely, which include the following:

• the potential risk of missing out on the interviewee’s verbal cues and body language in comparison to in-person interviews;
• obtaining the interviewee’s signed written statements immediately at the conclusion of the interview, unless transcribing software is used over the interview;
• potential risks that the confidentiality of matters discussed, and privacy of data shared during the interview may not be controlled or protected;
• technical complications in holding the interview which may lead to disruptions or misunderstandings; and
• the necessity of obtaining the interviewee’s consent before recording the remote session.

The number of interviewers required will depend on company policies as well as the severity and complexity of the complaint being investigated.

To ensure the investigative interviews are conducted fairly and impartially, interviewers should be individuals who can remain objective and unbiased. Additionally, in cases involving complaints of sexual harassment, gender considerations may be taken into account when selecting an interviewer, particularly to ensure the reporter, or other witnesses, feel comfortable during the interview process.

The presence of a neutral third party may be necessary in certain situations, including:

• when required under company policies;
• to document interview statements and ensure proper record-keeping;
• to ensure the interview process is conducted in compliance with company policies and legal requirements;
• to provide a corroborative account of the interview process;
• to act as an intermediary in cases where there is a significant disparity in seniority between the interviewer and the interviewee;
• to ensure there is no threat, intimidation, or duress imposed on the interviewee, particularly if the interviewer has direct or indirect involvement in the complaint or in relation to other parties involved in the investigation;
• to serve as a reference point in the event of future disputes arising from the interview;
• to provide legal or technical assistance, depending on the seriousness of the complaint under investigation;
• to facilitate the involvement of a trade union representative where the interviewee is part of a union and such participation is stipulated in collective agreements; and
• to serve as a safeguard against potential retaliation towards the interviewee, particularly in cases involving serious complaints such as sexual harassment or discrimination.

The ability of interviewees to be accompanied by a support person, such as someone providing emotional or mental support, depends on several factors. These include the nature of the complaint being investigated, whether company policies allow for such accompaniment, the interpretation of the collective agreement if the employee is a member of a trade union, and the need to maintain confidentiality and safeguard any data shared during the interview. If no company policies specifically address the involvement of a support person, the decision ultimately rests with the employer.

Generally, the conduct of an interview is an internal matter within the company where the process is governed by the company policies and practices. The employer has the prerogative to decide if a lawyer may be present to accompany the interviewee.

Among others, the information typically given by interviewers to interviewees includes:

• the purpose of the interview and concerns being investigated which are relevant to them;
• the interviewee’s rights in responding to queries or declining to do so;
• whether the interview is being recorded and, if so, obtaining the interviewee’s consent to being recorded;
• the confidential nature of the interview and the interviewee’s obligations to ensure that the interview is kept confidential;
• consent that it is a voluntary participation; and
• the possible consequences of the investigation in relation to the interviewee.

At the end of the interview, information typically provided to the interviewee includes:

• informing the employee of the opportunity to review the written statement taken down and to sign the same to acknowledge its contents;
• the possibility of a further interview being held if needed and possible next steps in relation to their further involvement in the process; and
• reminder of the interviewee’s obligation to treat the interview with confidence.

If an interviewee requests for the interview to be stopped, requiring them to continue with the same could give rise to risks of allegations that the interviewee was coerced or placed under duress during the interview which may taint the outcome of the interview process.

While the interviewer may inform the interviewer of the consequences of an incomplete interview, such communication should be handled carefully to ensure that allegations of intimidation may not be levelled against the interviewer. The interviewee’s request should be documented as a matter of record-keeping.

It is prudent for minutes to be taken during the interview process. While there are no hard and fast rules on the manner of taking minutes, it is best for verbatim minutes to be taken to avoid any disputes with regards to the responses given by the interviewee and the queries raised by the interviewer.

The minutes can be taken by an objective member of the company involved in the internal HR investigation. Depending on the complexity of the matter, employers may delegate the questioning and note-taking to external advisers.

It is prudent for interviewees to be given the opportunity to review the minutes and to sign them, which reinforces the accuracy and validity of the minutes, should the same be disputed later.

Interviews may be recorded, provided the interviewee’s consent is obtained. Recording interviews is generally done to maintain a clear and accurate record of the proceedings, including the substance of questions and responses. It also allows for greater focus on the interview itself, rather than note-taking, and facilitates the review of the interview minutes.

Once the interview is concluded, a transcript is typically prepared for documentation purposes. The interviewee is usually asked to sign the transcript to confirm its accuracy and the correctness of their responses. The transcript is then shared internally with the investigation team and may later be presented during the domestic inquiry of the respondent, ensuring they have a fair opportunity to address any allegations of misconduct.

Aside from interviews, there are several other types of fact-finding methods that may be used to gather and preserve the necessary evidence in an investigation, which include, among others:

• review of documents forming the subject matter of the complaint, which include financial documents (accounting statements, invoices, expense reports), correspondence (emails, memos, letters) and employee records within the company (disciplinary records, performance reviews, past grievances lodged against the respondent);
• examination and retention of CCTV surveillance and footage, and photographic evidence;
• site visits to investigate the location of the relevant incident;
• extraction and analysis of data from devices issued by the employer to employees; and/or
• external audit or investigative reports for investigations that are particularly complex in nature, such as financial or fraud-related concerns in relation to which external forensic firms, accountants or auditors may need to provide reports.

While there are no governing laws outlining specific methods that ought to be adopted by employers, it is crucial for employers to avoid practices that are coercive in nature, intimidating and which violate the employee’s personal privacy and property. Such practices, if adopted by the employer could undermine the integrity of the investigation and may risk legal action from employees who are subjected to such processes.

The legal basis for an employer’s duty to protect a reporter can generally be derived from several key considerations. These include:

• employment contracts and/or company policies;
• the employer’s general duty of care to protect employees from harm and to ensure a safe working environment under the OSHA, which arguably extends to providing a working environment that protects not only physical safety but the mental health of employees; and
• the employer’s obligation to avoid discrimination in the workplace, which may warrant the involvement of the Director General of Labour if a dispute arises.

There are no hard and fast rules on the measures that may be taken by an employer to protect a reporter as these would depend on the company policies in place (if any), the harm or dangers that may be perceived by the reporter and the nature of the complaint being investigated. If the circumstances do warrant action to be taken by the employer, some examples of measures which may be considered to afford protection to a reporter in avoiding retaliation or confrontation from the respondent or such persons involved in the complaint include:

• allowing the reporter to work remotely pending the outcome of investigations and inquiry on the complaint;
• moving the reporter to a separate workstation, if feasible;
• placing the respondent on suspension pending investigations; and
• implementing clear policies or directives outlining disciplinary consequences for any conduct that interferes with ongoing investigations or involves retaliatory behaviour towards the reporter and other parties involved in the inquiry process.

The seriousness of the complaint and the level of harm perceived by the reporter must also be taken into account. Inaction by the employer could result in the reporter resigning, potentially leading to a constructive dismissal claim. Additionally, if the circumstances of the workplace suggest discriminatory treatment, the reporter may escalate the matter to the Director General of Labour.

However, any measures taken to protect the reporter must be carefully balanced against the principles of natural justice, ensuring that the respondent is given a fair opportunity to address the allegations. If the employer’s actions unduly hinder the respondent’s ability to defend themselves, any disciplinary action taken against them may be subject to challenge in the Industrial Court on the grounds that due process and fundamental principles of fairness were not upheld during the investigation and inquiry.

Employers have a general duty to ensure that any investigation conducted against a respondent is conducted fairly, objectively and impartially. There are also overriding obligations under the OSHA and the EA for employers to ensure that employees are protected from harm at the workplace and to prevent discrimination in the workplace.

As the respondent is presumed innocent until proven otherwise, employers must take care to avoid any unreasonable actions that could negatively impact the respondent’s well-being and reputation before a determination is made regarding the validity of the complaint.

Some precautionary steps that may be taken by the employer to avoid adverse repercussions to the respondent pending the investigation include:

• placing the respondent on suspension or garden leave pending the outcome of investigations;
• preserving confidentiality of any information and evidence gathered during the investigation process; and
• restricting access to such information and evidence on a strictly “need-to-know” basis.

If the respondent finds themselves in a position where they feel unsafe, threatened, or harassed due to the complaint, they may consider resigning and subsequently bringing a constructive dismissal claim against the employer. There is also a risk that the respondent may argue that the manner in which the employer conducted the investigation resulted in negative treatment by colleagues, potentially calling into question the impartiality of the investigative process if it is later challenged.

Under Section 14(1) of the EA, disciplinary measures for misconduct should only be imposed following a due inquiry. Employers should refrain from imposing disciplinary measures ahead of the conclusion of the HR internal investigations, as doing so could be seen as a premature determination of the respondent’s guilt.

However, Section 14(2) of the EA permits an employer to suspend the respondent for up to two weeks at half pay if such a measure is necessary to prevent interference with the investigation or, in some cases, to ensure workplace safety. If the inquiry does not establish any misconduct, the respondent must be reimbursed the full amount of wages withheld during the suspension period.

While suspension may be justified in certain situations, it should be implemented with caution to ensure that it is not perceived as a punitive measure. Instead, it should be clearly framed as a neutral and precautionary step taken to protect the integrity of the investigation.

The protection of other employees is similar to the protection of the reporter as set out in 4.1 Protection of the Reporter. The employer must evaluate the seriousness of any complaints raised by employees concerning their safety or perceived harm. If the concerns are deemed serious, appropriate measures should be considered.

Procedural guarantees in the conduct of the investigation and inquiry are not explicitly prescribed by legislation. However, the overarching principle in handling employee misconduct is that employers must uphold the principles of natural justice and fairness throughout the investigation and inquiry process.

To align with these principles, a respondent’s rights during an investigation and inquiry generally include:

• the right to be informed of the specific allegations against them, where this is typically done through a show cause letter;
• the right to be provided with such evidence substantiating the specific allegations against them;
• the right to be afforded reasonable opportunity and time to consider the specific allegations against them and to provide their responses;
• that any period of suspension imposed upon the respondent pending the inquiry (if any) is not unreasonable and the inquiry is handled in a timely manner;
• the right to be heard in the course of an inquiry by an objective inquiry panel; and
• the right to seek the documentary evidence or the calling of witnesses during an inquiry to substantiate their responses to the specific allegations.

Adhering to these procedural safeguards helps employers demonstrate that due process has been observed before reaching any determination on alleged misconduct. Courts are generally reluctant to revisit or reassess an employer’s findings if the investigative and inquiry processes have been conducted fairly and in accordance with due process. However, if an employer fails to handle the investigation properly – by denying the respondent a fair hearing or an adequate opportunity to defend themselves – the inquiry process may be challenged, particularly if the respondent disputes the employer’s adverse findings against them.

An employer may have more detailed procedural requirements that go beyond those mentioned in 5.1 Requirements provided that such requirements align with the principles of natural justice and fairness in the handling of the investigations and inquiry.

Some employers have internal regulations that set out more detailed procedural requirements, which may include, among others:

• reporting procedures in the event an employee or external party wishes to file a complaint with the employer;
• step-by-step procedures setting out the initiation, execution and conclusion of the investigation process along with stipulated timeframes based on the complexity of the matter;
• mechanisms and guidelines in relation to the conduct of interviews;
• the composition and handling of a domestic inquiry;
• appeal processes in place should the respondent wish to challenge the employer’s findings;
• confidentiality considerations as a reminder to parties involved in the investigation process;
• anti-retaliatory requirements and consequences attached to them; and
• data preservation and collection during and after the investigation.

Whether these regulations are binding on the employer depends on the employer’s policies. However, where an employer has established internal regulations as a framework for governing investigations and inquiries, it is advisable to adhere to these procedures unless there is a valid reason to deviate. Failure to follow established procedures without justification may lead to allegations from an aggrieved respondent that due process was not observed.

The burden of proof in establishing that a misconduct occurred lies with the employer. Similarly, if the respondent initiates an unfair dismissal claim on grounds of their termination by reason of misconduct, the employer bears the burden of proving that such termination was with just cause and excuse.

The employer would have to prove on a balance of probabilities that the respondent committed an act of misconduct.

There are no legislative rules on when an HR internal investigation may be ended. The consideration of when such investigation may be ended includes, among others:

• guidelines under company policy, if it sets out circumstances prompting the conclusion of an HR internal investigation;
• if evidence gathered during the investigation is sufficient to issue a show cause notice to the respondent, or the evidence gathered or lack thereof demonstrates a baseless complaint; and/or
• withdrawal of complaint by the reporter where the context of such withdrawal will need to be scrutinised before ending the investigation.

While not specifically outlined in any employment-related legislation in Malaysia, general good practice dictates that an employer should follow certain procedures once an HR internal investigation has been concluded. These procedures typically fall into two categories:

• If the HR internal investigation indicates a likelihood that the respondent committed misconduct, the employer should issue a show cause letter to enquire as to whether the respondent has anything to state in response to the specific allegations raised against him/her. If the response given is not satisfactory, a domestic inquiry is typically held to evaluate the respondent’s account and the evidence presented for an assessment to be made regarding the alleged misconduct.
• If the HR internal investigation indicates that there is no substantial basis for the complaint, the employer will typically inform the reporter of its decision to not pursue further action on the matter. If the complaint is found to have been made for an ulterior purpose by the reporter, the employer may decide to initiate further action in respect of the same. In the event the respondent is suspended during the investigation period, the employer is to restore any salary withheld during that time and notify the respondent of the cessation of investigations.

There are no rules governing the form that the conclusion must take. However, it would be prudent for investigative findings and the conclusion to be documented for record-keeping purposes.

There are no requirements regarding the information to be included in the report. As a matter of good practice, an investigation report should ordinarily contain the nature of the complaint, investigation steps taken to verify the complaint, findings of the investigation and analysis of the findings as to whether the complaint made is substantiated.

The inclusion of recommendations and next steps in the investigation report would depend on the employer’s organisation, practice and policies in place. In some instances, the employer company may have other departments or personnel responsible for advising on recommendations and the next steps upon the conclusion of investigations, whereas other employers may include the same as part of the scope of the investigation report.

The HR department would ordinarily be involved in the investigation and inquiry as the information of employees, including the reporter and the respondent would be in its records. As a result, for the purposes of record retention of the employees’ personnel files and in the issuance of correspondence pertaining to the handling of the investigations and inquiry, the HR department would generally have access to the written reports unless directed otherwise by the employer.

As part of due process and to uphold fairness, the respondent has the right to be informed of the outcome of the investigation and to be made aware of the specific allegations against them, ensuring they have a fair opportunity to defend themselves. If the investigation determines that the complaint against the respondent is substantiated, the respondent is usually issued a show cause letter detailing the specific allegations and supporting evidence, to which they are expected to provide a response. However, the full investigation report is generally not shared with the respondent; instead, relevant evidence justifying the allegations is provided for their review.

Similarly, while the employer may inform the reporter of the outcome of the investigation in response to their complaint, the investigation report is typically not disclosed to them.

If the findings and the conclusion of the HR internal investigations reveal the commission of offences which are criminal in nature or breach applicable laws, the employer is obliged to report such findings to the relevant authorities. There may be legal consequences for an employer if findings of criminal activity or statutory violations are not reported to the authorities.

The necessity for an employer to report findings of investigations to the authorities stems from legislation, including the Penal Code, OSHA, EA, Industrial Relations Act 1967, Malaysian Anti-Corruption Commission Act 2009, Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001, Malaysian Communications and Multimedia Commission Act (1998), Income Tax Act, and the PDPA.

Some examples of HR internal investigation findings that require reporting include:

• criminal activity such as embezzlement, assault, theft, fraud, harassment;
• any workplace safety or health issues regulated under the OSHA;
• bribery or corruption;
• money-laundering activities;
• discrimination in the workplace;
• tax-related crimes or offences;
• data privacy breaches; and/or
• workplace disputes or issues such as dismissals or violation of labour practices. 

Depending on the HR internal investigation findings, the relevant authorities to whom such findings may be required to be reported include, among others, the Royal Malaysian Police, Department of Occupational Safety and Health, Malaysian Anti-Corruption Commission, Central Bank of Malaysia, Director-General of Labour, Industrial Relations Department, Inland Revenue Board and/or the Personal Data Protection Commissioner.

There is no legal right for other parties within the employer organisation to be notified of the conclusion of the HR internal investigations. The decision to disclose such information rests entirely with the employer, depending on its established practices, policies, and the necessity of communication within the organisation.

If the allegations against the respondent are substantiated following the investigation and inquiry, the employer may impose disciplinary measures in accordance with company policies. These may include, but are not limited to:

• issuance of a warning letter;
• demotion;
• suspension
• reduction in pay;
• transfer of departments/workplace; and/or
• termination (dismissal).

The disciplinary action taken must be proportionate to the nature and severity of the misconduct, considering any prior or recurring instances of similar behaviour by the respondent.

An employer may also implement other measures, regardless of whether the allegations are substantiated, based on organisational policies, workplace practices, and an assessment of the circumstances that arise during the investigation. At times, an investigation may reveal the need for increased awareness or reminders regarding acceptable workplace conduct. It may also highlight a breakdown in relationships between certain parties due to the complaint. In such situations, the employer may decide to implement corrective or pre-emptive measures such as team-building activities, training and counselling.

Any alternative measures must be implemented with sensitivity, ensuring that they effectively address workplace conflicts without making any individuals involved in the investigation feel singled out, targeted, or discriminated against by the employer or others within the organisation.

An employer is generally allowed to collect personal data for the purpose of conducting an HR internal investigation, provided such collection is in compliance with the PDPA which governs the use, collection and disclosure of personal data. The processing of sensitive personal data requires explicit consent from the data subject.

The collection of personal data is subject to limitations outlined in the employer’s data privacy notices issued to employees. Employers must ensure that any personal data collected is used strictly for the specific purpose for which it was obtained – namely, for investigation purposes.

The collection and/or processing of personal data by the employer is subject to compliance with the PDPA.

Personal data must be collected in compliance with the seven principles under the PDPA:

• General Principle: Data must be processed for a lawful purpose and with consent of the individual/where necessary under law.
• Notice and Choice Principle: Data subjects must be informed of the purpose of the data collection and be given the option to limit the processing of their data in accordance with their rights under the PDPA.
• Disclosure Principle: Any disclosure must be with the individual’s consent or when required or authorised under the law.
• Security Principle: Appropriate security measures must be implemented to protect personal data.
• Retention Principle: Personal data must not be kept longer than necessary.
• Data Integrity Principle: Personal data must be accurate, complete, not misleading, and kept up to date.
• Access Principle: Data subjects have the right to access and correct their personal data to ensure accuracy.

Access to personal data is governed by the PDPA, which generally grants individuals (data subjects) the right to access their own personal data being processed. However, third parties, such as authorised personnel and legal advisers, may also access such data if disclosure is necessary for the purpose of investigations or where required or authorised under applicable laws.

The specific type of personal data that can be accessed depends on the scope and purpose of the investigation.

An employer may limit a data access request in the following circumstances:

• If the request comes from someone other than the data subject, access may be denied to safeguard sensitive information.
• Where the requestor in question is the data subject and is requesting access to their personal data, the employer may refuse such access in writing in the circumstances set out in Section 32 of the PDPA.

The Whistleblower Protection Act 2010 provides protection to any individual who discloses information of alleged wrongdoings and/or corruption.

Under the Whistleblower Protection Act 2010, the reporter would be entitled to:

• protection of confidential information;
• immunity from civil and criminal action; and
• protection against detrimental action.

However, such protection is confined to complaints lodged with the enforcement agencies regulated under the Whistleblower Protective Act 2010, and does not extend to complaints raised with an employer.

There are provisions in the EA that address allegations of sexual harassment, including the following:

• Employers are required to conspicuously display a notice at the workplace at all times to raise awareness about sexual harassment.
• Employers have a legal duty to inquire into complaints of sexual harassment. If an employer refuses to conduct an inquiry within 30 days of receiving a complaint, they must inform the reporter in writing. If dissatisfied, the reporter may escalate the matter to the Director General of Labour, who has the authority to review the case and, if deemed necessary, direct the employer to conduct an inquiry.
• Upon an inquiry and if the complaint of sexual harassment is found against the respondent, the employer is entitled to impose disciplinary action against them, including dismissal.
• A complaint of sexual harassment may also be made to the Director General of Labour, who can direct the employer to inquire into such complaint or inquire into such complaint himself/herself if the employer is a sole proprietor.

The Anti-Sexual Harassment Act 2022 provides for the establishment of a tribunal known as the “Tribunal for Anti-Sexual Harassment”, which has the authority to issue various remedies/orders, including:

• an order for the accused to issue a statement of apology to the reporter as specified in the order;
• if the complaint related to any act of sexual harassment that was carried out in public, an order for the accused to publish a statement of apology to the reporter in any manner as specified in the order;
• an order for the accused to pay compensation or damages not exceeding RM250,000 for any loss or damage suffered by the reporter; and/or
• an order for the accused to attend any programme as the tribunal deems necessary.

Aside from the above, the Penal Code also provides for sexual crimes and offences that can be reported to the Royal Malaysian Police.

The Director General of Labour in Malaysia is vested with the authority to inquire into and resolve disputes between employers and employees in relation to matters of discrimination in the workplace. The Director General of Labour is also empowered to issue orders based on findings of such inquiries. Failure to comply with such an order constitutes an offence, carrying a fine of up to RM50,000. In cases of a continuing offence, the employer may also face a daily fine of up to RM1,000 for each day the offence persists after conviction.

The Penal Code also addresses offences of stalking, assault or battery which may address circumstances where discrimination or harassment involves such criminal elements.

While the EA does not contain specific provisions on bullying and mobbing, it does address discrimination and sexual harassment. The Penal Code further covers criminal aspects of workplace harassment, such as stalking, assault, or battery.

Moreover, the OSHA imposes a legal duty on employers to ensure, as far as reasonably practicable, the health, safety, and welfare of employees in the workplace. This duty arguably extends beyond physical safety to include mental well-being, covering bullying and sexual harassment concerns.

In the event an allegation is criminal in nature, there is an obligation to notify/report such criminal allegations to the relevant authority immediately in compliance with relevant applicable laws. This obligation may include:

• lodging a police report;
• providing a statement during investigations; and
• acting as a witness in any subsequent prosecution of the respondent.

Employers may also be required to comply with specific procedures depending on the nature of the offence and the applicable laws, particularly if regulatory authorities are involved.

Where there are multi-jurisdictional investigations involving various entities within a group of companies, it is prudent to ensure that the handling and transfer of employee data are in accordance with respective local data protection laws and to ensure that the confidentiality of such data is preserved.

While foreign employers may generally conduct HR internal investigations in respect of a Malaysian subsidiary, such investigations must be handled in accordance with Malaysian laws, regulations, rules, practice and procedures when dealing with employees who are governed by Malaysian labour laws and to factor in cultural considerations and language barriers. It is also prudent to also ensure that the management of employment-related issues, concerns and decisions is addressed and dealt with by the employer on record.