There are many ways that an employer can receive information that may give rise to an HR internal investigation. The most common way is an employee complaint or the receipt of other information from an employee or an employee representative. However, information can come from anywhere, and the employer is obliged to act regardless of the source. Although HR matters do not fall within the scope of Finnish whistle-blowing legislation, it is also quite common that the employer receives information requiring the start of an HR internal investigation from its whistle-blowing channel.

The most common circumstances for opening an HR internal investigation relate to claims of long-term bullying or harassment or other types of inappropriate behaviour. Other typical circumstances include the alleged misuse of business secrets or misuse of company funds.

There is no legal provision that directly requires carrying out HR internal investigations. However, certain provisions of the Occupational Health and Safety Act (738/2002) are deemed as the legal basis for an internal HR investigation.

Section 28 of the aforementioned Act concerns harassment or other inappropriate treatment that occurs at work and creates a risk or hazard to the employee’s health. Based on the provision, after becoming aware of the matter, the employer must, by the available means, take measures to remedy it. In practice, this provision includes an obligation to investigate suspicions of harassment and other inappropriate behaviour so that the employer can establish whether a breach requiring such remedial action has occurred.

Although employers are under no obligation to provide specific channels for reporting HR-related concerns, they must ensure that appropriate procedures are in place for employees to report incidents and concerns. Employers may freely choose the procedures and channels for reporting such concerns. However, unlike for whistle-blowing matters, anonymous reporting of HR concerns is not possible, as the employer cannot investigate the matter appropriately if the report is made anonymously. The process should therefore be organised so that employees report matters in their own name.

There are no specific rules regarding who carries out an internal HR investigation. The most important factors when determining the appropriate investigator are the investigator’s impartiality and competence. Often, a member of the company’s own HR team fulfils both criteria, but there are also exceptions. Companies may also have dedicated compliance officers.

If the employer’s management team member, HR team member or compliance officer is the subject of the claims or concerns, or if the claims are unusually complex or sensitive, it is usually recommended that an external counsel is brought in to participate in or conduct the investigation. This underlines the impartiality and objectivity of the investigation. However, if there is no personal connection to the claims and no other reason to suspect impartiality, it is possible that the company’s HR director will investigate the actions of another management team member.

The circumstances in which an internal HR investigation must be carried out are in practice reflected in Section 28 of the Occupational Health and Safety Act (738/2002) (see 1.2 Bases). According to this provision, when the employer becomes aware that there might be circumstances, such as bullying or threat of violence, endangering employees’ psychical or mental well-being, actions must be taken. This usually includes conducting an internal HR investigation so that the employer can first determine what has happened. In case the employer remains passive and does not act in accordance with Section 28, the management can be subject to criminal charges for an occupational health and safety crime.

It is usually impossible to verify the accuracy of an HR-related allegation without some degree of investigation. However, if the employer is able to directly ascertain whether the allegations are true, a more extensive HR internal investigation may not be necessary. It should be noted that a request from the person making the allegation to not conduct an investigation does not affect the employer’s obligation to do so.

In some cases, it may be necessary to delay or pause an investigation due to health issues of participating individuals. However, an employee’s sick leave is not in itself a reason to postpone or pause the investigation. The employee’s ability to participate despite sick leave must be determined on a case-by-case basis.

In cases where an investigation is neither obliged nor prohibited, the employer should act in accordance with the employer’s internal policies and guidelines, and ensure a sufficient case-by-case assessment.

There is no specific legislation addressing whether the reporter and/or respondent should be informed of the potential initiation of an internal HR investigation. There are also no specific requirements regarding the information to be provided or the deadlines for giving it. However, the recommended starting point is that the relevant parties should be informed appropriately and sufficiently. The parties have no right to be informed of possible disciplinary measures imposed on the other party.

As a rule, the employer is under no obligation to inform the authorities of the opening of an HR internal investigation. However, in the event that the Finnish Supervisory Agency (FSA) requests clarification on whether a certain employee has been subjected to bullying or harassment, or has experienced similar issues, the employer should inform the FSA that an internal investigation has been initiated. The FSA respects this and will therefore not pursue the matter further, at least for the time being. Otherwise, it is not a requirement to inform the authorities of the opening an internal investigation.

In the event of an internal investigation, the parties involved may be requested to sign a non-disclosure agreement (NDA). However, this is usually unnecessary if the individuals are employees of the organisation that is conducting the investigation. If an individual (for example, a witness) is not employed by the employer where the investigation is taking place, it is customary to require an NDA. With regard to employees working in the same organisation, the general confidentiality and loyalty obligations based on legislation and/or the employees’ employment agreements apply. In most cases, no separate NDA or other confidentiality agreement is required when the investigation specifically concerns HR matters and relates to the employment/service relationship under Finnish law.

Although it is possible to conduct a preliminary investigation to determine whether a full HR internal investigation is necessary, based on the firm’s experience, this is quite rare. It is imperative that the scope of the investigation be examined and determined at the outset of every investigation. Following a preliminary investigation, if it is determined that a full investigation is not required based on the available evidence, the employer can decide not to proceed with any further investigation.

The person(s) making the allegations and the person(s) to whom the allegations relate are typically interviewed in the course of an HR internal investigation. Possible witnesses are also interviewed.

During the investigation, any party may suggest that certain persons should be interviewed as witnesses. The investigator may decide whether interviewing the proposed witnesses is necessary considering the scope of the investigation. In addition, the investigator may, at their own discretion, decide that additional persons not proposed by either party should also be interviewed during the investigation. Usually, these additional persons are mentioned during the first interviews. It is ultimately the investigator’s responsibility to identify and determine who possesses relevant information and who will be interviewed. The number of witnesses in an HR internal investigation therefore varies significantly.

Unlike a civil litigation case, where a person is compelled to testify under the threat of a fine, an internal investigation is not a formal process carried out by the authorities. If the interviewee is an employee of the organisation where the investigation takes place, the employer may use its right to direct work and order the person to participate.

If an interviewee is not employed by the employer conducting the investigation, the employer is unable to compel their participation. The decision to participate is therefore at the discretion of the external individual. However, their participation can be encouraged by explaining the importance of the investigation and taking enough time to explain the investigation process, so that nothing remains unclear.

Interviews within an HR internal investigation can be carried out remotely via, for example, Teams or Zoom. In contrast to court proceedings, there are no restrictions on the methods used to conduct interviews.

There are no specific rules concerning the interviewers. The appropriate number and identity of the interviewers depend on the scope and extent of the investigation. To ensure first-hand information, the investigator should be present in the interviews. In practice, it is usually recommended to have (at least) two interviewers, and larger investigations may require additional interviewers. It is important to have a sufficient number of interviewers, especially if interviews cannot be recorded, to ensure that the investigation remains objective and accurate.

Since the interviews and the parties present during them are not regulated by any specific provision, there are no instances in which a neutral third party must be present. Furthermore, since HR internal investigations are carried out within companies or other organisations and are not regulated, the person conducting the investigation determines whether a neutral third-party witness should be allowed at the interview.

Interviewees are typically permitted to be accompanied by a support person and/or a lawyer, and occasionally they request this option. Although there are no specific provisions relating to interviewees’ rights, the person conducting the HR investigation (for example, internal HR or external counsel) will usually allow interviewees to be accompanied by a support person/lawyer, and this is generally encouraged.

At the beginning of the interview, the interviewer will typically explain the background and purpose of the interview and the investigation as a whole, as well as the procedures that will be used. The possible intention to record the interview should also be stated before the interview starts.

Should the interviewee wish to end the interview, it is at the interviewer’s discretion as to whether the interview should be stopped. However, as the person conducting the investigation is unable to use coercive measures to ensure the interview continues, it is advisable to pause the interview and resume it as soon as possible. There are no provisions in place that would prevent the interview from continuing via Teams or Zoom, for example.

An experienced investigator establishes trust with everyone they interview during an investigation. A positive atmosphere of mutual trust is vital for effectively executing the investigation. Such an environment is likely to reduce the likelihood of interviewees wanting to end the interview.

There are no requirements for taking minutes during internal HR investigations. However, it is customary for the investigator to take notes or minutes during interviews. It is also standard practice to create an interview memorandum, which is a document summarising the interview.

It should be noted that the interview memorandum reflects the views disclosed to the investigator and is not based on the interviewee’s own memorandum or similar. Before finalising the memorandum, the investigator usually gives the interviewee an opportunity to comment on the matters included in the memorandum. However, ultimately, the investigator decides the final content of the memorandum, which reflects the investigator’s view of what they have been told. It is not necessary for the interviewee to sign the minutes in order for them to be considered valid. If an external party conducts the investigation, it is customary for minutes to be taken in a form determined by the person conducting the investigation.

Interviews can be recorded. If this is the case, it will be stated before the interview begins. Any transcript produced based on the recordings usually only serves the investigator as a tool, and it is not common to share the transcript to the interviewee or other persons. The transcript is a tool for the investigator to double-check the information submitted during an interview.

If the interview is not being recorded by the investigator and is taking place via remote hearing, it is difficult to ensure that the interviewee is not recording the interview. However, there is no need to attempt to prevent such recording – under Finnish law, individuals are allowed to record their own conversations. The most important thing is that the investigator establishes an atmosphere of trust, so that if an interviewee is recording the interview, it is not due to distrust of the process.

The parties involved are permitted to submit any evidence they consider relevant to the case. The evidence can be in any form (written, video, recording, email, etc). The investigator may request that the parties involved, witnesses or external parties provide additional material. Please note that external parties are under no obligation to provide any materials.

There are also significant restrictions on the employer’s right to access employee emails or files to find evidence. The investigation process should always be transparent so that the parties (reporter and respondent) know what material and information the conclusions are based on. Witnesses do not have similar visibility.

The employer is responsible for the safety and health of all employees (including the reporter, the respondent and other employees) in the workplace under its general duty of care under Chapter 2, Section 3 of the Employment Contracts Act (55/2001) and Chapter 2, Section 8 of the Occupational Safety and Health Act (738/2002). If a situation arises where this requires, for example, changes to working arrangements (eg, remote working or moving an employee’s workstation further away from another) before or during the investigation, the employer is as a rule free to make such changes based on the employer’s right to direct work. However, the employer’s actions cannot include degradation of the terms of employment and should not be, or seem, retaliatory. In addition, in certain situations, for example if there is a clear threat to an employee’s psychological health or safety, the employer may release the employee from their obligation to work for the duration of the investigation.

Furthermore, it should be noted that Section 16 of the Non-Discrimination Act (1325/2014) and Section 8a of the Act on Equality between Women and Men (609/1986) contain specific provisions for the protection of individuals who have invoked the rights or obligations set out in these Acts, participated in the investigation of a matter concerning discrimination or taken other measures to ensure equality. Should the employer fail to protect the reporter, resulting in adverse consequences, the employer’s actions or negligence may be classified as discriminatory conduct. It is possible that this issue could be subject to separate litigation under the Non-Discrimination Act (1325/2014).

As an investigation will be conducted on the basis of impartiality and objectivity, it is essential that the respondent is given a genuine opportunity to respond to the allegations made against them and to provide evidence. Due to the nature of HR investigations and the sensitive matters they deal with, the initiation of an HR investigation is kept confidential to ensure the protection of the individual’s reputation.

Prior to concluding the HR investigation, the employer may take lawful disciplinary actions against the respondent, but the employer is responsible for the risk of measures being disproportionate. The employer can, for example, issue a written warning or terminate the employment if the grounds stated in the Employment Contracts Act (55/2001) are present. For instance, if it becomes clear before or during the investigation that there are clear grounds for termination of employment (with or without notice) and that termination is urgent in order to protect the reporter’s health and safety at work, it may be advisable to terminate the employee’s employment before the investigation has officially concluded. All disciplinary measures must be justified on a case-by-case basis.

There is a risk that such measures will later be deemed unlawful, retaliatory or even discriminatory. At the same time, neglecting necessary measures is also risky; for example, if the employer is considered not to have acted in a timely manner once it was informed of the relevant circumstances.

The measures described in 4.1 Protection of the Reporter may also apply for or against the respondent, but they should similarly not be or seem retaliatory.

Pursuant to Section 8 of the Occupational Health and Safety Act (738/2002), the employer is obliged to take the necessary measures to ensure the health and safety of their employees, including those who are not actual parties to the investigation. To this end, the employer must consider factors relating to the work performed, working conditions and other aspects of the working environment, as well as the personal circumstances of individuals. This may include measures such as remote working and other work-related arrangements, including appointing a new supervisor. Failure to protect employees may result in criminal charges for the employer and its management in accordance with Chapter 47, Section 1 of the Penal Code (39/1889). As there is a legal obligation to protect employees, there will be no adverse consequences for taking such protective measures.

The measures described in 4.1 Protection of the Reportermay also apply for or against other employees, but they should similarly not be or seem retaliatory.

With regard to procedural guarantees, it should be noted that internal HR investigations are not governed by any specific statute, such as in the Code of Judicial Procedure (4/1734). HR investigations are the company’s own internal proceedings, but they are often conducted by an external investigator. This ensures an impartial and independent view free from the influence of the company’s structures and reporting lines.

Although there are no binding procedural rules, there are some recommended best practices. It should be emphasised that no pressure of any kind should be exerted. As a result, the use of support persons or legal advisers should be viewed positively. The respondent needs to have all relevant information on the allegations made against them. Furthermore, all of the investigation material that the conclusions are to be based on should be transparent and visible for both parties.

For internal HR investigations to be effective and relevant in the context of potential legal proceedings, such as wrongful termination litigation, it is essential that they be conducted with the utmost impartiality and that all relevant factors are given full consideration.

As outlined in 5.1 Requirements, the governance of HR investigations is not subject to any particular statute. However, employers may have internal policies that define these terms, in which case employers must comply with them. However, it is not advisable to “lock” oneself into overly-specific procedures in the policy, as they may limit the employer’s options in terms of investigation procedures. Employers should have up-to-date policies in place relating to unwanted behaviour, such as harassment and violence in the workplace, and processes for reporting it. It is equally important that employees are trained regarding the policies and processes. This helps ensure that matters are reported and that early intervention can be effected.

In the event that an employee makes allegations against, for example, a colleague, supervisor or member of the company’s management, the responsibility for providing evidence to support these claims lies with the person making the allegations. The individual leading the internal investigation is responsible for determining and deciding on the degree of proof. The burden of proof differs substantially from that in an employment-related civil litigation on wrongful termination, and there are no binding legal rules regarding it.

Allegations are often made in good faith based on the reporter’s subjective experiences. The investigator is responsible for determining what has actually happened and objectively deciding on the appropriateness of the actions in question.

There are no specific rules or regulations governing when an internal HR investigation should end. Whether or not to proceed with the investigation is at the investigator’s discretion. The investigator should consider when they have gathered sufficient information and material to conclude the investigation and address all matters within its scope. The outcome will vary according to the specific circumstances of each case.

Following the completion of the investigation (which includes interviews, evidence-gathering and the drafting of conclusions), the investigator will inform the employer of their conclusions. The employer will then be responsible for drawing their own conclusions based on the investigation and any recommendations. The employer will then communicate their conclusions to the relevant parties. Employers are responsible for ensuring that all actions, including communication, are carried out. The investigator may assist the employer with this process.

There are no stipulated regulations regarding the form that the conclusion must take. However, it is standard protocol that the investigator prepares a final report and submits it to the relevant employer representative(s) or client’s representative(s), depending on whether the investigation has been conducted by an external counsel. If the investigation relates to the managing director (ie, the CEO), who is a designated company organ under Finnish law, the board of directors of the company will be informed. The report may be extensive or a simple executive summary, and the client may request a specific type of report from an external counsel.

There are no provisions in place that stipulate the content of written reports. However, it is customary for such reports to include at least:

• a description of the complaint;
• a summary of the events that have been established through interviews and/or evidence; and
• a conclusion, which determines whether the allegation(s) can be substantiated based on the information submitted during the proceedings.

Depending on the outcome of the investigation, the report frequently also includes recommendation(s) for the employer regarding the next steps.

As well as the employer’s obligation to determine whether inappropriate behaviour has occurred, it is standard practice to inform the relevant parties of the outcome of the internal HR investigation.

The parties (reporter and respondent) often do not have access to the full conclusion report, but they are informed of the relevant parts of the conclusions. Furthermore, during the investigation process they have access to all hearing memoranda and evidence that the conclusions are based on. This access to conclusions and material is granted only to the reporter and the respondent, and not to any witnesses or other individuals interviewed; they only have access to (and can verify) the memoranda from their own hearings.

As a rule, there is no legal obligation to communicate the conclusions to any authorities. However, and as mentioned in 2.2 Communication to Authorities, in the event that the FSA requests clarification on a certain case, the employer should inform the FSA about an internal investigation or any conclusions related thereto. The employer should also inform the relevant authority if they receive any enquiries on their behalf.

The conclusion of the investigation is communicated only to the parties (reporter and respondent) and the client’s (ie, the employer’s) representative(s), in accordance with the client’s wishes and needs. This information generally covers, at a minimum, the conclusion reached on the basis of the investigation and any measures that may be taken as a result. The full report is not typically delivered to the parties (reporter and respondent), and the extent of communications is determined on a case-by-case basis. Typically, the necessary information is communicated to them verbally in a more concise written form.

In the event that the allegations are substantiated, the employer is permitted to implement any disciplinary measures outlined by applicable law or legally stipulated in its internal policies. The following measures are the most common:

• issuing a written warning;
• terminating the employment contract (notice period applies); or
• immediate termination of the employment contract (notice period does not apply).

Please note that immediate termination of employment must be carried out within 14 days of the employer becoming aware of the grounds for termination. The 14-day period is usually considered to start only after the conclusion of the investigation. For normal termination, notice must be given within a reasonable timeframe after the employer becomes aware that the grounds for termination have been met.

It is common practice for employers to take other measures, irrespective of the findings. These actions typically involve the utilisation of an external service provider for internal mediation. If the situation has been ongoing for a considerable time, it is possible that the employer’s duty to prevent excessive employee stress has been overlooked. In such cases, the concern and measures may need to be extended to a larger group of people within the workplace than just those directly involved. This obligation is rooted in the employer’s duty to protect their personnel, as set out in Section 8 of the Occupational Health and Safety Act. It is also the employer’s duty, pursuant to Section 25 of the same Act, to monitor employees’ stress levels, investigate the causes of stress and take measures to avoid or reduce employees’ exposure to stress.

The general principle in the Act on the Protection of Privacy in Working Life (759/2004) is that employers may only collect and process personal data that is directly necessary for the employment relationship, and which relates to the rights and obligations of the employment relationship (eg, to conduct an HR investigation involving a particular employee). This requirement of necessity cannot be waived with the employee’s consent.

The employer must collect personal data concerning the employee primarily from the employee. If the employer collects personal data from a source other than the employee, the employee’s consent must be obtained for the collection of the data. However, consent is not required when an authority discloses data to the employer for the purpose of performing a task prescribed by law, or if the collection or obtaining of data is specifically provided for by law. Finnish legislation also contains provisions that address the confidentiality of electronic communications, such as emails, SMS, instant messages and internet browsing, alongside related metadata such as IP addresses and timestamps, and accessing such confidential electronic communications is permitted only in very limited situations subject to strict conditions.

The parties involved in the investigation generally have a right to access any of their own personal data collected during an HR investigation. As mentioned in the foregoing, the employer must collect personal data concerning an employee primarily from the employee. If information concerning an employee has been collected from sources other than the employee, the employer must inform the employee of the information obtained before it is used in decision-making concerning the employee.

The Act on the Protection of Privacy in Working Life (759/2004) does not provide explicit exceptions that would allow an employer to deny an employee access to their own personal data in the context of an HR investigation. However, the restrictions to access set out in the Finnish Data Protection Act (1050/2018) – regarding, for example, situations where providing access to the data could hamper the prevention or investigation of offences or seriously endanger the health or treatment of the data subject or the rights of some other person – may apply. In addition, the employer may have the right to refuse the fulfilment of an access request that would adversely affect the rights and freedoms of others.

AI is increasingly being used in internal investigations, particularly for managing large volumes of data. AI tools may enable efficient review and analysis of substantial amounts of documents and information that would otherwise be time-consuming to process manually. This includes organising evidence, identifying relevant documents and extracting key information from investigation materials. When implementing AI tools, it is crucial to select AI solutions that are safe to use from a data protection perspective. Furthermore, the AI tool to be used should not train the language model based on the data fed into it, and AI should not be used to make decisions without human involvement. In addition, an impact assessment may be needed before using an AI tool, and the persons using the tool should be sufficiently trained.

Finland has implemented the EU’s whistle-blowing directive through the Act on the Protection of Persons Reporting Violations of European Union and National Law (1171/2022) (the “Finnish WB Act”). As a starting point, the Finnish WB Act concerns only more serious breaches of certain legislation. The Finnish WB Act provides for protection for those reporting (suspected) breaches in the field of, for example, public procurement, financial markets, money laundering and terrorist financing, product safety and compliance, environmental protection, food safety and consumer protection. Further, protection under the Finnish WB Act requires that any breach of such legislation would lead to, for example, criminal or administrative sanctions. HR matters do not fall within the scope of the Finnish WB Act.

The Finnish WB Act provides protection for whistle-blowers by prohibiting retaliatory action from employers or organisations, including termination, suspension, unfavourable treatment or other actions having negative consequences for those who report violations. Whistle-blowers who have been subjected to retaliatory measures have the right to receive compensation for the harm caused.

The general provisions about, for example, harassment or other inappropriate behaviour are found in Sections 25 and 28 the Occupational Health and Safety Act (738/2002). However, not all situations that could be considered sexual harassment are clearly and exhaustively defined by law, although some guidance can be found in the Act on Equality between Men and Women (609/1986), Section 8d, and in the Penal Code (39/1889), Chapter 20, Sections 5 and 6, which may help to determine whether the case concerns sexual harassment or sexual assault. Some clarifying definitions can be obtained from, for example, the website of the Occupational Safety and Health Administration. The law protects all employees who have been subjected to sexual harassment or some other type of harassment.

In the firm’s experience, since the #MeToo movement, companies and individuals have become increasingly aware of the harmfulness of sexual harassment and other breaches of employees’ physical and psychological safety. Most reported cases do not involve allegations of blatant sexual harassment, but often instead allegations of relatively subtle bullying and inappropriate treatment. Such nuanced and subtle allegations can be difficult to investigate and verify.

Please see 8.2 Sexual Harassment and/or Violence.

Allegations of sexual harassment, for example, are often criminal in nature (please also see 1.5 Obligation to Carry Out an HR Internal Investigation). In such cases, it is the employer’s responsibility to determine whether the alleged actions of the employee meet the criteria for a crime. The employer must also decide whether to release the employee from the working obligation or subject them to other precautionary or disciplinary measures, such as termination of employment. It is imperative that such matters be addressed promptly.

Please note that disciplinary action may be assessed incorrectly, which could result in further civil litigation regarding wrongful termination. The most common crimes associated with HR investigations are occupational health and safety offences and sexual harassment. However, in this case, action must be taken by the individual concerned, meaning the employer cannot request police intervention on their employee’s behalf. If a criminal investigation is launched, the employer must comply with any orders issued by the relevant authority. If charges are filed, the employer’s duties will be determined based on their role in the proceedings.

If an employment relationship has been terminated based on the employer’s assessment that criminal behaviour has occurred, and there are later court cases both regarding the legality of the termination and the criminal case, the civil proceedings regarding termination can be paused to wait for the results of the criminal case.

Although there are no specific regulations governing multi-jurisdictional investigations, it is important to note that the other jurisdiction in question may have its own procedural regulations relating to such situations. As a general rule, there are no restrictions on foreign employers carrying out internal HR investigations in Finland, or on employers in Finland carrying out internal HR investigations abroad. Employers must comply with local legislation. Employers operating in Finland must comply with Finnish legislation, regardless of their country of origin, as work performed in Finland is subject to Finnish law.