HR Internal Investigations 2026 Comparisons

An HR internal investigation is typically preceded by complaints or other reports filed by employees, either orally or in writing. The forum for such complaints varies; it can be the employer’s whistle-blowing channel or other reporting channels, or a report can be made directly to HR, a manager or any other company representative. The nature of such complaints varies; typical matters are sexual harassment or harassment, bullying or victimisation, and other work environment-related issues such as stress or co-operation issues.

HR internal investigations can also be initiated in connection with an internal audit or equivalent, and/or due to suspicions of other crimes by employees (fraud, embezzlement, etc), other severe misconduct or violations of company policies (breach of authorisation procedures or the code of conduct, etc).

There are no laws stipulating that an employer must have legal bases in order to conduct an HR internal investigation. There are, however, some situations that trigger an obligation to initiate and conduct an investigation.

• When receiving a whistle-blowing report, employers are required to handle and investigate it according to the obligations stipulated in the Swedish Whistleblowing Act (2021:890).
• Under the Swedish Discrimination Act (2008:567), employers have a legal obligation to investigate sexual harassment or harassment related to a protected characteristic. Such an investigation is required when the employer becomes aware that an employee, intern or hired worker considers themselves to have been subject to harassment or sexual harassment, in connection with work, by someone who performs work or has an internship with the employer. Failure to conduct such an investigation implies an obligation to pay discrimination fees to the affected employees.
• Employers are also responsible for the health, safety and well-being of their employees within the framework of the Swedish Work Environment Act (1977:1160) and the provisions issued by the Swedish Work Environment Authority. Pursuant to this framework, employers are obliged to ensure that the employees are not affected by ill health or exposed to other safety risks. Therefore, they have an obligation to investigate cases of victimisation and bullying, for example. Such investigations shall include assessments of potential work environment risks and actions to prevent future similar incidents.
• An internal investigation should also be conducted by employers if such an obligation is specified in internal policies or other procedures.

It is recommended that employers, at their own discretion, investigate all circumstances, irregularities or similar issues that may result in the employer having to impose labour law sanctions such as dismissal or termination. This enables them to take an informed decision on an appropriate labour law sanction (if any), and to defend and present evidence in any subsequent legal claims and/or disputes in court.

Under the Whistleblowing Act (2021:890), private as well as public employers with 50 or more employees are obligated to implement and maintain a whistle-blowing channel for oral and written reports about irregularities that have been observed in a work-related context, and which concern matters that are of public interest to disclose and/or concern violations of relevant Union acts. Specific procedures shall apply for such reporting, and for following up reports.

Any incoming whistle-blowing report shall be managed by an independent and impartial person or function. The identity of any reporting person is protected by statutory confidentiality provisions, but there is no statutory requirement that anonymous reports be permissible. In general, however, employers allow anonymous reporting. If the reporting person chooses to be anonymous, it may be difficult for the employer to follow-up on the report with the reporting person.

There are no legal rules stipulating who should be responsible for carrying out an HR internal investigation in Sweden. It should, however, be noted that whistle-blower reports made through the whistle-blowing channel should be handled by independent and impartial persons or functions that have been assigned to manage the channel in accordance with the Whistleblowing Act (2021:890).

As HR internal investigations should be conducted with discretion and objectivity, it is recommended that an unbiased company representative with adequate knowledge be appointed to conduct the investigation. This is typically an HR representative or equivalent, but could also be another appropriate representative depending on the circumstances at hand.

External counsels are generally recommended, especially in investigations that are complex, comprehensive or in any other way require an investigator with legal knowledge and experience. Other forms of external help could be required if the investigation necessitates expertise in accounting (ie, in case of suspicion of economic misconduct) or computer forensics (ie, if there is a need to investigate computers, emails, etc) to obtain evidence.

Furthermore, an external investigator should always be engaged if there is a risk that the objectivity of an internal investigator could be questioned. Employers are not prevented from engaging an employment lawyer that the company uses as an external investigator. The employment lawyer is also not prohibited from representing the employer in any disputes or other claims against the company that may occur after the investigation is conducted.

An investigation must always be carried out when the employer receives:

• a whistle-blowing report within the scope of the Whistleblowing Act (2021:890);
• information about an employee feeling harassed due to a protected characteristic, or being sexually harassed by a colleague or someone who performs work for the employer in accordance with the Discrimination Act (2008:567); or
• information about potential victimisation or bullying leading to ill health at the workplace in accordance with the Work Environment Act (1977:1160) and the Planning and Organisation of the Work Environment Management (2023:2) provisions issued by the Swedish Work Environment Authority.

Generally, Swedish law does not prohibit HR internal investigations. However, if the investigation concerns suspected money laundering or financing of terrorist activities, the employer may be prohibited from alerting the suspect as to their suspicion, and thus from carrying out an internal investigation in accordance with the Money Laundering and Terrorist Financing Prevention Act (2017:630). In such cases, the employer must instead report their suspicions to the relevant authorities.

It is recommended that employers, at their own discretion, investigate all circumstances, irregularities or similar issues that may result in the employer having to impose labour law sanctions such as dismissal or termination. Such sanctions/measures require legal grounds to be permissible, and a well-conducted investigation should form the basis therefor. A well-conducted investigation may also constitute evidence in disputes or claims with the employees concerned.

A reporter that submits a reports through the employer’s whistle-blowing channel within the scope of the Whistleblowing Act (2021:890) is entitled to receive confirmation of receipt of the report within seven days, as well as information about any follow-up action within three months.

For reports made outside of the whistle-blowing channel, there is no explicit statutory right to be informed about an investigation. The reporter, should, however, be promptly informed as to whether the employer has initiated an investigation, as well as about the process going forward. The reporter should also be informed about the conclusion of the report as well as any measures taken, or that will be taken, as a result of the investigation. The person who is subject to the allegations – ie, the respondent – should be notified as soon as the allegations are substantiated.

Additionally, Regulation (EU) 2016/679 (the General Data Protection Regulation; GDPR) stipulates a general right to be informed of the collection and processing of personal data, including in connection with an investigation (Articles 12 and 13). However, such information will, in most cases, already have been provided to the employees through the employer’s privacy notice and, as such, no specific information needs to be provided to the reporter and/or the respondent in connection with an investigation.

There is rarely an obligation to report circumstances in connection with the opening of an internal HR investigation. However, there are certain situations where such an obligation may exist.

• The Work Environment Act (1977:1160) requires the reporting of serious workplace accidents and/or incidents. Specific examples include an employee who has been physically injured in the workplace, or who has attempted to harm themselves as a result of victimisation or bullying in the workplace. Such reports must be made to the Swedish Work Environment Authority.
• For employers within the financial sector, there may be an obligation to report any issues relating to, for example, money laundering, to the Swedish Finance Police, as stipulated in the Money Laundering and Terrorist Financing Prevention Act (2017:630). There may also be further reporting obligations for public employers – eg, grievances in relation to healthcare. For information about police reports, see 8.4 Criminal Cases.
• If, in connection with an internal investigation, a personal data breach has occurred – ie, a security incident that leads to unauthorised disclosure of or unauthorised access to personal data – there is an obligation for the employer (if they are the data controller) to report this to the Swedish Authority for Privacy Protection in accordance with the GDPR (Article 33).

The parties involved in an investigation may be asked to sign confidentiality agreements and non-disclosure agreements (NDAs), but they are not obligated to sign them. Such requests are not common in Sweden, and there is no sanction against such parties if they refuse. It is recommended that the parties involved be asked to exercise the utmost discretion and keep all information confidential in relation to the investigation. Employees are bound by a duty of loyalty, which means that they may not disclose confidential information from the business, and they shall adhere to their employer’s instructions.

It should be noted that an employee reporting any misconduct or other circumstances that give rise to the opening of an internal investigation generally has the option of remaining anonymous. Such anonymity is possible in relation to any accused individual, but not in relation to the investigator. It may, however, be difficult to maintain anonymity in practice, as statements can be directly linked to a reporting individual or witness. If employees refuse to participate for other, non-legitimate reasons, they should be informed of their obligation to follow their employer’s instructions; otherwise, it may constitute refusal to work.

It is possible, and in fact recommended, to conduct an initial investigation, for example to explore the substance of the allegations made, determine the process and format of the investigation, and assess whether it is necessary to take any other adequate investigatory measures. A preliminary investigation can also be used to assess compliance with certain time requirements, such as the requirement for urgency under the Discrimination Act (2008:567) or the requirement for confirmation of receipt and follow-up within a certain timeframe under the Whistleblowing Act (2021:890). The Employment Protection Act (1982:80) imposes requirements that any termination or summary dismissal may not be based solely on circumstances that were known to the employer more than two months before notice of termination or summary dismissal was given. A preliminary investigation or equivalent measure is generally conducted.

The persons interviewed within an HR internal investigation are typically:

• the person making the allegations or who has been subject to misconduct – ie, the reporter;
• any witnesses; and
• the accused – ie, the respondent.

It is recommended that these persons be interviewed in the order laid out in the foregoing list. This is to ensure that the allegations presented to the respondent during his or her interview are as complete as possible.

An HR internal investigation should involve the smallest group of people possible to assert the principles of discretion and confidentiality. If several witnesses are identified, all of them should be interviewed as a general rule. However, if a larger number of witnesses are available, the witnesses should be determined with consideration of the aforementioned principles of discretion and confidentiality, together with an assessment of whether each individual witness can contribute further to the investigation in terms of evidence. It is, for example, not necessary to interview a witness regarding a circumstance that is indisputable, or for which sufficient evidence has already been obtained.

Employees are in general obligated to participate in an HR internal investigation conducted by their employer. However, they may refuse due to discomfort, fear of retaliation, etc. The actions recommended against employees who refuse to participate depend on who is refusing and why. For employees with a particularly legitimate reason for refusal, typically the reporter or a witness, it is recommended that the employer emphasise the purpose of the investigation, that the investigation will be conducted discreetly, and that the complainant and witnesses have the option of remaining anonymous in relation to the accused, but not in relation to the investigator. Such anonymity may, however, be difficult to maintain in practice, as statements can be directly linked to a complainant or witness. If there is any legal protection against retaliation, the employee should be informed about it.

If employees refuse to participate for non-legitimate reasons, they should be informed of their obligation to follow their employer’s instructions; otherwise, this may constitute refusal to work.

Swedish law does not explicitly stipulate the format for HR internal investigations – eg, regarding interviews or the collection of other forms of evidence. Employers should conduct internal HR investigations in the manner that is most suitable in each individual case. Any interview conducted must, however, comply with:

• the rules regarding confidentiality and protection of reporting persons, as stipulated in the Whistleblowing Act (2021:890);
• the health and safety regulations in the Work Environment Act (1977:1160) and the provisions regarding Planning and Organisation of the Work Environment Management (2023:2) issued by the Swedish Work Environment Authority; and
• the procedure for processing personal data under the GDPR.

Further, the principles of objectivity, discretion and confidentiality should always be considered.

Interviews can be carried out remotely via digital platforms such as Teams, although interviews in person are, as a general rule, preferred and recommended.

There are no explicit rules regarding the number of interviewers, but for practical reasons, there should generally be two people conducting the interviews. This facilitates the taking of notes, asking of appropriate and adequate questions and, where necessary, avoidance of ambiguous or unclear statements, misunderstandings, etc. The latter can be facilitated by recording the interview; please see 3.10 Recording. Having more than two interviewers is typically not recommended, as the interviewee may perceive the situation as unbalanced and more uncomfortable than necessary, which could negatively affect the interview.

The persons conducting the interviews are typically the same as the investigators, and they should, in addition to being objective, possess adequate seniority, experience and knowledge of interview situations and the matter subject to investigation. Typically, it is also more appropriate for the person conducting interviews in highly sensitive cases, such as sexual harassment, to be of the same gender as the person who is alleged to have been subjected to improper behaviour.

Swedish law does not stipulate any direct prohibition against a neutral person participating in interviews in an HR internal investigation. If a neutral person is to participate for any reason, it is important to maintain the principles of discretion and confidentiality.

In general, there are no obstacles to interviewees bringing a support person or lawyer with them to the interview if they so wish. In the case of an interview with the reporter or another person subject to any misconduct, the presence of an unbiased support person can also be valuable, as it can help the interviewee feel more comfortable.

Normally, a respondent would not bring a lawyer or other legal representative unless they request this specifically. If the investigation is conducted by an external lawyer, he or she will encourage the respondent to bring legal representation as this is stipulated in the Swedish Bar Association’s Code of Conduct. It is important to ensure that an interviewee’s request to bring a support person or lawyer is not used to delay the investigation or otherwise negatively affect its efficiency.

It is recommended that the interviewers begin by introducing themselves and explaining their role, the purpose of the investigation, any investigative obligations on the part of the employer and the role of the interviewee in the investigation. If whistle-blowing rules apply, the employer’s obligations under the Whistleblowing Act (2021:890) regarding confidentiality, protection, reporting requirements, etc, may be mentioned.

Furthermore, the interviewee should be informed about the process going forward and how any potential follow-up will be disclosed to the individuals concerned. If an external lawyer is conducting the investigation or interviewing, the interviewee should be informed that the lawyer in question does not represent them, as this is stipulated in the Swedish Bar Association’s Code of Conduct. It may also be useful to provide information about practical details such as possible recording, signing of statements, etc. The interviewee should also be asked, or reminded, to exercise the utmost discretion regarding information they are already cognisant of or learn of via the investigation.

The GDPR stipulates a general right to be informed about the collection and processing of personal data, including in connection with the interview (Articles 12 and 13). However, such information is in most cases provided in advance through the employer’s privacy notice if the interviewee is an employee. If so, no specific information needs to be provided to the interviewee.

Employees are in general obligated to participate in interviews within the scope of internal investigations conducted by their employer. This falls within the employer’s right to lead and manage the work. It is normally not a problem to give an interviewee a short break during the interview and resume the interview thereafter. The employer’s responsibility for the work environment includes ensuring the well-being of their employees following the Swedish Work Environment Act (1977:1160) and the provisions issued by the Swedish Work Environment Authority.

If an interviewee, without legitimate reasons, refuses to resume the interview despite the employer’s instructions, the employer may draw reasonable conclusions from such refusal. If necessary, the employer may also take appropriate disciplinary measures against the employee.

Minutes or similar may be taken during interviews in an HR internal investigation. However, there are no formal requirements under Swedish law for such minutes to be taken, nor any stipulation that they should be taken by a specific person or signed by the participants. The need for formal minutes depends on the individual situation, but the interviewers’ own notes are normally sufficient as a basis for the investigation. If there are any unclear circumstances, an interviewee has made an unclear or ambiguous statement, or a confession has been made during the interview, it is recommended that the interviewee be asked to approve such statements afterwards. In general, it is advisable to take minutes during any interviews in an HR internal investigation.

Note that specific requirements regarding minutes and the signing thereof apply with regard to reports made orally within the framework of the Whistleblowing Act (2021:890).

Interviews may be recorded; indeed, this is a standard and practical procedure. The recording is normally used solely for the investigator’s own purposes and is not shared with anyone else. If the interview is to be recorded, the interviewee should be informed and asked to consent to this beforehand. If the interviewee does not consent to the recording, no recording should be made. Any recording and subsequent handling thereof must comply with the rules and principles of personal data processing under the GDPR; please see 7.1 Collecting Personal Data.

There may be other evidence that is deemed appropriate to gather within the scope of the investigation, depending on its nature. This may include written evidence such as email correspondence, text messages or internal chats. Such evidence can often be provided by the reporter or a witness. In other cases, it may be necessary to review the respondent’s email and retrieve evidence therein. Other possible fact-finding actions include reviewing the relevant internal regulations, code of conduct and other relevant policies or documents.

If the investigation concerns disloyal behaviour, such as competition with the employer’s business, misappropriation of trade secrets or other irregularities, it may be necessary to seek external expertise in computer forensics and/or engage an auditor to review the company’s accounts.

Any collection and processing of personal data, and the subsequent handling thereof, shall comply with the rules and principles of personal data processing under the GDPR; please see 7.1 Collecting Personal Data.

For reports that fall under the Whistleblowing Act (2021:890), the reporter is protected through confidentiality requirements, pursuant to which individuals involved in the follow-up of the report may not disclose the identity of the reporter unless such disclosure is necessary and proportional for the purposes of the follow-up. Additionally, employees who participate in such investigations are entitled to not be subjected to any retaliation related to the fact they have raised an alert or participated in an investigation. Examples of retaliatory actions include harassment, bullying, sidelining and related actions that may impact on career progression. A reporter that intentionally reports false information does not obtain protection as a whistle-blower.

Reporters that report violations of the Discrimination Act (2008:567), have been subject to harassment or sexual harassment and/or have participated in investigations are protected from retaliation by the employer. Employers who expose employees to, or fail to protect employees from, retaliation under the Whistleblowing Act or the Discrimination Act may be obligated to pay damages and/or discrimination compensation to the affected person.

Following the work environment responsibility stipulated in the Swedish Work Environment Act (1977:1160) and the provisions issued by the Swedish Work Environment Authority, employers are responsible for the well-being of their employees, and are obliged to ensure that they are not affected by ill health or exposed to other safety risks. Thus, if the reporter’s health and safety is at risk, adequate and reasonable measures must be taken to protect them.

An internal HR investigation should be conducted with consideration of the principles of discretion and confidentiality in relation to the respondent, as well as any other individual involved. To ensure this, employers should:

• limit the number of persons involved in the investigation;
• continuously remind participants about the need for confidentiality and discretion – ie, to not discuss the investigation with anyone outside the group;
• take precautions such as using code words, password-protected documents, careful email handling and discretion during physical meetings; and
• comply with the rules and principles stipulated in the GDPR when processing personal data.

It is generally possible for the employer to ask the respondent to temporarily work remotely, or release them from work (with pay). Any such measures taken against the respondent during the investigation must be proportionate, considering the respondent’s potential to return to work without negative effects if they are found not guilty and/or if no other measures or sanctions are required. Any communication regarding why the respondent is not at work, etc, should be carefully considered in order to manage any risk of defamation, etc.

Employers are generally responsible for the health, safety and well-being of their employees within the framework of the Swedish Work Environment Act (1977:1160) and the provisions issued by the Swedish Work Environment Authority.

Thus, employers are obliged to ensure that employees are not affected by ill health or exposed to other safety risks. If the respondent may pose a safety risk or otherwise expose other employees to a risk of ill health, or if there is a risk of evidence being destroyed or tampered with, or of witnesses being unduly influenced, employers are able to take temporary measures such as:

• releasing the respondent from work (with pay);
• issuing orders to work remotely;
• not allowing participation in a meeting or work trip; and
• not allowing contact with a certain colleague (or any colleague) while an investigation is ongoing, etc.

It is important that such measures are necessary and proportionate, and they should be in place for as short a period as possible.

Other permanent or more severe sanctions, such as warnings, redeployment or dismissal, shall be taken after the investigation has concluded and must comply with the Swedish Employment Protection Act (1982:80), as well as any applicable collective bargaining agreement.

An employer is obligated to take measures to prevent sexual harassment, harassment due to a protected characteristic, bullying and/or victimisation in the workplace. Additionally, according to the general responsibility to protect employees from ill health and other safety risks pursuant to the Swedish Work Environment Act (1977:1160) and the provisions issued by the Swedish Work Environment Authority, there might be a need for measures to protect employees other than the reporter and the respondent. Employers are also obligated to protect employees who participate in reporting under the Whistleblowing Act (2021:890), or who have participated in investigations relating to harassment or sexual harassment under the Discrimination Act (2008:567). Failure to protect employees from ill health, safety risks or retaliation may lead to fines, or an obligation to pay damages and/or discrimination compensation.

With the exception of the formal rules governing whistle-blower reports – ie, protection of identity, reporting, confirmation of receipt, feedback etc, under the Whistleblowing Act (2021:890) – Swedish law does not impose any requirements for specific procedural guarantees in connection with employers conducting HR internal investigations. However, certain time limits must be adhered to, including in investigations of sexual harassment and harassment; under the Discrimination Act (2008:567), these must be initiated in a prompt manner, and failure to do so may imply an obligation to pay discrimination compensation.

If termination or summary dismissal is considered necessary following an investigation, such measures may not be based solely on circumstances that were known to the employer more than two months before notice of the dismissal or termination is given. When employers impose labour law sanctions, such as redeployment, termination or dismissal, the rules and processes stipulated in the Swedish Employment Protection Act (1982:80), the Co-Determination at the Work Place Act (1976:580) and the applicable collective bargaining agreement must be adhered to. If an employer fails to comply with these regulations, the termination or summary dismissal may be declared invalid, and the employer may have to pay economic as well as general damages for invalid termination or other violations of said regulations. Additionally, circumstances that would have provided legal grounds for termination may become unavailable due to preclusion or the statute of limitations.

For whistle-blowing reports, the Whistleblowing Act (2021:890) stipulates that it is mandatory for employers with 50 or more employees to document the whistle-blowing channels and related procedures in writing – ie, in a whistle-blowing policy.

Employers are further required to have guidelines and procedures for handling sexual harassment/harassment in a discrimination policy following the Discrimination Act (2008:567), as well as for handling victimisation and bullying (usually included in the mandatory work environment policy, as stipulated in the Swedish Work Environment Act (1977:1160) and the provisions issued by the Swedish Work Environment Authority). These documents should contain procedures for employers investigating potential sexual harassment, victimisation and bullying (as well as ill health or accidents). A written discrimination policy is required for employers with 25 or more employees, and written documentation regarding the handling of victimisation and bullying is required for employers with ten or more employees.

Employers may set their own internal requirements for investigations, as long as these requirements meet the minimum level set by legislation and comply with the general principles of objectivity, discretion and confidentiality, as well as with the rules on data processing stipulated in the GDPR. It is, however, recommended that these internal rules be reviewed to avoid them being inadequate or otherwise unfit or unnecessarily burdensome when conducting internal HR investigations.

Non-compliance with internal rules or regulations implemented on a voluntary basis can cause the employer to become liable for non-compliance with statutory rules and regulations. Consequently, it is important to ensure that internal rules and/or regulations are aligned with statutory requirements.

The burden of proof depends on the circumstances that are to be proven. The burden of proof generally lies with the person making any allegations or claims. Thus, employers are, for example, responsible for proving that an employee has committed sexual harassment if it is to be used as a reason for termination – ie, to prove that there are objective reasons to terminate the employment. The employer must be able to prove that a circumstance has happened through the evidence that emerged during the investigation.

There are no explicit rules regarding when an investigation should be concluded. However, the Whistleblowing Act (2021:890), for example, requires that the reporting person be informed of the follow-up of a report within three months thereof. Furthermore, the Discrimination Act (2008:567) requires that an investigation be conducted in an urgent manner.

In general, an investigation should be concluded when sufficient and adequate evidence has been obtained to allow conclusions to be made. The general requirement of urgency should always be taken into account with regard to those involved.

Apart from the rules on reporting back to the reporter within three months, as set out in the Whistleblowing Act (2021:890), there are no procedural rules on concluding an HR investigation. However, it is common practice, and recommended, to report back to the reporter and the respondent with a summary of the investigation’s findings and any measures that will be taken as a result. It may also be advisable to report back to any witnesses that the investigation has been concluded and thank them for their participation, but no further details should be given to them in view of the requirements of discretion and confidentiality.

There are generally no explicit rules governing the form of any conclusions drawn from the internal HR investigation. For investigations of sexual harassment or harassment following the Discrimination Act (2008:567), it is recommended that the investigation be documented in writing, and the investigator is obligated to conclude whether sexual harassment or harassment has occurred or not.

For other HR internal investigations, it is generally preferred, and recommended, to draft written reports as these have practical benefits, such as in reporting back to company stakeholders or serving as evidence in case of legal claims.

There are no rules governing the content of reports in Sweden. The structure of a report depends on the circumstances of the individual case, but in general its format should be based on the purpose/subject of the investigation and its scope, whether highly sensitive information is being handled and who the recipient of the report is. If, for example, the report concerns a crime or other complex subject, or involves extensive evidence, it will usually be more comprehensive than a report that concerns sexual harassment or victimisation.

If a written report is to be used, it is generally recommended that it contains the following:

• a description of the scope of the investigation and its background;
• a description of how the investigation was conducted – ie, the methodology followed;
• a summary of the interviews and other factual findings, such as written evidence and the documents reviewed;
• conclusions; and
• the recommended measures going forward (if any).

Referring to 6.2 Procedure for Ending an HR Internal Investigation, the reporter and respondent should be provided with the result of the investigation. Due to the principles of discretion and confidentiality, it is generally not advisable to provide the reporter and/or the respondent with an entire written report. Instead, they should be provided with an oral or written summary of the findings, the conclusions and the measures recommended going forward (if any).

Typically, private employers are not obliged to report the results of an internal HR investigation to the Swedish authorities. However, if the results of the investigation reveal, for example, crimes relating to money laundering, these must be reported to the Finance Police and Swedish Financial Supervisory Authority, as stipulated in the Money Laundering and Terrorist Financing Prevention Act (2017:630), and any severe cases of ill health or workplace accidents must be reported to the Swedish Work Environment Authority in accordance with the Swedish Work Environment Act (1977:1160). Public employers may be subject to reporting obligations, for example with respect to grievances related to healthcare. For information about police reports, see 8.4 Criminal Cases.

Given the principles of discretion and confidentiality in relation to the parties involved in the investigation, the conclusion and result of an HR internal investigation should not be shared with a wider group of individuals than necessary. There may, however, be reason to report the outcome, or the existence, of an investigation to parties other than the reporter and the respondent. Such persons may be witnesses; it may be necessary to provide more detailed information, particularly in cases where these individuals have been seriously impacted by the circumstances and need further support from, for example, occupational health services.

Depending on the internal guidelines, responsibility and reporting channels, it may be appropriate to report to other responsible parties within the company, such as the board of directors or other stakeholders.

When communicating any conclusions regarding the investigation, it is of the utmost importance to assess any such communication beforehand, with consideration of the risk of criminal charges for defamation.

If an internal investigation concludes that an employee has behaved inappropriately or otherwise violated his or her obligations towards the employer, the following measures may typically be taken:

• issuance of a written warning;
• redeployment;
• termination (with notice) due to personal reasons; or
• summary dismissal.

If dismissal or termination of employment is to be effected, such measure cannot be based solely on circumstances known to the employer more than two months before the dismissal, as stipulated in the Swedish Employment Protection Act (1982:80). However, one aggravating circumstance falling within the stipulated two-month period is sufficient for other, older, circumstances to be permissible as grounds for termination or summary dismissal. Taking any of the measures listed in the foregoing, with the exception of written warnings, requires compliance with the applicable rules in the Employment Protection Act or the applicable collective bargaining agreements.

While not a disciplinary measure, note that an employer may initiate legal proceedings to claim damages if the internal investigation concluded that the respondent was guilty of disloyal behaviour (eg, engaging in competition with the employer’s business, misappropriating trade secrets or perpetuating theft, fraud or similar actions).

In addition to potential measures directed at a respondent, there may be reason to take a variety of other measures depending on the circumstances of the individual case.

• If there are difficulties with co-operation, mediation should be undertaken to resolve the problems. Even reorganisation measures can be considered if deemed necessary to mitigate any issues.
• If the investigation has identified a lack of knowledge in areas where the employer is obliged to ensure a certain level of competence, such as with respect to anti-discrimination and the work environment, measures to improve knowledge may be taken, as well as team-building initiatives.
• If the employer has found, during the course of the investigation, that the applicable policies, etc, may be insufficient or otherwise inadequate, it is recommended that these be reviewed and, where appropriate, updated.

Swedish employers may generally collect personal data within the framework of an internal HR investigation, provided that this is done in accordance with the rules and principles applicable under the GDPR and the Swedish Act regarding Supplementary Provisions to the GDPR (2018:218).

Rules and basic principles to particularly consider include, inter alia, the following.

• Having a legal ground for data processing. For HR internal investigations, this could be a legal obligation – eg, an obligation to investigate under the Whistleblowing Act (2021:890) or the Discrimination Act (2008:567). Otherwise, a legal ground may be found through a legitimate interest assessment – ie, balancing the interest of the employer to process an employee’s data to investigate something with the employee’s interests and rights.
• Observing the principle of data minimisation – ie, not collecting and processing more personal data than is necessary for the given purpose.
• Ensuring that the collected and processed personal data is accurate.
• Erasing or anonymising personal data as soon as it is no longer needed. Routines and procedures for such erasure should be established.
• Ensuring that the data is well protected by taking appropriate security measures.
• Assessing whether it is permissible for the personal data to be transferred to a third country.

The GDPR generally prohibits the processing of personal data that is deemed sensitive (special categories of personal data). This includes information about trade union membership, health, sexual orientation etc, and personal data relating to criminal convictions and offences. Such data may, as an exception, be processed by an employer when necessary to establish, assert or defend legal claims – ie, in the context of a dispute/litigation. Other rules and principles in the GDPR must, however, be complied with.

For the processing of personal data related to the follow-up of a report, additional rules under the Swedish Whistleblowing Act (2021:890) must be considered:

• personal data may only be processed if necessary for follow-up, to enable the implementation of measures required in accordance with the information provided in the case and to enable reports to be used as evidence in legal proceedings or any other lawfully permissible manner; and
• personal data in a whistle-blowing channel may only be accessed, on a need-to-know basis, by independent and impartial persons or functions assigned to manage the whistle-blowing channel.

There are a number of obligations to consider when collecting and/or processing personal data for an HR internal investigation.

• The individuals involved, for whom personal data processing is needed, have the right to be informed that their data is being collected, and of the purpose thereof and how the data will be used. This information must be provided at the time of data collection at the latest. Such information is normally already provided through the employer’s privacy notice. It is therefore generally recommended that such privacy notice encompass the collection of personal data in connection with internal investigations.
• The individual must also be informed about their rights to access personal data, have personal data rectified or erased, limit the processing of personal data, port personal data, object to the processing of personal data and not be subject to automatic decision-making.
• Following the principle of storage limitation, personal data relating to an investigation should generally be retained for the duration of any applicable statute of limitation connected to claims by individuals. Under the Whistleblowing Act (2021:890), personal data stored following an investigation should be erased two years after closure of the case.

Individuals whose personal data is collected as part of the investigation have the right to access this data, and other information, by submitting a request. Such information may include:

• a copy of the processed personal data;
• information about the purpose and categories of processed personal data;
• the receivers of the data in; and
• the period over which it is anticipated that the personal data will be stored, etc.

There is also a right to information concerning whether the personal data has been subject to any automatic decision-making (see 7.4 AI).

It is often sufficient to provide the individual with a summary of all the processed personal data. There may be circumstances in which information should not be disclosed, for example due to provisions in other legislation or because disclosure of the information would be detrimental to others (including the employer due to an ongoing dispute). In certain cases, the employer may also refuse to provide a copy of the data, for example if the data subject makes unfounded or unreasonable requests (such as several access requests in a short period of time).

It is not common for AI to be used in connection with internal investigations. However, it may potentially be used in the review of written evidence or in forensic investigations. Given the rapid development of AI, there is reason to believe that its use in internal investigations will increase. Any such usage will, however, be dependent on the limitations set out in the new AI Directive (2024/1689), as well as in the GDPR.

The AI Directive regulates the development and use of AI in the EU based on the level of risk the systems impose. It prohibits certain particularly harmful applications and imposes strict limits on high-risk AI – eg, for recruitment or monitoring of performance. The AI Directive thus imposes restrictions on the use of AI in HR internal investigations, which would in general be deemed high-risk AI.

When processing personal data using AI, the rules and principles of the GDPR must be complied with. AI can be used for various forms of automatic decision-making, but the GDPR generally prohibits such decision-making. There are exceptions, however – eg, in the case of explicit consent from the individual – but it is generally not recommended to base personal data processing on consent, as it may be withdrawn by the individual. In the case of data processing in connection with automated decision-making, the individual has the right to be informed that such decision-making is taking place, and to receive an explanation of the decision taken.

Sweden has implemented the EU Whistleblower Directive (2019/1937) through the Whistleblowing Act (2021:890). It protects whistle-blowers – ie, reporting persons who, in a work-related context, have obtained or acquired information about irregularities and report it. For classification as a whistle-blower, one must be an employee, job seeker, intern, self-employed person performing work, working shareholder or similar, or a person who has previously been active in the business. The reporting shall be made in a work-related context and shall concern information about irregularities that are in the public interest to disclose, or irregularities that violate certain Union acts. Irregularities that may be in the public interest to disclose need to be assessed on a case-by-case basis but may, for example, include human rights violations, corruption, misuse of public funds, violations of official regulations or violations of competition law.

The Act provides protection against obstructive measures and retaliation, as well as immunity from liability for breach of confidentiality. An employer may not obstruct or attempt to obstruct reporting, nor take retaliatory measures against a reporting person. In addition, an employer cannot take retaliatory measures against someone who has turned to their employee organisation for consultation regarding reporting, or obstruct or attempt to obstruct consultation with said organisation. An employer who violates these prohibitions is liable to pay damages.

Sexual harassment is a form of discrimination defined by the Discrimination Act (2008:567) as behaviour of a sexual nature that violates someone’s dignity. Employees, job applicants and interns or hired workers who report violations of the Act, have been subject to harassment based on a protected characteristic or sexual harassment and/or have participated in such investigations are protected from reprisals by the employer.

The Discrimination Act (2008:567) stipulates that the following are protected characteristics: gender, gender identity or expression, ethnicity, religion or other belief, disability, sexual orientation and age. Discrimination can take the form of:

• direct discrimination;
• indirect discrimination;
• sexual harassment;
• harassment, which is defined as behaviour that violates someone’s dignity and is related to any of the protected characteristics;
• inadequate accessibility; and
• instructions to discriminate.

Regarding the protection of a person making allegations of harassment or other forms of discrimination, see 8.2 Sexual Harassment and/or Violence.

The Work Environment Authority’s provision regarding Planning and Organisation of the Work Environment Management (2023:2) defines victimisation and bullying as actions directed at one or more employees in an offensive manner that may lead to ill health or exclusion from the work community. Swedish legislation does not provide protection for employees bringing forward allegations concerning victimisation and bullying.

There are no procedures that an employer must follow if an allegation subject to an investigation may be criminal. There are, however, several aspects that should be taken into account when conducting an investigation where there is suspicion that some form of crime has been committed.

There may be a risk that evidence might be destroyed if the employer’s investigation and suspicions are disclosed to the respondent. In such cases, it is advisable to await any measure that could enable disclosure until the police have secured evidence, especially as the police have better resources at their disposal to do so. It is, however, important that the pace of the employer’s own investigation be maintained until it is completed. The investigation may also be of use to the police, or be used in connection with insurance claims or other liability issues, such as auditor liability. Please note that if the crimes concern money laundering, for example, disclosure to any suspect is prohibited, as stipulated in the Money Laundering and Terrorist Financing Prevention Act (2017:630).

There is no general duty for employers to file a police report, unless there is a legal obligation to do so – eg, if the matter arises within the financial or healthcare sector. It is, however, generally recommended that a police report be filed, as is encouraging and assisting employees in filing a police report if they have been the victim of a crime.

It should further be noted that the GDPR stipulates that personal data relating to criminal offences, as well as suspicions thereof, may as a general rule not be processed unless such processing is required under applicable statutory provisions, or is necessary to establish or defend a legal claim or fulfil a legal obligation.

When handling investigations that may involve crimes or suspicions thereof, it is important to review and evaluate, or prevent the disclosure of, any communication that may constitute defamation. It should further be noted that employers are responsible for the well-being of their employees within the framework of their occupational health and safety responsibilities under the Swedish Work Environment Act (1977:1160) and the provisions issued by the Swedish Work Environment Authority. Therefore, employers are obliged to ensure that the employees are not exposed to danger in connection with the investigation of crimes.

There are no specific requirements under Swedish law in the event of an investigation involving several jurisdictions, nor are there any restrictions on foreign employers conducting investigations in Sweden or on Swedish employers conducting investigations abroad.

However, there may be less direct requirements or circumstances to consider, such as:

• assessment of which jurisdiction’s law applies;
• compliance with the local employment laws and statutes of limitation;
• obligations to involve trade unions or work councils;
• consideration of local rules in relation to obtaining evidence;
• the local approach to legal professional privilege;
• compliance with rules in regard to the processing of personal data, and more specifically whether it is permissible to transfer personal data to a third country; and
• any mandatory requirements in relation to filing reports or notifications to any local authority.