In general, HR internal investigations often begin with an allegation of wrongdoing in the workplace, which may come from employees, management, whistle-blowers, internal and outside auditors, business partners, clients and customers, the regulators, the media or someone else. Typical scenarios include, but are not limited to: employees’ complaints of misconduct, external allegations of wrongdoings, whistle-blowing of compliance violations, the results or observations of an internal or external audit or compliance review, incidents or leads discovered in daily management, responses to regulatory inquiries or investigations, media reports, etc.

In general, an HR internal investigation can be regarded as within the authority of an employer’s management over employees provided that it is conducted in compliance with the law and its internal policies established in accordance with the law. It is commonly seen that employers put in place internal policies regarding HR internal investigation, in which initiation of investigation, scope, process, results and consequences of the investigation can be stipulated. The internal polices can serve as legal bases for carrying out an HR investigation and employers should adhere to such established procedures and policies.

There are circumstances where an employer is obligated to carry out investigations, such as investigation in response to complaint of sexual harassment in the workplace as required by PRC Law on the Protection of Women’s Rights and Interests, investigation in response to regulatory authorities’ instruction to conduct self-investigation as required by relevant regulatory rules in special industries, etc. Other circumstances are largely subject to the employer’s internal policies established in accordance with the law.

Currently, there are no specific laws and regulations requiring certain types of channels that employees may use to report concerns. However, for instance, PRC Law on the Protection of Women’s Rights and Interests provides that an employer should set up a complaint hotline, mailbox and other open complaint channels. The general principle is to ensure there are measures in place for protecting complainants from adverse consequences of coming forward with concerns or information, and therefore, it is generally encouraged to provide avenues for anonymous reporting and where not, it is generally encouraged to take measures to maintain confidentiality to the extent reasonably possible.

Currently, there are no specific laws and regulations articulating who should be responsible for carrying out an HR internal investigation. It is largely subject to the employer’s internal policies. 

Depending on the specific circumstances, the investigator can usually be someone from HR, management, internal audit, compliance or the legal team. Where the complaint involves serious corporate governance issues, the board may need to be involved. In general, the investigator should be someone who will be independent, and who is not the subject of the investigation and/or a relevant witness, or with any potential conflicts of interests, and who has adequate availability and skills to handle the investigation.

An external investigator such as external counsel, an accounting firm or forensic team can be appointed in accordance with actual needs, especially where the matter is particularly sensitive (eg, sexual harassment, retaliation, etc), where it involves higher management (eg, CEO, VP, etc), high-stakes accusations, significant financial or legal exposure, or may involve potential internal conflicts of interest, where internal resources are limited, or independence and objectiveness is of great importance. 

The timing for bringing in external investigators depends on the actual situation. Some may bring in external investigators at the very beginning considering the investigation’s complexity, the time constraint, the need for expertise, and the importance of impartiality and the potential exposure, etc. Some may choose to bring in external investigators after the initial information-gathering phase, and expect the external investigators to provide professional assistance with evidence preservation and advising on legal actions to be taken.

There are circumstances where an employer is obligated to carry out investigations, such as investigation in response to complaint of sexual harassment in the workplace as required by the PRC Law on the Protection of Women’s Rights and Interests, investigation in response to regulatory authorities’ instruction to conduct self-investigation as required by relevant regulatory rules in special industries, etc.

In general, there are no statutory prohibitions from carrying out HR internal investigation.

Employers may formulate internal policies regarding HR internal investigations to standardise the guide to its own internal investigations, and in typical circumstances, factors to be considered and relevant process and procedures can be specified.

When assessing whether the situation at issue may need a formal investigation, factors taken into consideration include whether there are alternative ways to resolve the matter (eg, less sensitive workplace matters may be resolved through informal communication between employees where appropriate), whether the matter is of a serious nature, or may subject to significant exposure, whether there is initial information adequate to move ahead with investigation, and whether there is a history of similar incidents, etc.

In general, it is not legally required to inform the reporter whether an investigation will be opened. However, employers may choose to do so where appropriate for considerations such as acknowledging the importance of the complaint, encouraging advocacy, gathering further information, etc.

In general, it is not legally required to inform the respondent whether an investigation will be opened. In normal circumstances, respondents can be informed that an investigation is underway and what the main allegations are, so that they can respond when appropriate (such as where an interview is conducted, where corresponding actions such as suspension may be taken, or seeking consent for processing of personal information, etc) and requested to keep it confidential. In some circumstances, it may not be appropriate to inform the respondent, such as where an employee may be able to influence other relevant parties, tamper with evidence, or create other substantial risks without precautionary measures available.

In terms of what information the respondent needs be provided with, in general, a general description of the conduct alleged and details as necessary to enable them to sensibly respond, can be provided. There is no legal requirement of prior notice period. It is fine to decide not to provide prior notice where it is reasonably viewed that such prior notice of the investigations to the respondent may compromise the responses or bring about other risks.

In general, opening an HR internal investigation is not legally required to be communicated to the authorities. There may be circumstances where employers may communicate the opening of an HR internal investigation to authorities mainly for the purpose of keeping them posted on progress. For instance, regulatory authorities may instruct employers to conduct self-investigation, and in such a case, employers may communicate opening the investigation in response to such instructions.

The parties can be asked to sign confidentiality agreements and/or NDAs covering an HR internal investigation. In practice, it may be more common to duly notify the parties involved of the confidentiality obligations and consequences of failure to do so in writing and request acknowledgment (compared with formal agreements to be executed, such approach may be easier to be accepted by the parties involved).

In addition, it is still a general duty for the parties to keep an HR internal investigation confidential, and such requirements and relevant consequences such as disciplinary actions are commonly stipulated in internal policies.

In a case where the parties do not keep the HR internal investigation confidential, depending on the specific circumstances, the employer may take disciplinary action in accordance with the valid internal policies formulated in accordance with law. Where failure to perform confidentiality obligations resulted in damages for the employer, legal recourse includes suing for compensation for damages (though practically speaking, it can be difficult to satisfy the burden of proof of damages).

In practice, where it is uncertain whether a full investigation is necessary or appropriate, an employer may choose to conduct a preliminary investigation first to gather data on this and determine if there is a trend that may warrant a full investigation.

The scope of the interviewees during an HR internal investigation is typically determined based on the specific circumstances of the investigated event and the needs of investigation. In general, the reporter/whistle-blower, individuals with knowledge of the facts of the investigated event, and the respondent (in some cases, these three categories of individuals may overlap) are likely to be interviewed.

For example, in a sexual harassment investigation (under PRC laws, it is required for an employer to conduct an investigation in the event of sexual harassment in workplace), the victim or other reporters, any witnesses or other individuals with knowledge of the facts, and the respondent may be interviewed.

The number of interviewed individuals will be determined on a case-by-case basis considering factors such as information sufficient for facts findings, involvement/relevance of the matters being investigated, sensitivity of the matters being investigated, etc.

In general, the participation in interviews by the interviewees (no matter by reporter/whistle-blower, individuals with knowledge of the facts, or the respondent) is typically on a voluntary basis. If the interviewee refuses to participate or requests to only participate in certain aspects of the investigation/interviews, the employer lacks the statutory basis to require them to participate in the corresponding investigation/interviews.

In practice, some employers may adopt measures to encourage employees to participate in the investigation/interviews or may explicitly specify in internal policies that employees should participate in investigations/interviews, or otherwise be subject to disciplinary action. However, even with such provisions requiring mandatory participation in investigations/interviews, if the interviewee refuses to participate or requests to only participate in certain aspects of the investigation/interviews, whether disciplinary actions taken is permissible solely based on failure to participate in the investigation/interview is still disputable.

Under PRC laws, there are no statutory requirements or restrictions regarding the format of conducting interviews. As such, it is feasible for an employer to conduct a remote interview with the interviewee. In practice, when determining whether to conduct a face-to-face or remote interview, following two factors are mainly considered.

• Availability and willingness: due to actual constraints, face-to-face meeting may not always be available (eg, different locations of the interviewers or interviewees). Also, different interviewees may have different preferences to the format of the interview. Some may prefer a face-to-face interview over remote interviews, and vice versa. The employer can choose the format according to whichever better facilities the interview.
• Evidence preservation: In general, there are two types of interviews during an HR internal investigation, each with different objectives and functions. One type is for the purpose of information-gathering, and the other is for the purpose of preserving evidence. If a specific interview is conducted for the purpose of preserving evidence, a detailed interview transcript/note is generally created, reviewed and signed by the interviewee after the interview. Therefore, if the interview is conducted remotely, the employer needs to ensure that the interview note is promptly and properly acknowledged by the interviewee (in a PRC labour dispute context, interview notes signed with wet-signatures are still preferred). It is also important to properly maintain any written records for the transcript.

Under PRC laws, there are no statutory requirements regarding the number of interviewers. However, it is not suggested to have too many interviewers as it may potentially put pressure on the interviewee. In practice, it is common to have two interviewers (with one to lead the conversation and the other to take notes).

There are also no statutory requirements regarding the characteristics of interviewers. In practice, the selection of interviewers depends on the specific circumstances of the investigation and the interviewee. For example, in the event of workplace sexual harassment, if the victim is female, it may be appropriate to have at least a female interviewer. In addition, it may be appropriate to avoid the situation that any interviewer may have a hierarchical or potential conflict of interest relationship with the respondent.

Under PRC laws, there is no statutory requirement for having a witness present during interviews, nor is there a statutory requirement for having a neutral third party serving as a witness. It is also not a common practice during an HR internal investigation in the PRC.

Under PRC laws, there is no corresponding concept of “support person” and it is also not a common practice during the HR internal investigation.

Under PRC laws, there is no statutory requirement for interviewees to be accompanied by a lawyer. In practice, as the investigation is generally conducted internally and is subject to strict confidentiality, it is not commonly observed that an interviewee be accompanied by a lawyer. However, depending on the actual circumstances, if the presence of a lawyer can facilitate the interview, the company may consider accommodating such request.

Under PRC laws, there is no statutory requirement that an employer should provide certain information to an interviewee at the start or end of an interview. In practice, it is common for an employer to provide following information to the interviewee at the start of the interview:

• to inform the interviewee of the purpose of the interview, to help the interviewee better understanding the investigation and to ensure the smooth the progress of the interview;
• to inform the employee of the confidentiality of the interview, and to have the employee sign a confidentiality undertaking, to prevent the employee from disclosing any information of the investigation after the interview;
• to inform the employee of the interview recording and the preservation of evidence (if any), such as whether the interview will be recorded, whether a transcript will be formed and transmitted to an employee for signature, etc, trying to avoid the situation that the employee refuses to co-operate with the company for evidence preservation after the interview (though note that it is not legally required to do so, all depends on the company culture, internal rules, and other considerations); and
• to inform any potential subsequent steps of the investigation, such as whether the final investigation outcome will be notified to the interviewee and any further co-operation required.

Under PRC laws, the participation in an interview is on a voluntary basis. If the interviewee explicitly requests to stop the interview, the company may consider communicating with the interviewee, trying to see whether it is feasible to continue the interview, or to reschedule the interview for another time. However, if the employee still refuses and insists on stopping the interview, the company will generally have to do so.

There are two types of interviews during an HR internal investigation with different objectives and functions. One type is for the purpose of information gathering, and the other is for the purpose of preserving evidence. For interviews with the purpose of information gathering, minutes may not necessarily be required (but notes are suggested to be taken or recorded for further reference). However, for interviews with the purpose of evidence preserving, a minute is commonly formed (a summarised minute is allowed, but if some content of the interview needs to be submitted as evidence, a detailed minute or even an interview transcript is more commonly prepared). The minute is generally reviewed and signed by the interviewee.

There are no explicit statutory requirements for the minute taker. In practice, companies may decide whether to engage an external party to take a minute based on the specific needs and circumstances of the investigation.

Recording interviews is quite common in practice (even during an interview with the purpose of information gathering instead of evidence preserving, where a minute may not be formed) to ensure there is a record of the progress of the interview. Whether a transcript is prepared depends on the specific purpose and function of the interview. If some contents of the interview will be submitted as evidence, a transcript is usually formed and shared with the interviewee for review and signature. In some cases, transcripts are also shared with relevant parties to the investigation, such as external legal counsel or other investigators.

In addition to interviews, common methods of fact-finding during investigations typically include, but are not limited to, the following.

• Collection of paper documents and electronic records: Employers may gather and collect paper documents and electronic records such as emails, company CCTV footage, social media records, financial documents, etc. For example, during an investigation for false reimbursement, the company may conduct an investigation into the respondent’s email records, WeChat records of relevant individuals (a written consent from the user of the WeChat account is required), original receipts for the reimbursed payments, etc. For the preservation of evidence, original paper documents should be preserved and electronic records should be either notarised or presented during tribunal/court proceedings via the original electronic medium.
• Onsite investigation: In some cases, the employer may also conduct on-site inspections (eg, reviewing office spaces or storage devices) to find physical evidence relevant to the investigation. Physical evidence should be preserved in its original form.

Methods that violate relevant laws and regulations or infringe on an individual’s legal rights and interests are typically not allowed. For example, unauthorised wiretapping is generally not allowed as it may infringe on individual’s privacy rights.

As a general principle, the employer will take necessary and reasonable action to protect the reporters, such as protecting their identity and personal information if there is no need to disclose it, their safety in the workplace, and from retaliation. In some circumstances, failure to take necessary and reasonable actions to protect reporters may escalate the situation, embed retaliation and discourage making complaints.

Possible temporary measures include remote work, suspension, transfer of working areas, changing reporting lines, employees put on paid leave, etc. Note that such measures can not infringe on the legitimate rights of the person. For instance, if the accused is suspended with reduced pay without consent or other legal grounds, it will bring about additional risks. As such, when taking protective measures, it is suggested that a careful assessment be undertaken of the legal grounds for the measures and whether they are appropriate and reasonable.

As a general principle, an employer will take necessary and reasonable actions to protect the respondent, such as protecting their identity, personal information and reputation, and ensuring a fair and impartial investigation, and no infringement of their legitimate rights. Requiring all parties involved to keep information confidential is important. During the investigation, circumstances may arise where an employer will take actions to protect the respondent. For instance, where relevant parties disclose the respondent’s identity to others that do not need to know, and this may adversely affect the respondent’s reputation, employers will take measures to make clarifications and prevent further developments.

In general, disciplinary measures against the respondent should not be taken prior to concluding an HR internal investigation. Where a respondent carries out misconduct during the process of investigation, such as failing to keep confidentiality, retaliating, refusing to co-operate with or even (attempting to) impede investigations, tampering with evidence, etc, this behaviour may constitute a violation of the employer’s internal policies, and in such a case, disciplinary measures may be taken in accordance with the provisions of the internal policies.

In general, an investigation is conducted in a manner that does not disrupt normal business operations and team stability, and thus it usually only involves employees needed to participate in the investigation. Other employees not relevant to the investigation will be kept unaffected by the investigation to the extent possible.

Currently, there are no specific legal regulations in the mainland of China that govern the internal investigation procedures for employers. Nevertheless, employers are obligated to comply with fundamental legal frameworks, including the Civil Code, the Criminal Law, the Personal Information Protection Law, and the Labour Law, as well as established judicial practices. These frameworks necessitate adherence to certain foundational principles during internal investigations by employers to ensure the legality and impartiality of the proceedings.

• The investigation must not infringe upon the personal freedom of the employees.
• Arbitrary searches of employees are prohibited.
• If the investigation requires the examination of personal devices or the collection of personal information, the employer must provide prior notification to the individual being investigated and obtain their written consent.
• Personal information collected during the investigation must be limited to what is essential for the inquiry. Access to this information shall be restricted to designated investigators and relevant decision-makers, thereby preventing unauthorised access. In the meantime, it is required to comply with laws and regulations regarding personal information, with particular care taken to avoid disclosing employees’ personal information.

Failure to comply with these requirements may result in the following.

• Tort claims: Employees may pursue claims for damages against the employer due to misconduct, which may include unauthorised disclosure of personal information.
• Administrative liability: Employers may face administrative penalties for acts that violate administrative law, such as conducting unlawful searches, which may result in fines and administrative detention
• Criminal responsibility: In severe cases, the responsible individual may face criminal charges for illegal searches and unlawful detention as defined by criminal law. For example, if an employer searches employees’ personal belongings without consent, using coercive or violent methods, and this conduct results in significant harm, criminal liability may be established.

Employers may formulate internal policies to standardise and guide their own internal investigations and procedures. These provisions may extend beyond the procedural safeguards previously mentioned in 5.1 Requirements and typically encompass various elements, including but not limited to the investigation process, scope, participants, methods of evidence collection, confidentiality measures, management of results, and procedures for appeals.

The internal rules and regulations established by the employer are binding for both the employer and the employee. The legal admissibility of evidence obtained from an investigation that does not comply with these internal rules may be subject to scrutiny, potentially leading to its invalidation as a basis for determining the facts of a case.

In general, the burden of proof in labour dispute cases follows the standard principles of civil procedure, which dictate that the party making a claim is responsible for providing evidence. However, in the context of labour relations, the employer typically holds a position of strength, while the employee is often at a disadvantage. Consequently, the Chinese labour law offers preferential protection for workers. As a result, in labour disputes, the employer is frequently required to assume the initial burden of proof, particularly in the following situations:

• if evidence relevant to the dispute is in the possession of the employer’s management, the employer is obligated to provide it. Failure to do so may result in negative consequences for the employer; and
• the employer bears the burden of proof in any labour dispute arising from decisions related to dismissal, expulsion, termination of the labour contract, or reduction of labour remuneration made by the employer.

In theoretical contexts, the degree of proof beyond a reasonable doubt is typically reserved for criminal disputes and exceptional instances of civil disputes. In labour dispute cases, which are classified as civil disputes, the standard of preponderance is generally applied. This means that when evidence does not establish a fact as clear and conclusive, a fact that is highly probable may still be affirmed.

In practice, however, to protect vulnerable workers, when an employer suspects that an employee has engaged in misconduct and subsequently initiates disciplinary action or dismissal based on that suspicion, a more stringent degree of proof may be required.

There are no specific rules by laws and regulations governing when an HR internal investigation may be ended under PRC law. However, several principles and requirements can be inferred from relevant laws and regulations as follows.

• Achievement of investigation purpose: Internal investigations are generally conducted to uncover facts regarding the respondent’s alleged or suspected wrongdoing, misconduct or non-compliance. Once it has been proved whether or not the respondent has committed any misconduct, the purpose of the investigation is fulfilled, and the investigation should be terminated accordingly.
• In accordance with internal policies: If the employer has established internal rules and policies stipulating restrictions on the completion of an investigation, it should strictly adhere to these provisions. For instance, if internal policies mandate that investigations should be completed within 30 working days, the investigation must be ended before this deadline unless an extension is granted for special circumstances.
• Protection of employees’ legal rights: Prolonged internal investigations may unnecessarily disrupt the employees’ normal work and personal life, potentially infringing their rights and interests. For example, if a respondent is suspended during an HR internal investigation that remains inconclusive for an extended period of time, with neither the respondent’s position being reinstated nor reasonable solutions being provided, this could violate the respondent’s labour rights. In such cases, the company should terminate the investigation, reinstate the respondent, or provide reasonable compensation.
• No negative impact on business operations: From the perspective of corporate governance, HR internal investigations should not be carried out endlessly for fear of disrupting normal business operations and team stability. If an investigation is already negatively impacting the employer’s daily functions, the employer should consider terminating the investigation to restore normal production and operations.

Currently, there are no statutory requirements on procedures to end an HR internal investigation under PRC law. Once the decision is made to end an internal investigation, the employers should adhere to specific procedures in compliance with their internal policies, typically including notification and communication to the relevant parties.

• If the employer decides to abandon the investigation before a conclusion has been drawn:
1. communications to the parties – inform both the reporter and the respondent via a written notice or a face-to-face meeting, clearly stating the decision to terminate the investigation, the reasons for the decision and any follow-up arrangements. Third parties involved in the investigation should be informed as well. If the reporter or other employees raise any objections, an explanation should be provided.
• If the employer ends the investigation after reaching a conclusion, besides informing the relevant parties of the decision to terminate the investigation, the employer might also take the following actions:
1. rehabilitation – if the allegations are not substantiated, the employer should emphasise that the alleged behaviours could not be substantiated, dispel misunderstandings and rumours, and protect the reputation of the respondent; and
2. clarification and statement – if the allegations are substantiated and the employer intends to take disciplinary measures against the respondent, the investigation outcome should be communicated to the respondent, and actions should be taken in accordance with the employer’s internal policies. If the employer has suffered any losses due to the respondent’s misconduct, it may pursue claims for damages against the respondent.

There are no statutory requirements regarding the format of the conclusion. However, a written report is generally recommended for purposes of assisting internal management, maintaining records, providing evidence in potential disputes, and reporting to external authorities, etc.

In addition to the written report, the documents generated or discovered during the process of internal investigation, including interview transcripts and other relevant materials which can provide evidence to support the conclusions of the investigation, should also be securely stored and maintained as confidential.

There are no statutory requirements regarding contents of an investigation report, but an HR internal investigation report typically contains the following items.

• Summary and introduction: including the background, timeline, scope and subjects of the investigation.
• Background and investigative actions: including alleged or suspected wrongdoing, the actions taken and the investigation methods.
• Findings and conclusion: to provide a detailed explanation of the findings, issues identified during the investigation, and conclusions of whether the respondent engaged in misconduct, supported by relevant evidence.
• Recommendations: To provide specific measures for next steps based on investigation conclusions and the employer’s internal policies. Recommendations are usually included in an internal investigation report.

For the Reporter

The employer has no statutory obligations to inform any employee about the outcome of the investigation under PRC law. Whether the reporter has a right to learn the outcome of the internal investigation depends on whether there are relevant stipulations in the employer’s internal rules and policies. Due to the confidentiality of the investigation, the employer might not disclose the investigation outcome to the reporter. However, in order to encourage whistle-blowing, it is recommended that the whistle-blowers be granted the right to learn about relevant information that corresponds to the matters they reported.

The reporters typically have no access to the completed internal investigation report, since the report may contain the employer’s trade secrets, the privacy of other employees and other sensitive information.

In practice, once the internal investigation is concluded and subsequent measures are determined, the employer may send the reporter a case closure notice to clarify the end of the investigation and briefly explain the reason why it ended. The notice will also provide channels for appeal in case the reporter has any confusion or objection.

For the Respondent

Whether the respondent has a right to know the outcome of the internal investigation also depends on the employer’s internal policies.

However, under the PRC Labor Contract Law, if an employer decides to take disciplinary actions against the respondent, particularly to terminate the employment contract with the respondent, it is required to inform the respondent about the findings of the internal investigation and the specific facts supporting the disciplinary actions. If the respondent has objections to the outcome of the investigation, the employee may initiate an internal appeal procedure if it is provided for by the internal policies.

The respondents have no access to the completed internal investigation report either, in order to protect the reporters, the privacy of other employees and other sensitive information.

Situations of Mandatory Disclosure

External investigation

If the employer is being investigated by public security authorities or other regulatory authorities and is requested to provide an internal investigation report regarding the employees’ misconduct, it must co-operate and provide a complete report in accordance with law.

Regulation in special industries

For employers in certain industries, for example, banking, if an employee’s investigation reveals any misconduct or non-compliance, the findings and outcome are typically required to be reported to higher regulatory authorities.

Situations of Self-Disclosure

According to Article 32 of Law of PRC on Administrative Penalty, voluntarily disclosing relevant facts including evidence gathered through internal investigation may lead to a mitigation in penalties. The employer’s governing body or top management should evaluate whether to make a self-disclosure to the authorities.

The conclusions of an internal investigation are typically communicated not only to the reporter and respondent involved but also to the following parties.

• Top management: The top management shall be entitled to learn the details of an internal investigation in order to make appropriate decisions and take follow-up actions. The information provided to the top management is usually comprehensive, including the background, process, conclusions of the investigation and recommended follow-up measures.
• The legal department: The legal department requires findings and conclusions of the investigation to assess potential legal risks and follow-up actions. The information shared with the legal department typically includes detailed findings and recommendations.
• Human resources department: The HR department should also have the authority to access investigation conclusions related to employee misconduct for purposes of human resource management.
• Witnesses and team members: In some cases, witnesses and team members may receive a summary of the investigation conclusions related to their testimony or job responsibilities. However, this should be kept to the minimum necessary to protect the confidentiality of the investigation and the privacy of the individuals involved.

If the allegations are substantiated, the employer may take disciplinary action according to its internal rules and policies in response to the respondent’s misconduct. The specific measures taken by the employer mainly depend on the severity of the respondent’s behaviours and whether any losses have been caused to the employer. Possible actions include criticism and education, verbal or written warnings, reassignment or demotion, etc. If the respondent’s misconduct falls under the circumstances for termination as stipulated in Article 39 of the PRC Labour Contract Law, the employer has the right to terminate the labour contract with the respondent.

In addition, from the perspective of corporate management, the employer may choose to take relatively strict disciplinary measures against the respondent in order to enhance employee management and discourage other employees from engaging in similar behaviours. These disciplinary measures must, however, comply with internal policies and legal regulations.

Regardless of whether the internal investigation finds sufficient evidence to support the allegations against the respondent, the employer should take a series of the following actions to enhance internal compliance management, including but not limited to:

• training and advocacy – strengthen corporate compliance training and advocacy to cultivate the employees’ awareness and understanding of compliance;
• remedial and improvements – identify gaps and deficiencies in compliance management and strengthen the construction of the compliance system;
• team-building activities – organise team-building events to encourage open and honest communication among team members and rebuild confidence among team members; and
• individual communication if needed.

Employers are permitted to collect personal data during HR internal investigations, but this must be done in accordance with the limitations set by the PRC Personal Information Protection Law (PIPL) to ensure compliance.

Statutory Grounds for Personal Data Collection

Personal data must be collected based on statutory grounds. The most relevant grounds for HR internal investigations include:

• the individual’s consent has been obtained; and
• the collecting is necessary for conducting human resource management under the employment rules and regulations.

It is important to note that the PIPL does not provide specific standards for what constitutes “necessary for conducting human resource management”. Therefore, obtaining employee consent remains the most common practice to ensure compliance with personal data collecting and processing.

Meanwhile, employers can also consider detailing the scenarios and specifics of personal data collection and processing in their policies. For example, HR internal investigations can be described as a part of human resource management in internal policies, thereby enhancing the legitimacy of collecting personal data under the second statutory ground.

Minimised Collection

The collection of personal data shall be limited to the minimum scope necessary for achieving the purpose of the HR internal investigation and shall not be excessive.

Limited Retention Period

The retention period of collected personal data shall be the shortest time necessary for achieving the purpose of the HR internal investigation, except as otherwise provided by any law or administrative regulation.

In addition to the limitations mentioned in 7.1 Collecting Personal Data, the following principles and rules must be adhered to when collecting and processing personal data for an HR internal investigation:

Personal Data Processing Principles

Lawful, transparent, accurate and secured

Personal data shall be processed in accordance with the principles of legality, legitimacy, necessity, good faith, openness and transparency. In addition, the quality and security of personal data shall be guaranteed during the processing.

Specified purpose

Personal data shall be processed for a specified and reasonable purpose. The processing shall be directly relevant to the processing purpose and in a manner that has the minimum impact on personal rights and interests.

Obtaining consent and separate consent

General consent

Consent shall be voluntarily and explicitly given by individuals on a fully informed basis. Processors are required to inform individuals truthfully, accurately and completely about:

• the name and contact information of the personal data processor;
• the purposes and methods of processing, the categories of personal data to be processed, and the retention periods;
• the methods and procedures for individuals to exercise the rights provided by the PIPL; and
• other matters that should be notified as required by laws and administrative regulations.

Separate consent

For certain activities (eg, sharing personal data with third parties, processing sensitive personal data, outbound transferring personal data), the PIPL requires “separate consent”, which is a form of consent with higher requirements. Based on the current understanding and practice, this consent shall be explicit and obtained specifically for each activity, not bundled with other consents.

Rules of Outbound Transfer of Personal Data

Outbound transfer of personal data for HR internal investigations is common, particularly among multinational employers sharing employees’ personal data within a global management system. Given the special nature of outbound transfer, the PIPL sets out detailed requirements. In addition to informing employees about the items to be transferred and obtaining their separate consent, the data processor is also required to conduct a personal data protection impact assessment. Furthermore, one of the following three legal mechanisms shall be adopted:

• a security assessment organised by the National Cyberspace Department;
• a certification by a specialised agency for personal data protection in accordance with the provisions of the National Cyberspace Department; or
• a standard contract formulated by the National Cyberspace Department with the overseas recipient.

Notably, under the Provisions on Promoting and Regulating the Cross-border Transfer of Data, a personal data processor may be exempt from the above mechanisms if it is necessary for cross-border human resources management in accordance with legally established labour rules and regulations, and the transfer of employees’ personal data abroad is required.

Certain parties have the right to access personal data collected in the context of an HR internal investigation, including the following.

• Individuals: Under the PIPL, individuals have the right to access, copy and modify their own personal data. Therefore, in the context of an HR internal investigation, employers cannot restrict these rights, although they may limit access to personal data that does not belong to the individual.
• State organs: If state organs require employers to provide information related to an employee’s unlawful or non-compliant behaviour, employers generally have an obligation to co-operate with these organs and disclose necessary information as required. In such cases, employers can conduct an initial screening of the information to ensure that only relevant and necessary personal data is submitted.
• Other third parties: Access for other third parties is usually defined by contracts, such as delegated contracts or data transfer agreements. Employers can include specific provisions in these agreements to limit third parties’ access to personal data.

The State Council’s Guiding Opinions specifically pointed out the necessity to make good use of the public in the interim and ex post supervision, and to establish a system of “whistle-blowers”, under which the persons who have performed meritorious deeds in reporting serious illegal acts or significant potential risks shall be rewarded and given strict protection.

In China, people have the right to complain, report and disclose any illegal or irregular behaviour to administrative agencies, and those who do so are called whistle-blowers. There are many laws that stipulate administrative agencies’ protection measures for whistle-blowers. However, the law does not stipulate protection measures for whistle-blowing in companies’ internal investigations.

In practice, companies formulate their own internal policies to encourage and protect the whistle-blowing. Concretely, some companies will design some anonymous reporting channels in their internal systems to protect the personal information of whistle-blowers; there are also some regulations that prohibit retaliation against whistle-blowers for reporting matters, and require HR internal investigators to strictly keep the whistle-blower’s privacy confidential; some companies will also set up certain rewards to encourage whistle-blowing.

In China, the Civil Code clearly provides for protection against sexual harassment. Sexual harassment means any act, in violation of another person’s will, which makes another person feel uncomfortable in relation to sex by means of words, expressions, actions, words, images, videos, voices, links or other means. Sexual violence is defined as a forcible sexual act, attempted sexual act or other coercion directly directed at another person’s sexuality, regardless of the perpetrator’s relationship to the victim.

The Civil Code breaks through the gender restriction of sexual harassment. Both men and women are equally protected when being sexually harassed.

Specifically, the protection measures against sexual harassment are divided into three stages: prevention in advance, prevention in the middle of the matter, and treatment afterwards.

• Prevention in advance: anti-harassment rules and regulations, special departments and personnel responsible for prevention and control, strengthening education and training on anti-harassment, channels for complaints.
• Prevention in the middle of the matter: timely acceptance of relevant complaints, investigation, taking necessary security measures.
• Treatment afterwards: timely feedback of investigation results, punishment according to rules and regulations, protection of victims, psychological counselling.

In China, there are a variety of laws and regulations to protect individuals from discrimination and harassment. These include not only general provisions, but also a number of special laws that target specific characteristics to provide protection.

The Constitution provides the principle that all PRC citizens are equal before the law, providing the basis for specific anti-discrimination laws. The Labour Law and the Employment Promotion Law stipulate that workers shall not be discriminated against in employment, regardless of their nationality, race, sex or religious belief. The Law on the Protection of Women’s Rights and Interests ensures that women enjoy equal labour rights and social security rights with men, and prevents and corrects gender discrimination in employment. The Law on the Protection of Disabled Persons ensures the labour rights of disabled persons, and prohibits discrimination based on disability in aspects such as the recruitment of employees, regularisation, promotion, professional title assessment, labour remuneration, living welfare, rest and vacation, and social insurance.

Victims of discrimination and harassment can seek help through administrative complaint channels, and can also file lawsuits in court to stop harassment and claim compensation.

Bullying and/or mobbing in the field of labour and employment generally refers to the behaviour that is committed by an employer or by other employees in the workplace and is for the purpose of damaging the physical and mental health or economic interests of the employee, such as violence, verbal abuse, isolation, unreasonable transfer of position, etc. However, PRC employment law currently has no independent definition or regulation on bullying and/or mobbing in the workplace, and current regulations do not separate bullying and/or mobbing from intentional harms.

Victims of bullying can request the perpetrator to bear the liability for damages caused by the tortious act in accordance with the provisions of the Civil Code. Perpetrators with serious circumstances may be subject to criminal punishment.

PRC laws do not strictly or expressly set out specific procedures to be followed by employers. In practice, employers should first conduct an internal investigation to collect evidence that may support the allegation, such as surveillance videos, financial records and working records. During the process of investigation, the employer should ensure that procedural rules are complied with, and avoid infringing on the legal rights of employees. If the preliminary investigation discovers that the employee’s activities may constitute a criminal offence, the employer shall report the case to the public security authority and submit relevant evidence. The employer needs to communicate with relevant authorities and assist the judicial authorities in their investigations. Furthermore, the following factors may be taken into consideration.

• Legal procedures shall be followed in terminating or suspending the labour contract. Before the court renders a judgment, an employer cannot unilaterally terminate the labour contract during the period when the employee’s personal freedom is restricted, but the performance of the labour contract can be temporarily suspended.
• The employee’s privacy should be protected. The investigation procedures and the course of evidence collection shall meet the requirements of the law and the employees involved shall not be disclosed.
• The employer should encourage the employee to voluntarily co-operate with the investigation and try to get a lighter punishment. If an employee voluntarily surrenders themselves or provides clues that assist in the arrest of other persons involved in the case, such employee may be given a lighter or mitigated punishment.

When dealing with multi-jurisdictional cases, employers need to be mindful of applicable law and jurisdictional issues relating to each jurisdiction.

• If the investigation involves cross-border transfers of data, the employer needs to ensure that data transfers comply with the relevant laws and regulations. In China, cross-border transfer of personal information is subject to the provisions of Law on the Protection of Personal Information, including obtaining individual consent from the employee, conducting data security assessment, etc.
• As legal systems and labour rules differ significantly between different countries and regions, it is essential that employers familiarise themselves with the relevant laws in each jurisdiction to ensure that investigation activities comply with the local requirements.
• Investigators should comply with the regulations of China, including execution of labour contracts, formulation of labour rules and regulations, etc.
• Simultaneously, investigators will also need to comply with local laws and regulations when conducting internal HR investigations abroad. Certain countries may have more strict requirements on employee privacy protection. Employers may need to co-operate with local legal counsel, law enforcement agencies, etc, to ensure the smooth conduct of investigations.
• Cultural differences, protection of employees’ rights and interests, legal risks and other factors shall also be considered in the cross-jurisdictional investigation.