HR Internal Investigations 2026 Comparisons

In Norway, an HR internal investigation is normally initiated following receipt of information from an employee in the form of a notice of concern under the Norwegian Working Environment Act (arbeidsmiljøloven, the WEA).

Whether a notice qualifies as a notice of concern under the WEA requires a case-by-case assessment. Section 2A-1 of the WEA stipulates that a notice of concern must relate to conditions that contravene legal rules, corporate written ethical guidelines, or generally accepted societal ethical norms.

Examples (non-exhaustive) stated in the WEA include conditions that may involve:

• danger to life or health;
• danger to climate or the environment;
• corruption or other economic crime;
• abuse of authority;
• insecure working environment; and/or
• breach of personal data security.

Statements concerning conditions that relate solely to the employee’s own employment do not qualify as a notice of concern under the law. Expressed professional differences of opinions or purely political statements will not, as a general rule, be considered as notices of concern.

If a notice is considered a notice under the WEA, the provisions of the WEA apply, triggering certain rights and obligations for the person reporting the concern (the “Reporter”) and the employer.

The detailed requirements for the procedure for notices of concern are set out in a separate statutory provision (see 1.3 Communication Channels for further details).

Where a notice meets the legal definition of a notice of concern under the WEA, the employer must ensure that it is adequately investigated. The extent of the investigation that an employer must undertake will vary from case to case.

Notices of concern are regulated by Chapter 2A of the WEA which contains rules concerning:

• procedure for notices of concern;
• the employer’s duty to act;
• prohibition on retaliation;
• compensation and damages for breach of the prohibition on retaliation;
• duty to establish procedures for internal notices of concern; and
• duty of confidentiality in relation to external notices of concern to public authorities.

The WEA contains both rules providing employees the right to submit notices of concern, and rules requiring the employer to ensure sufficient investigation of such notices.

Chapter 2A of the WEA also applies to public sector workplaces, and to civil servants. A separate act applies to employees working on board Norwegian ships. Such employment relationships are regulated by the Ship Labour Act (skipsarbeiderloven), which has its own provisions regarding notices of concern and is supplemented by the Ship Safety Act (skipssikkerhetsloven). Although the wording differs, these Acts are based on the same general principles regarding the scope of coverage and the prohibition against retaliation.

In addition to the legislation mentioned above, other acts may be relevant to notices of concern. For example, for public entities, the rules in the Freedom of Information Act (offentlighetsloven) and the Public Administration Act (forvaltningsloven) may be particularly relevant.

In 2019, the EU adopted a new directive on whistle-blowing, Directive 2019/1937. Norway is not a member of the EU but has committed to follow certain rules through the EEA Agreement. The Whistleblowing Directive has not yet been incorporated into the EEA Agreement and therefore does not have direct effect in Norway. The question of implementation has been considered and is under review; however, at the time of writing, it is uncertain whether the Directive will be implemented and, if so, how.

The Norwegian Bar Association has developed separate guidelines for private investigations conducted by lawyers. These apply in principle to lawyers, but may also provide guidance for others who conduct HR internal investigations.

Notices of concern may be made on three levels: either internal, to public authorities, or external.

It is mandatory for organisations that regularly employ at least five employees to have procedures for internal whistle-blowing. Organisations with fewer employees must also have such procedures if the circumstances in the organisation require so. The need for procedures will depend on a specific risk assessment in the organisation. The threshold is low: it is primarily uncomplicated organisations with few employees that do not have a duty to establish procedures. Regardless of the number of employees, the duty to handle notices in a proper and secure way within a reasonable timeframe still applies.

The procedures for notices of concern must specify to whom notices should be sent. This may be, for example, a person in the company, an employee representative, a person in management, a person in an HR position, or an external party.

With regard to internal whistle-blowing, employees may always report:

• to the employer or a representative of the employer;
• in accordance with the organisation’s whistle-blowing procedures;
• in accordance with a duty to report; and
• via a health and safety representative, employee representative, or lawyer.

It is possible to report anonymously. Employees may also request that the employer keep the notice of concern confidential, including that the identity of the person reporting must not be disclosed.

The employer is responsible for ensuring that a notice of concern is sufficiently investigated. The handling of the notice of concern may be conducted both internally and externally.

Norwegian law does not impose requirements as to who within the employer’s organisation should initiate the investigation; the law only requires that the employer initiate adequate investigations within a reasonable timeframe. See 1.2 Bases on how employees may report internally and to whom.

The employer may outsource the handling of the (internal) notice of concern to an external party. External handling of notices of concern may occur both where an employer does not have the resources or competence internally to investigate, and where the notice of concern relates to matters that should be assessed by external parties. For example, this may apply where the notice of concern is related to the executive management.

The employer may also implement a hybrid solution, where the notice of concern is handled internally but external expertise is also utilised based on the nature of the reported issue.

Upon receipt of a notice of concern, the employer must conduct adequate investigations within a reasonable timeframe. In other words, the employer has a duty to act. Whether a notice constitutes a notice of concern according to the law requires a case-by-case assessment; see 1.1 Circumstances.

There are no specific prohibitions on initiating an HR internal investigation. However, the employer may refrain from doing so if the matter either does not constitute a notice of concern according to the law or there is no need for further investigation. Whether further investigation is necessary will depend on the specific case, including the nature of the notice of concern and the severity of the matter.

Where a notice does not qualify as a notice of concern under the WEA, the employer must assess the notice against the rules on freedom of expression and the duty of loyalty in employment relationships. The employer must always, even in cases outside the scope of the whistle-blowing provisions of the WEA, act objectively and ensure a fully adequate working environment.

The first step an employer should take when receiving a notice of concern is to confirm to the Reporter that the notice has been received. The Reporter is not entitled to notification regarding whether an internal HR investigation will be initiated. However, it is advisable (based on legal theory) that the Reporter is informed of the procedural steps the employer will undertake in handling the information provided, including what the Reporter may reasonably expect throughout the process. Such information will be helpful for the Reporter, particularly as taking the initiative to require an investigation may be challenging for an employee. It is of importance to note that there is no regulation regarding such information requirements.

It is essential that the person who is the subject of an allegation triggering an investigation (the “Respondent”) is given an opportunity to respond to the notice of concern raised through the whistle-blowing process. Whilst this procedural safeguard is not expressly codified in the legal framework, the requirement to observe the principle of contradiction (the opportunity to respond to allegations or claims before a decision is made) is firmly established in legal doctrine and in guidance issued by the Norwegian Labour Inspection Authority concerning the proper handling of notices of concern. Upon receipt of a notice of concern, the employer is obliged to ensure that the matter is adequately examined within a reasonable timeframe, and it is standard practice for the Respondent to be notified of the notice of concern by the employer and be given a fair opportunity to present their version of events. This approach reflects both the employer’s duty to conduct a fair and thorough investigation and the Respondent’s fundamental right to procedural fairness.

Under Norwegian law, an employer who receives a notice of concern or handles a case involving a notice of concern is not obliged to inform the public authorities. However, it would be best practice to notify, for example, the Financial Supervisory Authority of Norway if an employer receives a notice of concern and discovers that an employee has violated regulations administered by that Authority.

Under Norwegian law, there is freedom of contract, and it is therefore possible for employers and employees to enter into confidentiality agreements (NDAs). This freedom is, however, not unrestricted in Norway, and in any event such agreements cannot be used to restrict or remove the Reporter’s statutory rights under the WEA. For example, agreements or instructions that limit the statutory right to send notices of concern are invalid.

Whether or not an NDA has been entered into, the employer must adhere to the principle of confidentiality. This means that the identity of those involved in a case involving a notice of concern, including the Reporter, the Respondent and others who provide information, must only be disclosed on a need-to-know basis. Investigations and reports should be handled without revealing the identity of the Reporter or other involved parties, as far as possible, to more people than those who have a need for or right to such knowledge.

Norwegian law requires the employer to investigate the notice of concern within a reasonable time. There is no statutory regulation as to whether the employer must or should initiate a preliminary investigation, but legal theory supports the view that a preliminary investigation is recommended. The purpose of a preliminary investigation is to determine which investigations will be necessary to ensure that the employer’s legal requirements are met.

The employer should refer to its own whistle-blowing procedures and ensure that these are followed, while also ensuring that both the Reporter and the Respondent have a satisfactory working environment. This may be ensured through, for example, paid leave during the period the investigations are carried out, coverage of costs for legal assistance for both parties, and adjustments in work tasks and reporting lines. Consideration can also be given to whether the employer should obtain external assistance to handle the notice of concern.

In Norwegian HR internal investigations, the pool of interviewees typically depends on the nature and complexity of the allegations. The primary subjects of interviews include the Reporter, the Respondent and any relevant witnesses who may have observed the conduct in question or have knowledge of the circumstances.

The number of witnesses interviewed varies significantly from case to case. In straightforward matters involving isolated incidents, investigators may interview only a few key witnesses whereas in complex cases involving systemic issues, workplace culture problems, or allegations affecting multiple employees, the number of witnesses can be substantially higher.

Investigators typically prioritise interviewing individuals who have direct knowledge of the events, those who may have witnessed relevant behaviour, and persons who can provide context about workplace dynamics or the Respondent’s conduct patterns. The selection of interviewees should be proportionate to the seriousness of the allegations and necessary to ensure a thorough investigation.

Under Norwegian law, employers have limited recourse when employees refuse to participate in HR internal investigations. However, the employment relationship creates certain obligations that can be leveraged.

For employees, the duty of loyalty (lojalitetsplikt) under the employment contract typically requires co-operation with legitimate workplace investigations. Employers can instruct employees to participate in investigations as part of their work duties. Failure to comply with such reasonable instructions may constitute a breach of employment obligations and could potentially lead to disciplinary measures, including termination in serious cases.

However, this obligation has important limitations. Employees retain the right against self-incrimination, and they cannot be compelled to provide information that might expose them to criminal liability. Additionally, employees have the right to be accompanied by legal counsel or other representatives during interviews.

For non-employees or external witnesses, investigators have no legal authority to compel participation. In such cases, investigators must rely on voluntary co-operation and may need to adjust their investigation methodology accordingly, potentially seeking alternative sources of information or evidence.

Norwegian law and practice permit interviews to be conducted remotely using video conferencing platforms such as Teams, Zoom or similar technologies. This flexibility has become increasingly common, particularly following the COVID-19 pandemic, and is generally accepted as a legitimate method for conducting HR internal investigations.

Remote interviews may be particularly appropriate in certain circumstances, such as when participants are located in different geographical areas, when health considerations make in-person meetings inadvisable or when scheduling constraints make remote participation more practical.

Investigators should consider several factors when deciding whether to conduct interviews remotely:

• the sensitivity and complexity of the allegations, which may favour in-person interviews to ensure better communication and rapport;
• technical requirements and the interviewee’s comfort with technology;
• the need to ensure confidentiality and prevent unauthorised recording or observation, including that no unauthorised persons are present during the interview either digitally or physically; and
• the ability to properly identify the interviewee and ensure they are speaking freely.

When conducting remote interviews, investigators should ensure that appropriate technical safeguards are in place, including secure platforms, proper identification procedures and clear protocols for recording and documentation. The same procedural rights and protections that apply to in-person interviews, including the right to legal representation and protection against self-incrimination, apply equally to remote interviews.

Interviewees should be informed in advance if the interview will be conducted remotely and should be given the opportunity to request an in-person meeting if they have concerns about the remote format.

The meeting may be digitally recorded for transcript/minutes (see 3.9 Minutes).

Norwegian practice does not prescribe specific rules regarding the number of interviewers or their characteristics, but several practical considerations guide best practice.

Typically, interviews are conducted by two investigators to ensure proper documentation and provide mutual support during the process. This approach also helps maintain objectivity and reduces the risk of misunderstandings or disputes about what was said during the interview.

While there are no mandatory rules about interviewer gender, investigators should be sensitive to the nature of the allegations. For example, in cases involving sexual harassment or gender-based discrimination, it may be appropriate, if possible, to include an interviewer of the same gender as the complainant or to offer the interviewee a choice in this regard.

Objectivity and independence are fundamental requirements for all investigators. They must be free from conflicts of interest and should not have personal relationships with the parties involved. This should also be addressed at the outset of the interview so that the interviewee may comment on this.  Investigators should possess appropriate competence and experience in conducting workplace investigations.

Seniority considerations may be relevant depending on the organisational context and the level of the individuals involved in the investigation. However, the primary focus should be on ensuring that investigators have the necessary skills, independence, and authority to conduct a thorough and fair investigation.

While Norwegian practice does not generally require the presence of a neutral third party during investigation interviews, there are specific circumstances where such presence may be advisable or necessary.

A neutral witness may be appropriate in particularly sensitive cases, such as those involving serious allegations of sexual harassment, violence, or other criminal conduct. The presence of a neutral party can help ensure proper conduct during the interview and provide additional documentation of the process.

In some cases, organisational policies or collective bargaining agreements may require or permit the presence of a neutral observer, such as a representative from HR, the health and safety representative, or a union employee representative, particularly when interviewing employees who are union members.

The decision to include a neutral third party should balance the need for thorough investigation with the comfort and rights of the interviewee. If a neutral party is present, their role should be clearly defined and limited to observation rather than active participation in the questioning process.

Any neutral third party must be bound by the same confidentiality requirements as the investigators and should not have any conflicts of interest related to the matter under investigation.

Support Person

Under Norwegian law and practice, interviewees have the right to be accompanied by a support person during HR internal investigation interviews. This right is considered fundamental to ensuring fair treatment and proper procedural safeguards.

The support person may be a colleague, union representative, friend or family member. For employees who are union members, they typically have the right to be accompanied by their union representative. The choice of support person is generally left to the interviewee, subject to practical considerations and potential conflicts of interest.

The support person’s role is primarily to provide moral support and assistance to the interviewee. They may help the interviewee understand questions, take notes, and provide emotional support during what can be a stressful process. The support person should not interfere with the investigation process or attempt to coach the interviewee’s responses.

Investigators should inform interviewees of this right at the outset and allow reasonable time for the interviewee to arrange for representation if desired. The presence of a support person should not delay the investigation unreasonably, but investigators should accommodate reasonable requests for accompaniment.

The support person must agree to maintain confidentiality regarding the investigation and should not have conflicts of interest that could compromise the investigation’s integrity.

Lawyer

Interviewees have the right to be accompanied by a lawyer during interviews in HR internal investigations. This right is considered fundamental to ensuring proper legal safeguards and due process protection for individuals who may be affected by the investigation’s outcome.

Employers must inform interviewees of their right to legal representation at the outset of the investigation process. This information should be provided in writing when scheduling interviews, allowing sufficient time for the interviewee to arrange legal counsel if desired.

For employees who are Respondents, the employer typically covers reasonable legal fees. This obligation stems from the principle that employees should not bear a personal financial burden when co-operating with workplace investigations related to their employment duties.

Legal representatives may attend interviews but generally observe rather than actively participate in questioning. The lawyer’s role is primarily to advise their client and ensure procedural fairness. Investigators should accommodate reasonable requests from legal counsel regarding interview procedures while maintaining the investigation’s integrity and efficiency.

Norwegian practice requires investigators to provide specific information to interviewees both at the start and at the end of interviews to ensure procedural fairness and transparency.

At the start of interviews, investigators should provide:

• information about the background and purpose of the investigation;
• details about the mandate and scope of the investigation;
• explanation of the interviewee’s rights, including the right to legal representation and the right against self-incrimination, explaining that they are not obligated to provide information that could expose them to criminal liability;
• information about how the interview will be conducted and documented;
• details about confidentiality obligations; and
• explanation of how the information provided may be used in the investigation.

Ideally, this information should also be provided in writing before the interview to allow the interviewee time to prepare and seek advice if needed.

For Respondents, additional information must be provided, including details about the specific allegations they may face and sufficient information to allow them to understand and respond to the concerns.

At the end of the interview, investigators should explain the next steps in the process, including how minutes will be prepared and the interviewee’s right to review and comment on the documentation.

Where an interviewee requests that an interview be stopped, investigators must respect this request and handle the situation appropriately.

Interviewees have the right to pause or terminate an interview at any time, particularly if they feel overwhelmed, need time to consult with legal counsel, or require a break for personal reasons. This right is fundamental to ensuring that the investigation process remains fair and does not become coercive.

When an interviewee requests to stop, investigators should:

• immediately cease questioning and respect the request;
• document the time and circumstances of the interruption;
• discuss with the interviewee whether they wish to reschedule the interview and ascertain whether they are declining to participate further;
• allow reasonable time for the interviewee to seek legal advice if requested; and
• ensure that no pressure is applied to continue against the interviewee’s wishes.

The circumstances and reasons for stopping the interview should be documented in the investigation file.

If the interview is paused rather than terminated, investigators should arrange for resumption at a mutually convenient time, allowing the interviewee adequate time to prepare or seek advice.

For employees, while they generally have a duty to co-operate with legitimate workplace investigations, this must be balanced against their rights to fair treatment and protection against self-incrimination. Investigators should work with the interviewee to find an appropriate way forward that respects both the investigation’s needs and the individual’s rights.

Minutes are routinely taken during interviews in Norwegian HR internal investigations and specific procedures should be followed to ensure accuracy and fairness.

Summary minutes are generally acceptable and commonly used, as they capture the essential content of the interview without requiring verbatim transcription. The minutes should accurately reflect the key points discussed, questions asked, and responses given.

Interviewees have the right to review the minutes of their interview. This right is fundamental to ensuring accuracy and providing an opportunity for correction or clarification. The Norwegian Bar Association’s guidelines emphasise that interviewees should be given access to review their interview documentation.

Interviewees should be provided with a reasonable opportunity to comment on the minutes and to suggest corrections or additions. Where the interviewee disagrees with the content or wishes to add clarifications, these should be noted in the final version of the minutes.

While interviewees are not typically required to sign the minutes, they may be asked to confirm their accuracy or provide written comments. Any corrections or additional remarks from the interviewee should be incorporated into the final documentation.

There is no specific requirement for an external party to take minutes, but the person taking minutes should be independent of the subject matter and maintain appropriate confidentiality. In practice, minutes are often taken by one of the investigators or an administrative assistant who is bound by confidentiality obligations.

The minutes should be prepared promptly after the interview and provided to the interviewee within a reasonable timeframe for review and comment.

Interviews in Norwegian HR internal investigations may be recorded, and this practice is becoming increasingly common. Recording provides an accurate record of the proceedings and helps ensure proper documentation of the investigation process.

Interviewees must be informed in advance if the interview will be recorded. This notification should be provided in writing when scheduling the interview, allowing the interviewee to prepare accordingly and seek legal advice if desired.

Where interviews are recorded, investigators typically produce written minutes or summaries rather than full verbatim transcripts. These documents capture the essential content of the interview while maintaining readability and focus on relevant information.

Recordings and any transcripts produced are considered internal investigation documents and are subject to strict confidentiality requirements. They are typically not shared with the employer but remain with the investigators. However, information from the recordings may be referenced or quoted in the final investigation report. The recordings serve primarily as a tool for investigators to ensure accuracy in their documentation and may be retained for the duration of the investigation and any subsequent proceedings, subject to data protection requirements. The recordings should be deleted after the minutes are approved.

Interviewees have the right to review and comment on the written minutes or summaries prepared from their recorded interviews (see 3.9 Minutes). Any corrections or clarifications requested by the interviewee should be incorporated into the final documentation.

In addition to interviews, Norwegian HR internal investigations may employ various other fact-finding methods, subject to legal limitations and practical constraints.

Permissible fact-finding methods include:

• document review and analysis of relevant business records, emails and communications;
• review of electronic data, subject to privacy laws and email inspection regulations;
• analysis of CCTV footage or other security recordings where available and legally accessible;
• review of personnel files, performance records and disciplinary history;
• examination of relevant policies, procedures and training records;
• site inspections or workplace observations where relevant; and
• review of financial records or expense reports in cases involving potential misconduct.

However, private investigators face significant limitations compared to law enforcement:

• no power to compel document production from third parties;
• no search and seizure authority;
• limited access to personal communications without consent;
• no authority to conduct searches of personal property; and
• restrictions on accessing private financial information.

Special considerations apply to electronic data collection (see 7. Data Protection).

When third-party information is needed, investigators must rely on voluntary co-operation or formal legal processes such as evidence preservation procedures under the Dispute Act, though these are rarely used in HR investigations.

Under Norwegian law, the employer has an express duty to act and exercise care towards the Reporter. The employer must particularly ensure that the Reporter has a fully satisfactory working environment and must, if necessary, implement measures to prevent retaliation against the Reporter, both during and after an investigation. The duty of care may extend to protection of mental health, integrity, dignity, and the climate for freedom of expression. For example, the employer may need to act to ensure that the Reporter is not ostracised in the workplace community, and as a general principle, the Reporter’s identity shall never be disclosed more than absolutely necessary.

Retaliation against any employee who has reported a notice of concern is prohibited. Retaliation means any adverse action, practice or omission that is a consequence of or a reaction to the employee having reported, including, but not limited to, threats, harassment, unjustified differential treatment, social exclusion, warning, change in work duties, reassignment, suspension, termination, summary dismissal or disciplinary measures.

Where the working environment of a Reporter is not fully satisfactory as a result of, or in connection with the fact that a notice of concern has been made, this would be considered retaliation, which is unlawful under Norwegian law. Intentional or negligent violation of the WEA’s provisions on health, environment, and safety may also result in criminal liability or fines.

Where the employer fails to protect the Reporter in accordance with the law, the employee may claim compensation and damages from the employer without showing fault. That said, the employer is not required to implement disproportionately costly measures.

Under Norwegian law, the employer also has duties towards the Respondent. The employer must safeguard the Respondent’s legal rights and ensure both the right to be heard and necessary confidentiality for the Respondent. This entails that the employer has established whistle-blowing procedures for handling the case, and that the Respondent has the right to contradict the allegations and factual statements given by the Reporter. The Respondent also has the right to access the case information and documentation, balanced with the protection of the Reporter’s identity to the extent possible.

Where the Respondent is also an employee, the employer must ensure that the Respondent also has a fully satisfactory working environment, both during and after an investigation. The employer has no duty to enter into confidentiality agreements with those involved in a whistle-blowing case, nor is this common practice in Norway. As the WEA is primarily mandatory law, any agreement that deviates from the WEA to the detriment of an employee will in most cases not be valid.

The employer should seek to resolve the whistle-blowing of concern at the lowest level but may not protect the Respondent by failing to escalate the case to a higher level where necessary. Escalation may be necessary in serious matters, such as sexual harassment.

Where the Respondent does not have a fully satisfactory working environment, the employer may face claims for damages and compensation, administrative sanctions from the Labour Inspection Authority (Arbeidstilsynet) as well as criminal liability or fines.

The employer may, by virtue of the employer’s managerial prerogative, implement necessary measures in respect of a Respondent in a whistle-blowing case, even before the investigation has been concluded. Such measures are justified by the employer’s duty of care for its employees and the obligation to ensure a fully satisfactory working environment. Such measures may include, for example, temporary reassignments, changes to work duties, or measures to secure evidence. In cases where there may be a risk to life and health, or where there is reason to suspect criminal conduct that should be reported to and investigated by the police, the employer will often have a duty to implement measures, even while the whistle-blowing case is still under review.

Where the employer has a concrete basis to suspect that the Respondent has committed any acts that may constitute grounds for summary dismissal, and the needs of the business so require, the employer may suspend the Respondent while the matter is being investigated. This applies only where there is reason to believe that there has been a serious breach of duty or other material breach of the employment agreement and where less stringent measures are insufficient to address the situation.

Where the employer has reasonable grounds to believe that circumstances constituting grounds for summary dismissal exist, the employer may require the Respondent to cease work with immediate effect, even if the whistle-blowing investigation has not been concluded. Such action requires concrete evidence of serious misconduct that justifies immediate removal from the workplace.

Where the employer implements measures against a Respondent, and it subsequently transpires that such measures were not necessary, proportionate, or lawful, the employer may face claims for damages and compensation from the affected employee.

Where an employer fails to implement necessary measures against a Respondent in circumstances where such measures were required to ensure a fully satisfactory working environment, or to prevent retaliation against the Reporter or other employees, the employer may face claims for damages and compensation.

Under Norwegian law, the employer must protect all employees and generally ensure that they all have a fully satisfactory working environment. Where a whistle-blowing case prevents a fully satisfactory working environment for other employees, the employer has a duty to implement necessary and proportionate measures. The specific measures will depend on the severity of the case and must be assessed to ensure they are proportionately balanced between severity and necessity.

If the employer fails to fulfil its duty to ensure a fully satisfactory working environment for its employees, the employer may face claims for damages or compensation, and in certain serious cases, criminal liability and fines. The same applies if the employer implements measures that are disproportionate in relation to the Respondent.

The WEA sets out only limited concrete requirements for the employer’s investigation of whistle-blowing notices.

Certain fundamental principles are emphasised, for example:

• A fair process must be conducted within a reasonable timeframe.
• The process must ensure legal certainty and predictability.
• The presumption of innocence must be maintained.
• The Respondent must be notified of the allegations.
• The Respondent must be given the opportunity to respond and present their defence, including the right to verify and challenge evidence (contradiction).
• The Respondent must be protected against self-incrimination.
• the Respondent has the right to legal representation.

Failure to comply with these procedural requirements may result in sanctions, including invalidation of measures taken, liability for damages, reputational harm, and workplace environment challenges.

The employer may establish internal regulations that impose additional procedural requirements. Such regulations are binding on the employer once implemented. Non-compliance with internal regulations may result in the same consequences as failure to comply with statutory requirements, including invalidation of measures taken and potential liability for damages.

The allocation of the burden of proof varies depending on the nature of the whistle-blowing matter. Where the qualification of a statement or action as a notice of concern is disputed, the burden lies on the employer to prove that the report does not comply with the applicable legal requirements. In cases involving alleged retaliation, the burden of proof is shared: the employee must present evidence suggesting that retaliation occurred, whereupon the burden shifts to the employer to demonstrate that the contested actions were not taken in response to the notice of concern.

The relevant standard of proof depends on the nature of the investigation and the character of the allegations. While the ordinary balance of probabilities serves as a starting point, a higher standard of proof may be applied where the assessment could result in substantial criticism or significant legal consequences for the person concerned.

There are no specific rules in Norwegian law governing when an HR internal investigation may be ended. The employer must assess when sufficient information has been obtained to conclude, but generally a case involving a notice of concern should not take longer than necessary, and the employer should have completed the investigation within a reasonable timeframe.

As mentioned in 1.1 Circumstances, the extent of the investigation will vary from case to case. In some cases, it is possible to conclude after a preliminary investigation.

Norwegian law does not prescribe specific procedural requirements that must be followed at the end of an HR internal investigation; however, it is advisable to inform the Reporter and the Respondent of the outcome (see 6.5 Information).

Whilst investigation into a notice of concern may identify workplace issues, such investigations rarely provide resolution for those issues. At the conclusion of any case involving a notice of concern, the need for remedial measures relating to the matters reported, or the workplace more generally, should always be assessed.

Unless the business has specific guidelines regarding the conclusion as part of the established procedures for internal whistle-blowing, there are no specific rules governing the form that the conclusion must take. Internal processes are, however, based on a principle of proper case handling, and the conclusion should be traceable for the future. This means that the investigation should result in a written assessment/summary.

For investigations conducted by external investigators, recommendations regarding conclusion and outcome follow the guidelines of the Norwegian Bar Association. According to the guidelines, the assignment must be based on a mandate from the employer which shall also specify what outcome the investigation should result in. Normally this is a written report in response to the mandate.

Unless the business has specific guidelines regarding the conclusion as part of the established procedures for internal whistle-blowing, there are no specific rules governing the form that the conclusion must take. Internal processes are, however, based on a principle of proper case handling, and the conclusion should be traceable for the future. This means that the investigation should result in a written assessment/summary.

For investigations conducted by external investigators, recommendations regarding conclusion and outcome follow the guidelines of the Norwegian Bar Association. According to the guidelines, the assignment must be based on a mandate from the employer which shall also specify what outcome the investigation should result in. Normally this is a written report in response to the mandate.

According to the guidelines from the Norwegian Bar Association, the parties “affected” by the HR internal investigations have the right to be notified of the outcome of the investigations affecting them, but they do not have the right to receive the full report. The affected parties also have the right to be informed of the outcome before, or at the same time as, the final report is ready. This right may only be varied under special circumstances.

The term “affected” implies that the investigation and its outcome must have significance for the individual’s situation and is decided on a case-by-case basis.

The Reporter may have a right of access under data protection rules. It is recommended that employers have internal procedures for handling such access requests. The Respondent also has a right of access to personal data concerning them. For more details on access to personal data, see 7.3 Access.

There are no statutory procedures imposing a duty on the employer to report a notice of concern to the police, but where there is suspicion of criminal offences the employer should consider referring the matter to the police as soon as possible, especially considering potential contamination of evidence/witnesses if the internal investigation continues. See also 8.4 Criminal Cases,regarding criminal cases.

There may be a duty to report if there is a breach of personal data security, in which case the appropriate authority is the Norwegian Data Protection Authority.

There is no statutory duty to provide information after investigations have been completed. Information to other parties should be limited to what is necessary, having regard to rules on data protection, confidentiality and proper conduct. See also 6.5 Information on the information provided to affected parties in a whistle-blowing case.

There are several types of sanctions available to the employer following the conclusion of a case involving a notice of concern. The WEA regulates the rules on suspension, dismissal and summary dismissal. Such formal and statutory sanctions may be a response following a concluded case involving a notice of concern, but this requires that the conditions in the WEA are met. Generally, it is not lawful to terminate the employment relationship unless there is objective cause. There is no requirement as to how quickly an employee can be dismissed following a concluded HR internal investigation, but the seriousness of the offence and choice of sanction will have an impact.

In Norway, there are also non-statutory rules governing the issue of warnings in employment relationships, which may also constitute a form of sanction after an HR internal investigation has been concluded. In addition, the employer may make changes to the employment relationship, for example, by removing certain areas of responsibility from the individual concerned. Such sanctions are not regulated by statute, but generally it is important that the employer acts in accordance with the requirement of objective cause, and may also constitute a retaliation against the Reporter.       

It is important that employers take all reasonable steps to safeguard the working environment during and after a process involving a notice of concern. A whistle-blowing process may, depending on the specific circumstances, have a significant and negative impact on the working environment. Relevant measures may include, for example, providing information about the process and any steps that have been taken, providing training or courses, introduction or revision of policies, and mediation between parties.

The employer may collect personal data for the purpose of an HR internal investigation, provided that the collection complies with the requirements of the GDPR (General Data Protection Regulation – Regulation (EU) 2016/679) and specific regulation on control measures laid out in the WEA. In particular, the employer must:

• mention such purpose in its record of processing activities;
• consult with employee representatives regarding the need for, design of, and implementation of the control measure as early as possible, in accordance with the WEA Section 9-2;
• unless the investigation is based on a legal obligation, conduct a legitimate interest assessment, comparing the interest of the employer in conducting the processing versus the interests and rights of the relevant employees;
• if the processing may give rise to a high risk for the relevant employees (depending on the consequences and type of data collected), conduct a data protection impact assessment;
• only collect the data that is necessary for the purposes of the investigation;
• keep the data only for as long as it is necessary, which must be subject to a concrete assessment;
• inform the relevant data subjects of the collection and processing of personal data in compliance with Articles 13 or 14 of the GDPR, and fulfil certain consultation and information obligations under Chapter 9 of the WEA, including informing affected employees about the purpose of the control measure, the practical consequences including how it will be implemented, and the expected duration;
• ensure that the investigation is proportionate, not subjecting employees to unnecessary inconvenience or loss;
• ensure that the control measure is not degrading to the employee and cannot be achieved through other less intrusive means;
• respect the purpose limitation principle – personal data collected for one purpose cannot be used for subsequent purposes that are incompatible with the original purpose without the employee’s consent;
• exercise particular caution when collecting health information or other special categories of personal data, ensuring compliance with GDPR Article 9 and the WEA Section 9-3, and only requesting such information when strictly necessary; and
• if data may be transferred outside the EEA, implement adequate safeguards, such as conducting a data transfer impact assessment and entering into Standard Contractual Clauses (SCCs) with the data importer outside the EEA.

It is highly recommended to include the requirements set out above in an employee privacy policy as well as in a whistle-blowing policy.

Specific rules apply to access to employee email accounts or the employee’s private areas in the employer’s data systems.

• Access may only be gained if it is necessary for the legitimate interests of the employer or if the employer has reason to believe that the employee’s use of the email account constitutes a material breach of the employee’s duties.
• Prior to gaining access, the employee must be informed and given the opportunity to object. The employee shall, as far as possible, be given the chance to participate while the email account or private area is accessed.

Subject to Article 15 of the GDPR, in principle anyone is entitled to information regarding the processing of their personal data, including “a copy of the personal data undergoing processing”. However, this does not mean, for example, that the Respondent is automatically entitled to information on the Reporter’s identity. In accordance with case law (for example, LB-2024-058268), the employer must balance the Respondent’s need for information and ability to exercise their right to object with the obligation to secure a fully satisfactory physical and psychosocial working environment for the Reporter and other involved employees.

Accordingly, the Respondent shall always have the right to know the specific allegations put forward so that they are able to defend themselves; however, the identity of a Reporter or witnesses should generally not be disclosed to a Respondent without the consent of the former.

Use of AI in HR Internal Investigations

The use of AI in HR internal investigations is growing. Some employers have started to use AI tools to handle internal investigations, particularly for sorting and reviewing large volumes of information. However, the extent of adoption varies significantly, with some organisations not using any AI in their internal investigations at all and others, particularly larger employers, using it extensively.

Common uses of AI include:

• automated review of emails, documents and internal communications;
• identification of relevant patterns and correlations when reviewing large volumes of documents; and
• relevance-based filtering and prioritisation of information.

Data Protection Considerations When Using AI

Employers must carefully address a number of significant data protection considerations when using AI in HR internal investigations.

It is critical that employers safeguard personal data when using AI tools. This necessitates ensuring that the consequences of using AI are thoroughly assessed. Employers should use data protection impact assessments where necessary and ensure that privacy safeguards are implemented in internal AI systems. Employers must establish a clear, lawful basis for processing. They must also fulfil their transparency obligations towards employees and ensure that only necessary data is processed. Furthermore, it is essential to maintain robust data security, particularly when engaging external providers. Meaningful human oversight must also be preserved to ensure that significant decisions are not made solely on the basis of automated processing.

By appropriately addressing these data protection considerations, employers can effectively leverage AI as a valuable tool in the conduct of HR internal investigations.

Whistle-blowing is regulated by Chapter 2A of the WEA, which provides employees with the right to report whistle-blowing by giving a notice of concern. The WEA also sets out rules for the procedure for notices of concern, the employer’s duty to act, the prohibition against retaliation against the person reporting, the duty to have whistle-blowing procedures in place and other related matters.

See 1.2 Bases for further information.

Chapter 4 of the WEA contains a statutory prohibition against harassment, including sexual harassment. Sexual harassment means any form of unwanted sexual attention that has the purpose or effect of being offensive, frightening, hostile, degrading, humiliating or troublesome. The attention may be verbal, non-verbal or physical.

Breach of the prohibition against sexual harassment may give rise to a right to compensation.

See also 8.3 Other Forms of Discrimination and/or Harassment regarding other forms of discrimination.

The employer must ensure a fully satisfactory working environment, both physical and psychological.

Chapter 4 of the WEA contains a prohibition against harassment. Harassment means actions, omissions or statements that have the purpose or effect of being offensive, frightening, hostile, degrading or humiliating.

The WEA also contains a prohibition against discrimination. The grounds of discrimination covered by the law are:

• political views;
• membership in an employee organisation;
• age;
• part-time employment; and
• temporary employment.

Breach of the prohibition against discrimination may result in claims for damages and compensation, regardless of whether the employer is at fault.

Norway also has a separate Equality and Anti-Discrimination Act. This Act applies to all areas of society and prohibits discrimination on the grounds of:

• gender;
• pregnancy;
• parental leave in connection with birth or adoption;
• care responsibilities;
• ethnicity, religion, belief;
• disability;
• sexual orientation, gender identity, gender expression;
• age; or
• other significant circumstances relating to a person.

Discrimination includes both direct and indirect differential treatment. As protection against discrimination, the Act contains several prohibitions, such as prohibition against retaliation and prohibition against harassment. In addition, the Act contains requirements for active equality in the workplace.

To provide effective protection against discrimination, Chapter 6 of the Act contains a rule on shared burden of proof.

There is no general duty for employers to report criminal offences to the police, but the employer should consider doing so where a notice of concern relates to possible criminal conduct. Where a police investigation is initiated, the internal investigation may continue in parallel, but the employer should be aware that the police investigation may affect the internal process. It may be appropriate to engage in dialogue with the police regarding how to proceed. The employer must also consider whether it is necessary to implement interim measures to protect employees and the workplace whilst the investigation is ongoing. The internal investigation may also affect the seizure of potential evidence in the criminal case.

During an HR internal investigation, the privilege against self-incrimination must also be considered. Information obtained in an HR internal investigation may be used in subsequent legal proceedings, such as police investigations. It is therefore particularly important to operate in accordance with the privilege against self-incrimination if the matter is or may be of a criminal nature.

There are no special procedural requirements that an employer must follow in cases involving multiple jurisdictions. However, it is important that employers comply with the rules relating to data transfers across borders (see 7. Data Protection for further information on data protection).

For investigations involving employees in several countries, the employer should consider engaging legal assistance in each/all relevant jurisdictions.