HR Internal Investigations 2026

Last Updated February 04, 2026

France

Law and Practice

Authors



Axipiter is an independent French law firm with a strong international leaning and around 30 lawyers in France. It offers comprehensive expertise in business law, with a recognised Employment Law department, advising a wide spectrum of clients – from SMEs to large international groups – on all aspects of legal and employment matters. Axipiter’s Employment Law team is known for its pragmatic and tailored approach, with a strong focus on human, organisational and compliance-related challenges. In providing customised solutions adapted to both French and international settings, the firm helps clients navigate their HR issues and make strategic, informed decisions. The team frequently advises on sensitive internal HR investigations. For instance, it recently managed inquiries following allegations of moral harassment for a leading retail and luxury group, and optimised internal investigation processes for an industrial mining client. It delivers practical, compliant solutions protecting both reputation and workforce integrity.

Internal HR investigations in France are usually triggered by any matter that could impact compliance, workplace integrity, or employee wellbeing. Investigations arise when facts or allegations suggest potential breaches of internal rules, statutory obligations, or workplace standards.

Common triggers include:

  • employee complaints or whistle-blowing reports regarding harassment, discrimination, retaliation, or other misconduct;
  • ethical or compliance concerns, such as fraud, corruption, conflicts of interest, misappropriation of company assets, or violations of data protection rules;
  • incidents affecting workplace safety or integrity, including health and safety breaches or behaviour that could undermine the work environment; and
  • regulatory or legal risks that could expose the company to civil, criminal, or administrative liability.

A key example under French law concerns allegations of harassment or discrimination. Employers have a legal duty to act promptly and take appropriate measures. Under Article L.4121-1 of the French Labour Code, employers must take all necessary steps to ensure the safety and protect the physical and mental health of workers. This includes:

  • preventing harassment (L.1152-4); and
  • preventing, stopping, and sanctioning sexual harassment (L.1153-5).

Since the 2016 reform, an employer’s liability for harassment can be limited if the employer demonstrates that it has implemented all preventive measures and that it took immediate action once aware of allegations (Cass. Soc., 1 June 2016, No 14-19.702).

Conducting an internal investigation promptly and impartially is considered a key measure for assessing the validity of such allegations and implementing corrective actions, helping to mitigate potential legal exposure.

HR internal investigations in France can be conducted on the basis of legal obligations, best practice considerations, or the employer’s discretionary powers. These three categories determine whether an investigation is mandatory, recommended, or optional, depending on the circumstances.

Legal Obligations to Conduct an Investigation

Certain situations require the employer to carry out an internal investigation, as follows.

  • Social and Economic Committee (Comité Social et Économique – CSE) alerts: A member of the CSE may exercise a right of alert regarding breaches of individual rights (Articles L.2312-5 and L.2312-59) or in the event of serious and imminent danger (Articles L.2312-5, L.2312-60, and L.4132-1 et seq).
  • Whistle-blowing reports: Reception of a report via a professional alert system established under Law No 2016-1691 of 9 December 2016 (Sapin II), applicable to companies with at least 50 employees.

Non-Mandatory But Strongly Recommended Investigations

Outside these specific obligations, there is generally no statutory requirement to open an internal investigation, including in harassment cases. Recent case law confirms that:

  • an employee may be dismissed for harassment without a prior internal investigation (Cass. Soc., 14 February 2024, No 22-14.385); and
  • an employer does not breach its health and safety obligations if it has implemented sufficient measures to protect the employee, even without conducting an internal investigation (Cass. Soc., 12 June 2024, No 23-13.975).

However, conducting an internal investigation is strongly recommended, particularly in cases of alleged harassment, due to:

  • the employer’s health and safety obligations (Article L.4121-1 Labour Code);
  • jurisprudence requiring immediate measures to stop harassment (Cass. Soc., 1 June 2016, No 14-19.702);
  • the National Interprofessional Agreement of 26 March 2010, which provides that complaints should be followed by an investigation;
  • case law indicating prompt investigation is appropriate when an employee alleges being a victim or witness of harassment (Cass. Soc., 29 June 2011, No 09-70.902); and
  • the fact that such investigations also serve as evidence regarding measures taken to stop harassment and the justification for any disciplinary action against the alleged perpetrator.

Employer Discretion to Conduct an Investigation

Outside these circumstances, the employer may open an investigation at its discretion, under its management and disciplinary powers, or to protect the company’s assets and interests.

In France, employers are not legally required to establish dedicated reporting channels for employees.

Article 4.2 of the National Interprofessional Agreement of 26 March 2010 recommends that an appropriate procedure can be implemented to identify, understand, and address harassment and workplace violence.

In practice, in the absence of a statutory framework, employees raise concerns through a variety of channels, including verbally, in writing, by email, or via the company’s internal messaging system. Reports may be made to different recipients, such as colleagues, line managers, HR representatives, senior management, employee representatives, or occupational health doctors.

Employees may submit reports anonymously; however, taking immediate and effective action can be more challenging when the report is anonymous.

Regardless of the channel used, once the employer becomes aware of a concern, they must act promptly, which typically includes initiating an internal investigation if appropriate.

In France, the rules regarding who should conduct an internal HR investigation depend on the circumstances.

When a report originates from a member of the CSE under their right of alert, the employer must conduct the investigation with that CSE member (Article L.2312-59 Labour Code). Outside this legal requirement, the employer may conduct the investigation internally or appoint an external investigator, as there are no statutory rules on the composition of the investigation team.

The French Ministry of Labour recommends ensuring a plurality of perspectives. The investigation may be conducted jointly by a management representative and an employee representative. If the company has no employee representatives, a volunteer employee may be selected. Care should be taken not to assign the investigation to employees working in the same department as the alleged victim or perpetrator, to their direct supervisors, or to anyone whose involvement could compromise the investigation’s impartiality (Ministry of Labour Guide, 8 March 2019).

Case law provides further guidance. In some instances, the investigation may be conducted solely by the HR Director (Cass. Soc., 1 June 2022, No 20-22.058) or by a psychologist specialised in psychosocial risks, even if not approved by the Labour Inspectorate (CA Agen, 9 January 2024, No 22/00827). Such investigations may, however, be more easily contested in legal proceedings.

Conversely, the French Supreme Court has ruled that assigning an internal investigation to an employee who is in conflict with the individual concerned constitutes a breach of the employer’s health and safety obligations (Cass. Soc., 6 July 2022, No 21-13.631).

In France, an internal HR investigation must be conducted in certain circumstances, including:

  • when a member of the CSE exercises their right of alert regarding breaches of individual rights (Articles L.2312-5 and L.2312-59 Labour Code) or in the event of a serious and imminent danger (Articles L.2312-5, L.2312-60, and L.4132-1 et seq); and
  • when a report is made through a professional alert system established under Law No 2016-1691 of 9 December 2016 (Sapin II), applicable to companies with at least 50 employees.

Failure to conduct an investigation in these circumstances may engage the employer’s liability for breach of their health and safety obligations, and, if the conditions are met, could give rise to claims of gross negligence.

In France, there are certain circumstances in which an internal HR investigation may not be carried out, either temporarily or at all, as follows.

  • Interference with ongoing criminal proceedings: An internal investigation may be suspended or limited if it risks interfering with a parallel criminal investigation. A draft law of 29 October 2024 (Bill No 514) is currently under review to regulate internal investigations conducted alongside criminal proceedings.
  • Potential breach of fundamental rights or data protection rules: Investigations must respect employees’ fundamental rights and comply with personal data protection laws.
  • Use of unfair or inappropriate methods: Investigations must be conducted fairly; any improper investigative method could invalidate the process.

The necessity of an internal investigation also depends on the circumstances.

  • An internal investigation should only be initiated if the report requires further investigation (Framework Decision No 2025-019, 5 February 2025).
  • If the employer already has sufficient knowledge of the facts and the investigation would not provide additional information, immediate protective measures may be taken and disciplinary proceedings may be initiated against the alleged perpetrator.
  • In most cases of harassment or discrimination, an internal investigation remains necessary, as the facts are often complex and require careful examination.

In cases where an internal HR investigation is neither legally required nor prohibited, the employer must assess whether it is appropriate to proceed.

Factors that may inform this decision include:

  • the severity and complexity of the alleged facts;
  • potential legal risks, such as exposure to employment tribunal claims;
  • the need to gather evidence in order to:
    1. establish the veracity of the reported facts; and
    2. initiate disciplinary proceedings against the alleged perpetrator;
  • the potential impact on the workplace climate; and
  • compliance with applicable internal procedures related to the reported issue.

Where there is uncertainty about whether to initiate an internal investigation, legal counsel can advise the employer on the appropriate course of action.

It is generally recommended than an internal investigation be opened promptly upon becoming aware of potential harassment or misconduct, as this:

  • allows the employer to clarify the facts and circumstances of the report;
  • reinforces the legitimacy of any measures taken following the investigation; and
  • protects the employer against allegations of failing to act appropriately.

Under French law, neither statute nor case law requires the employer to inform the respondent that an internal investigation is being initiated in cases of harassment.

The French Supreme Court has clarified that an employer is obliged to conduct an impartial investigation when allegations of moral harassment are made, and that such an investigation may be conducted without the respondent’s knowledge without constituting an unfair method of evidence (Cass. Soc., 17 March 2021, No 18-25.597).

Nonetheless, except where informing the respondent would pose a clear risk of pressure on alleged victims or witnesses, it is generally advisable to notify the respondent of the investigation. Doing so helps to uphold the principle of contradictory proceedings and ensures procedural fairness.

There is no legal obligation for the reporter to provide information about whether an investigation will be opened or on its progress. In practice, however, employers may choose to inform the reporter, particularly to reassure them that the report has been taken seriously and is being addressed. Any such communication should be balanced carefully to protect confidentiality and avoid prejudicing the investigation.

In France, the initiation of an internal HR investigation does not generally need to be communicated to the authorities, except where the law requires reporting.

Mandatory reporting applies in certain serious situations, including:

  • crimes such as rape, murder, or terrorism;
  • violence, abuse, or sexual assault against minors or vulnerable persons; and
  • child pornography.

In these cases, the employer must notify the relevant judicial authorities, such as the police, gendarmerie, or public prosecutor. The information typically provided includes:

  • the identity of the victim(s), if known;
  • the identity of the alleged perpetrator, if known;
  • a description of the alleged facts and circumstances; and
  • any evidence or documentation collected by the employer that is relevant to the case.

Outside of these legally mandated situations, communicating the opening of an internal investigation to the authorities is optional, and generally not recommended, in order to preserve confidentiality and ensure the proper conduct of the investigation.

In the context of an internal HR investigation, it is essential that the employer, investigators and all participants maintain strict discretion to protect the dignity and privacy of all individuals involved. Information collected during the investigation must remain confidential.

Although French law does not require parties to sign a separate confidentiality agreement or NDA, it is common practice and strongly recommended by the French Defender of Rights to have all interviewees and investigators acknowledge a confidentiality undertaking. This formalises the expectation of confidentiality and underscores its importance.

Even in the absence of a formal agreement, French law generally imposes a duty of confidentiality on participants in the investigation. Breach of this duty may expose employees or third parties to disciplinary measures or civil liability.

If confidentiality is violated, the employer may take appropriate action, which could include:

  • disciplinary measures against employees who fail to maintain confidentiality; and
  • seeking remedies under civil law if the disclosure causes harm to the company or other individuals involved in the investigation.

A preliminary assessment may be conducted to determine whether a full investigation is warranted.

Conversely, when the employer already has sufficiently precise and reliable knowledge of the facts, and a full investigation would not yield additional information, it may be more appropriate to immediately implement protective measures and consider whether to initiate disciplinary proceedings.

The French Supreme Court has confirmed that an employer can satisfy its health and safety obligations without conducting a full investigation, provided that appropriate and sufficient measures have been implemented (Cass. Soc., 12 June 2024, No 23-13.975).

In summary, a preliminary assessment is useful for evaluating whether a full investigation is warranted. A comprehensive investigation should be reserved for situations where an in-depth inquiry is necessary to establish the facts and seriousness of the allegations, particularly in cases of harassment or discrimination.

In an internal HR investigation, the key individuals typically interviewed include:

  • the alleged victimand the respondent, even if either is on sick leave;
  • witnesses, as well as any individual requesting to be interviewed or whose testimony is requested by the alleged victim or the respondent;
  • direct supervisors or line managers; and
  • potentially other relevant parties, such as the occupational health doctor or labour inspector, if their expertise is required.

Although the French Supreme Court does not mandate that the respondent be interviewed, both the Defender of Rights and the Ministry of Labour consider it essential to do so in order to uphold the principle of adversarial proceedings.

Direct confrontation between the alleged victim and the respondent is strongly discouraged due to potential psychosocial risks.

There is no fixed number of witnesses to be interviewed. The goal is not to interview all employees, but rather to speak with a sufficient number of individuals to obtain clear and objective information, allowing investigators to fully understand and analyse the situation.

Courts assess the value of an investigation without requiring that all employees be interviewed (Cass. Soc., 8 January 2020, No 18-20.151).

If the respondent refuses to participate in an investigation, they cannot be compelled to do so. It is, however, recommended to document in detail all summons and the refusal, as this refusal can be taken into account when analysing the facts.

The alleged victim may also decline to participate for various reasons, such as fear, trauma, or lack of trust. In such cases, the employer should note the refusal, continue the investigation by other means, and, where possible, offer alternatives (eg, accompanied interviews, written statements).

In general, it is advisable to systematically document all attempts to interview individuals, refusals, partial participation, and the reasons given, to demonstrate the employer’s diligence in conducting the investigation.

Interviews may be conducted remotely using secure platforms such as Teams or Zoom. The key requirement is that the confidentiality and integrity of the discussions be fully maintained.

Employers should ensure that participants are in a private setting where the conversation cannot be overheard and that any digital tools used comply with data protection and privacy standards.

While remote interviews are practical and increasingly common, care should be taken to preserve the same level of confidentiality and professionalism as in face-to-face meetings.

To ensure objectivity and impartiality, it is recommended that at least two investigators be appointed. Investigators must be completely neutral, with no personal or hierarchical connection to either the respondent or the alleged victim in order to avoid any conflict of interest or undue influence.

The French Defender of Rights recommends including at least one investigator with strong legal knowledge in workplace discrimination and experience in interview techniques. Investigations may be conducted internally or, in cases of a potential conflict of interest, by an external service provider.

The presence of a neutral third party during interviews may be advisable in certain situations to ensure fairness and transparency. Typical circumstances include:

  • when the interviewee requests to be accompanied, for example by an employee representative, colleague, or other trusted individual; this can help the interviewee feel supported and encourage openness; or
  • when internal company policies or procedures explicitly provide for third-party accompaniment during interviews.

While not legally required, involving a neutral observer can also enhance the credibility of the investigation, provide additional oversight, and help document that the interview was conducted fairly. Employers should ensure that any third party present maintains confidentiality and does not influence the substance of the interview.

Interviewees may be accompanied by a support person, such as an employee representative, interpreter, or lawyer, provided that the accompanying individual remains passive and does not intervene on behalf of the interviewee.

French law does not confer an absolute right to be accompanied by a support person or lawyer during an internal HR investigation. However, companies may allow accompaniment either as a matter of internal policy or in response to a specific request, particularly in sensitive or complex cases, to ensure the interviewee feels supported and to uphold the principle of procedural fairness.

Employers should make clear to all participants that the role of any accompanying person, including a lawyer, is limited to support and observation, without influencing the substance of the interview.

At the beginning of the interview, it is recommended that the interviewee be informed of the following:

  • the confidentiality obligations applicable to them during the investigation;
  • that all statements and information exchanged during the interview are strictly confidential and must not be disclosed to anyone outside those present;
  • the relevant legal framework regarding moral harassment, sexual harassment, and discrimination, in order to provide context for the investigation;
  • the context, purpose, and scope of the investigation, so that the interviewee understands the objectives of the interview;
  • the possibility of being accompanied, if applicable under internal policies or legal requirements; and
  • how their personal data will be processed in accordance with GDPR, including purposes, confidentiality measures, retention period, and authorised access.

At the end of the interview, it is recommended to inform the interviewee of:

  • the next steps in the investigation, including, where possible, an estimated timeline;
  • the continued obligation to maintain confidentiality following the interview; and
  • the fact that a written summary of the interview will be prepared, reviewed, and signed for validation.

If an interviewee requests to stop the interview, their request must be respected immediately, and the interview should be suspended or terminated. It is essential to document in the interview record that the interviewee wished to stop, including, where appropriate, any reasons they provided for doing so. This ensures transparency and demonstrates that the employer has respected the interviewee’s rights while maintaining a clear record of the investigation.

In France, minutes of interviews are typically taken during an HR internal investigation. These should accurately and comprehensively reflect the content of the interview.

Key points regarding interview minutes include the following.

  • Review and signature: Interviewees should have the opportunity to review the minutes to ensure their statements are correctly recorded. They are generally asked to sign the minutes to acknowledge their accuracy.
  • Summarised minutes: While minutes should be as accurate as possible, summarised minutes may be used in practice, provided they faithfully capture the substance of the interview.
  • Who prepares the minutes: It is not necessary for an external party to draft the minutes. One of the investigators can prepare them, provided impartiality and accuracy are maintained. If the investigation is outsourced, the external provider usually prepares the minutes.
  • Impartiality and accuracy: Whether prepared internally or externally, the minutes must preserve the integrity of the interview process and ensure that the content can be relied upon for any subsequent actions, including disciplinary or legal proceedings.

Recording of interviews is possible in France, but only with the consent of all participants. It is not standard practice in internal HR investigations, as it may discourage interviewees from speaking freely.

If an interview is recorded, a transcript may be produced. Its use and distribution must be strictly controlled in accordance with confidentiality obligations. Typically, transcripts are shared only with the investigators and, if necessary, the legal counsel involved in the investigation.

To ensure that interviews are not recorded without authorisation, including in remote settings (eg, via Teams or Zoom), it is recommended to clearly inform all participants at the start of the interview that recording is prohibited and to reiterate the confidentiality requirements. Employers should also consider disabling any recording features on the digital platforms used.

In principle, evidence must be collected in a lawful and fair manner. This may include, for example, emails, written statements, recordings, or testimony from other employees. Unfair or improper methods of obtaining evidence are generally excluded.

However, the French Defender of Rights has acknowledged that certain evidence obtained unfairly (such as clandestine recordings) may be considered if it is indispensable to establishing the truth, and if the intrusion into the privacy of the individuals concerned is strictly proportionate to the purpose pursued.

French case law similarly allows evidence obtained unlawfully or unfairly to be submitted in court, provided it is essential to exercising the right to evidence and does not disproportionately harm the interests of the opposing party (Cass. ass. plén., 22 December 2023, No 20-20.648).

Investigators must therefore carefully balance these competing interests when deciding whether to admit or rely on evidence obtained through potentially unfair means.

Under French law, employers have a general duty of security (obligation de sécurité) under Article L. 4121-1 of the Labour Code, which requires them to take all necessary measures to protect employees’ health and safety. This obligation applies throughout the internal investigation and includes protecting the reporter from potential retaliation, pressure, or intimidation.

Mandatory and Recommended Protective Measures

Employers must take appropriate steps to ensure the reporter can continue working safely during the investigation. In practice, this may include the following.

  • Immediate referral to the occupational physician, who may recommend adjustments to duties, working hours, or workspace.
  • Provisional organisational measures designed to avoid direct contact between the reporter and the respondent. These may involve:
        • temporary leave for the respondent with full pay (Cass. soc., 8 March 2017, No 15-23.503);
        • temporary reassignment of the respondent to a different team or role (Cass. soc., 20 December 2006, No 04-46.051); or
        • placing the respondent on remote working arrangements (Defender of rights, framework decision No 2025-019, 5 February 2025).

These measures do not constitute disciplinary sanctions. They are justified exclusively by the employer’s duty to ensure a safe working environment and to prevent potential interference with the investigation.

Priority Given to Measures Affecting the Respondent

The Defender of Rights recommends that protective measures should, as a matter of priority, impact the respondent, not the reporter. Adjusting the reporter’s working conditions – unless strictly necessary and carried out with their explicit consent – may be seen as:

  • stigmatising the potential victim; or
  • constituting unlawful retaliation, prohibited by Articles L.1152-2 and L.1153-2 of the Labour Code.

The French Supreme Court has held an employer liable where, despite sanctioning the harasser, the employer proposed that the victim change departments (Cass. soc., 17 February 2021, No 19-18.149).

Legal Consequences of Taking (or Not Taking) Protective Measures

  • If the employer fails to take protective measures, it may be held liable for breach of their obligation of security. This can lead to damages, constructive dismissal claims, or recognition of workplace harassment.
  • If the employer takes protective measures inappropriately, measures affecting the reporter without necessity or consent are at risk of risk being characterised as retaliation or discriminatory treatment, exposing the employer to significant legal liability.

Under French law, employers have a duty to protect all employees, including the respondent, throughout an internal investigation. This obligation stems from the employer’s general duty of security above mentioned and from the need to respect the respondent’s fundamental rights, including dignity, privacy, and the presumption of innocence.

Measures That Must or May Be Taken to Protect the Respondent

Employers should implement measures designed to preserve the respondent’s rights and prevent any undue harm resulting from the investigation.

Key measures include the following.

  • Respecting the presumption of innocence and avoiding any premature characterisation of the facts.
  • Preserving the respondent’s dignity and reputation, for example by:
    1. ensuring the strict confidentiality of the investigation;
    2. preventing disclosures to third parties not involved in the process; or
    3. reminding all participants of their duty of discretion. Article 4.2 of the National Interprofessional Agreement (ANI) of 26 March 2010 explicitly states that: “It is in everyone’s interest to act with the necessary discretion to protect the dignity and privacy of each person. No information, other than anonymised information, should be disclosed to parties not involved in the matter”.
  • Protecting the respondent’s health, including:
    1. providing contact details for the occupational physician if the investigation is causing distress or impacting the respondent’s wellbeing; and
    2. implementing temporary organisational measures (eg, changes in reporting lines or remote working) where appropriate, provided they do not amount to punitive treatment.

These measures must remain strictly necessary and proportionate, to avoid creating the impression of preferential treatment.

Internal Communication, Where Necessary

If rumours or speculation circulate within the organisation, the employer may issue a limited internal communication. The communication should remain neutral and factual, indicating that:

  • an internal investigation is ongoing;
  • discretion is required to maintain the integrity of the investigation; and
  • any conclusions will be drawn only at the end of the process.

This type of communication helps protect the respondent from reputational harm while preserving the fairness and confidentiality of the process.

Legal Risks if the Employer Does Not Protect the Respondent

Failure to take appropriate measures may expose the employer to:

  • liability for breach of its obligation to protect the respondent’s physical or mental health;
  • claims for moral harassment if rumours, hostility, or stigmatisation develop in the workplace and the employer remains passive; and
  • claims for violation of privacy or dignity.

Legal Risks if the Employer Takes Protective Measures Improperly

If measures taken to protect the respondent are disproportionate, unjustified by the needs of the investigation, or perceived as shielding the respondent, then the employer may be accused of:

  • lack of impartiality;
  • obstructing the investigation; or
  • favouring the respondent, which could undermine the credibility of the process and potentially expose the employer to liability vis-à-vis the reporter.

The primary purpose of an internal HR investigation is to determine whether the alleged conduct actually occurred. Accordingly, it is generally inadvisable to impose disciplinary measures prior to the conclusion of the investigation and the issuance of the investigation report.

Risks of premature disciplinary action include:

  • imposing a sanction for conduct that ultimately proves unfounded;
  • exposure to claims by the employee for unjustified disciplinary measures; and
  • potential re-qualification of a dismissal as deprived of real and serious cause.

In this regard, the French Supreme Court has held that a disciplinary sanction imposed prematurely, without awaiting the outcome of the disciplinary procedure, constitutes a breach of the employer’s duty of protection (Cass. Soc., 6 July 2022, No 21-13.631).

However, it is possible, and advisable, to implement precautionary measures during the course of an internal investigation to protect the alleged victim, while avoiding premature disciplinary action against the respondent (see 4.1 Protection of the Reporter).

It is worth noting that an internal investigation should only be initiated if the report or complaint requires further examination. If the employer already possesses sufficient evidence demonstrating the reality and extent of the alleged misconduct, and this justifies disciplinary action, the disciplinary procedure should be initiated promptly, particularly in light of the statutory limitation period for such misconduct.

As soon as a potential risk comes to the employer’s attention, the employer is obliged to take all necessary measures to protect the health and safety of all employees, including the alleged victim, the respondent, and other staff members.

Consequently, the precautionary measures described above to protect the alleged victim may also be applied to safeguard other employees.

Such measures should be implemented with due consideration of the risk that the alleged conduct could recur and affect other employees during the course of the investigation.

The employer must strike a careful balance to preserve the health, safety, and rights of each employee. Failure to take appropriate protective measures could expose the employer to liability for breach of its general duty of security under French labour law. Conversely, protective measures should be proportionate and non-punitive, as overly restrictive actions may themselves give rise to claims by the employee affected.

French labour law does not prescribe a specific procedure for internal HR investigations. However, the French Defender of Rights has issued general recommendations for investigations following reports of discrimination or harassment (Decision No 2025-019, 5 February 2025).

Internal investigations should comply with four principles, as follows.

  • Impartiality, independence, and transparency: All parties must receive fair and impartial treatment (Guide ministère du travail, 8 March 2019). Failure to comply can result in liability, including damages for conducting a biased investigation (Cass. Soc., 9 February 2012, No 10-26.123).
  • Confidentiality and privacy: Investigators must protect the dignity and privacy of all involved, maintaining confidentiality of information disclosed (Guide ministère du travail, 8 March 2019; Article 4.2, ANI of 26 March 2010).
  • Adversarial principle: Employees have the right to know the allegations against them and to present their side. Participation cannot be compelled; refusals should be documented, and written statements may be accepted. The right to remain silent should be recorded in the interview minutes.
  • Presumption of innocence: Respondents must be treated as presumed innocent throughout the investigation.

Additional procedural considerations are as follows.

  • Assistance: No statutory right to a lawyer exists in internal investigations, but employers are advised to allow legal assistance upon request (Cass. Soc., 22 March 2016, No 15-10.503).
  • Anonymity: Employees may request anonymity, similar to whistle-blower protections. Anonymised testimony may be admissible if essential and disclosed to the respondent (Cass. Soc., 19 March 2025, No 23-19.154).
  • Recording: Interviews may be recorded with consent, but written transcripts by a designated person are recommended to reduce stress. If requested by the employee, recording should be allowed.

Failure to respect these safeguards may result in challenges to findings, liability for breach of privacy or fairness, or reduced evidentiary value in subsequent disciplinary or judicial proceedings.

Where a company has implemented specific internal procedures for conducting HR investigations, these procedures must be respected (framework decision No 2025-019, 5 February 2025).

Such procedures may take the form of:

  • charters;
  • prevention and action plans; and
  • guides or methodologies for conducting internal investigations.

Unlike the statutory internal regulations (règlement intérieur), which must be formally filed with the labour inspectorate and the employment tribunal, charters or guides relating to internal investigation procedures do not have normative force.

However, failure to comply with established internal investigation procedures may undermine the credibility of the investigation. In litigation, courts will assess whether the alleged procedural breach materially affects the evidentiary value of the investigation.

It should be noted that internal investigations and their conclusions do not bind the judge, who will independently determine the probative value of the findings (Cass. Soc., 29 June 2022, No 21-11.437).

Under French labour law, the burden of proof in internal investigations and related disputes depends on the type of allegation. Generally, the employee must provide facts that give rise to a presumption of wrongdoing. Once such facts are presented, it is for the employer or alleged wrongdoer to demonstrate that the conduct did not constitute misconduct and that any related decisions were justified by objective, non-discriminatory or non-harassing reasons (Article L1154-1, French Labour Code).

The degree of proof required is therefore not “beyond reasonable doubt”, as in criminal cases, but rather a preponderance of evidence or sufficient factual basis to raise a presumption. This standard applies both in litigation and at the stage of internal investigations, where the aim is to collect elements that reasonably suggest the alleged misconduct occurred, rather than irrefutable proof (Decision No 2024-105, 11 July 2024).

Illustrative examples of evidence that may support a presumption include witness statements, medical certificates, and emails or text messages. In contrast, mere rumours or hearsay alone are insufficient (Cass. Soc., 9 October 2013, No 12-22.288).

Under French law, neither statute nor case law sets a specific point at which an internal HR investigation must be concluded.

In practice, an investigation may be closed once all relevant information has been collected (interviews, documents, data) and the investigator has sufficient evidence to:

  • verify the allegations made by the reporter;
  • identify any potential violations of legal rules concerning harassment or discrimination; and
  • formulate a reasoned conclusion.

An investigation may also be closed prematurely in certain circumstances, including when:

  • no credible evidence can be obtained despite reasonable efforts;
  • the complainant withdraws their complaint and no compelling reason exists to continue;
  • the co-operation of the parties is insufficient to establish the facts;
  • an external procedure (judicial or police) renders further investigation unnecessary; or
  • the individuals involved leave the company.

Once the decision to conclude/abandon an HR internal investigation has been made, it is recommended that both the reporter and the respondent be informed of the closure. The conclusions of the investigation should subsequently be communicated to them.

Where employee representatives exist within the company, the full report or a summary may also be presented to the members of the CSE during an extraordinary meeting convened for this purpose.

French case law confirms that an employer is not required to disclose the full investigation report to the disciplinary committee. It is sufficient to provide information that is sufficiently detailed to allow for a meaningful and fair discussion (Cass. Soc., 27 November 2024, No 23-11.720). This approach may similarly be applied when sharing findings with CSE members.

There are no legal rules prescribing a specific form for concluding an internal HR investigation. In practice, it is standard to formalise the conclusions in a written report.

Preparing a written report is considered essential, as it:

  • ensures a clear record of the investigation and the evidence collected;
  • provides supporting evidence in the event of a dispute or litigation, including regarding the findings of fault and the limitation period for disciplinary action; and
  • supports any disciplinary or corrective measures that may be taken.

At the conclusion of an internal HR investigation, it is the responsibility of the employer, as the disciplinary authority, to evaluate the facts and determine whether the allegations constitute harassment, discrimination, or other violations of company policy or law.

The French Defender of Rights emphasises that the employer must ensure that the findings do not minimise the facts, blame the alleged victim, or justify discriminatory remarks on the grounds of humour or context.

Written reports are typically used to formalise the investigation. While there is no legal requirement specifying the exact content, such reports generally include:

  • a summary of the allegations received;
  • the context, purpose, and scope of the investigation;
  • details of the investigative methodology, including who was interviewed and which documents or evidence were reviewed;
  • summaries of interviews or other fact-finding activities;
  • the findings of the investigation, including the assessment of the credibility of witnesses and the evidence collected;
  • conclusions regarding whether the allegations are substantiated, partially substantiated, or unsubstantiated;
  • suggested next steps or recommendations, which may include disciplinary or corrective measures; and
  • any limitations encountered during the investigation, such as witnesses refusing to participate.

Such reports ensure transparency, demonstrate due diligence, and provide a defensible record of the employer’s actions in the event of legal proceedings. Including recommended next steps is common practice and helps guide the employer in implementing appropriate remedial or disciplinary actions following the investigation.

In practice, it is recommended that employers communicate only the conclusions of the internal HR investigation to the parties involved, in order to preserve the confidentiality of the testimony provided and the anonymity of any witnesses interviewed.

French law does not grant parties a right to receive the full written investigation report. Consequently, the employer is not obliged to share the complete report with either the reporter or the respondent.

In practice, employers typically provide a summary of the findings or the outcome relevant to the individuals concerned, without disclosing sensitive details about other witnesses or internal deliberations. This approach balances transparency with the need to protect confidentiality and ensure procedural fairness.

In France, there is no general obligation to communicate the conclusions of an internal HR investigation to the authorities, particularly because the reported matters usually do not directly involve the employer as a victim.

However, the law requires certain serious matters be reported as soon as they come to the attention of any individual, such as:

  • crimes whose reporting may prevent or limit their effects, or prevent further offences (eg, murder, rape, torture, terrorism); and
  • abuse, mistreatment, or sexual assault against minors or vulnerable individuals (for example, assault on a pregnant colleague or an employee accessing child pornography).

In these cases, the employer should provide the authorities with the established facts and any information necessary for them to take appropriate action.

Failure to comply with these reporting obligations may result in criminal sanctions, including up to three years’ imprisonment and fines of up to EUR45,000 (Articles 434 1 and 434 3 of the French Criminal Code).

In practice, limiting communication of the conclusions of an internal HR investigation to the reporter, the respondent, and, where applicable, members of the CSE is generally recommended.

Information shared is usually confined to the conclusions themselves and any resulting measures, without disclosing the identities of witnesses or other confidential details, in order to preserve privacy and maintain the integrity of the investigative process. Communication to other team members or colleagues is typically avoided to prevent gossip, retaliation, or breaches of confidentiality.

If the allegations are substantiated, the employer may impose disciplinary measures on the respondent. The sanction must be effective, proportionate, and dissuasive, taking into account the employee’s disciplinary history. Where harassment or discrimination is confirmed, French case law supports dismissal for serious misconduct (faute grave) of the employee responsible.

If the allegations are not substantiated, the employer generally does not take disciplinary action against the respondent. However, if the reporter acted in bad faith or knowingly made false allegations, the employer may consider proportionate disciplinary measures against the reporter.

In all cases, under Article L.1332-4 of the French Labour Code, any disciplinary sanction must be imposed within two months from the date the employer becomes aware of the facts – ie, from the closure of the investigation.

Before taking any action, the employer should assess whether additional investigations (or counter-investigations) are necessary, particularly if disputes remain regarding the findings. This ensures procedural fairness and helps reduce the risk of legal challenges.

In practice, even when an internal HR investigation does not substantiate allegations of harassment, there may still be ongoing tensions or interpersonal conflict between the reporter and the respondent.

Employers typically implement measures aimed at restoring a positive work environment and preventing further issues. Such measures may include:

  • mediation between the parties to facilitate dialogue and resolve misunderstandings;
  • support, coaching, or training for managers to strengthen conflict management and improve team dynamics;
  • organisational or team-building initiatives to reinforce collaboration and cohesion; and
  • enhanced monitoring or follow-up to ensure the workplace climate remains constructive.

These measures are often recommended regardless of whether the allegations are substantiated, as they help maintain a respectful and safe work environment, reduce the risk of future disputes, and demonstrate the employer’s proactive approach to managing workplace relations.

Under French law and the General Data Protection Regulation (GDPR), an employer is permitted to collect personal data for the purpose of an internal HR investigation, subject to strict limitations.

Personal data collected must:

  • be processed for specified, explicit, and legitimate purposes; and
  • not be further processed in a manner incompatible with those purposes (Article 5(b) GDPR).

The lawfulness of data processing must be based on at least one of the legal grounds provided under Article 6 GDPR. In the context of an internal HR investigation, two bases are typically applicable, as follows.

  • Compliance with a legal obligation eg, when the investigation is conducted following a mandatory whistle-blowing report or to comply with the employer’s health and safety obligations.
  • Legitimate interest this is justified when the data subject could reasonably expect, at the time of data collection, that their personal data would be processed for a given purpose. As an example, preventing fraud or misconduct may constitute a legitimate interest.

All data collection and processing must be strictly necessary, proportionate, and transparent. Personal data should be secured and retained only for the duration required to complete the investigation.

Under the GDPR, when the processing of personal data is likely to result in a high risk to the rights and freedoms of individuals, the data controller must carry out a Data Protection Impact Assessment (DPIA) prior to processing.

An internal HR investigation, which aims to determine whether legal or regulatory violations have occurred and whether disciplinary or judicial action is warranted, constitutes high-risk processing and should therefore be preceded by a DPIA.

The French Data Protection Authority (CNIL), in its publication of 11 October 2018, provides an indicative list of processing operations requiring a DPIA, including the management of whistle-blowing reports and the internal investigations arising from them.

Furthermore, as interviews conducted during the investigation involve the collection and processing of personal data, Article 13 of the GDPR requires that interviewees be provided with a privacy notice that specifies, at a minimum:

  • the identity and contact details of the data controller;
  • the purposes and legal basis of the processing; and
  • the retention period for the data and the rights of the individuals concerned (access, rectification, objection, etc).

In practice, these measures ensure the transparency and lawfulness of data collection and processing during an internal investigation, while mitigating risks for both the company and the individuals involved.

Under Article 15 of the GDPR, any current or former employee, upon verifying their identity, has the right to request access to all personal data concerning them held by their employer or former employer.

This right includes, in particular:

  • the purposes of the processing;
  • the recipients of the data; and
  • the retention period of the data.

However, this right of access is not absolute. The employer may limit disclosure of certain information to protect:

  • the privacy rights of third parties;
  • the company’s trade secrets; and
  • the confidentiality of correspondence.

In the context of an internal HR investigation, it is generally possible to refuse access to information where disclosure would compromise the confidentiality of individuals interviewed during the investigation, including the alleged victim, the respondent, or witnesses.

In any event, any access granted should be proportionate to the requesting employee’s rights while ensuring compliance with confidentiality obligations and legal data protection requirements.

AI tools may be used in the context of internal investigations in France, but their use remains limited in practice. When they are used, it is generally as support tools to facilitate the review and analysis of large datasets (eg, emails, documents, messaging records), assist with keyword searches, or identify patterns or anomalies that may be relevant to the investigation.

However, any use of AI must remain strictly proportionate, human-supervised and compliant with the GDPR, particularly with regard to transparency, data minimisation, accuracy and security. Employers must ensure that data processed by AI tools remains confidential and is not transferred outside the EU without appropriate safeguards.

AI also raises specific data-protection considerations, including:

  • the risk of profiling or automated decision-making, which is prohibited unless strict GDPR conditions are met;
  • the need to ensure that algorithms do not introduce bias that could affect the fairness of the investigation; and
  • the obligation to inform employees that their data may be processed by AI tools and to document the legal basis for such processing.

In all cases, AI cannot replace human judgment. Findings must be reviewed, validated and contextualised by the investigator before being relied upon.

France provides specific whistle-blower protections under Law No 2016-1691 of 9 December 2016 (“Sapin II”), further strengthened by the “Waserman” Law of 21 March 2022.

Definition: A whistle-blower is defined as a natural person who, in good faith and without direct financial gain, reports or discloses information regarding a crime, offence, threat, or harm to the public interest; a violation or attempted concealment of a violation of international commitments ratified by France, EU law, national law, or regulation (Article 6, Sapin II).

Who is protected:

  • the whistle-blower themselves;
  • facilitators who assist the whistle-blower;
  • individuals linked to the whistle-blower who may face retaliation; and
  • legal entities controlled by or working with the whistle-blower in a professional context (Article 6-1, Sapin II).

The scope of situations covered covers crimes, offences, threats, harm to the public interest, violations of international obligations, EU law, or French law.

Additional protections:

  • civil and criminal immunity for damages or liability arising from the report (Article 10-1, Sapin II; Article 122-9, Criminal Code);
  • protection against retaliation, threats, or prohibited adverse measures (Article 10-1, Sapin II);
  • adjustment of the burden of proof in cases of retaliation, similar to harassment claims (Article 10-1, Sapin II);
  • criminal sanctions against those obstructing internal or external reporting (Article 13, Sapin II);
  • civil and criminal sanctions for abusive proceedings against a whistle-blower (Article 13, Sapin II); and
  • psychological and financial support measures for whistle-blowers (Article 14-1, Sapin II).

Additional legal protections:

  • the Labour Code – prohibition of discriminatory measures against whistle-blowers (Article L.1121-2, L.1132-1); and
  • the Criminal Code – recognition of whistle-blower status as a protected category against discrimination (Article 225-1 and 225-2, effective 1 September 2022).

France provides specific protections against sexual harassment and gender-based violence under the Labour Code and criminal Code.

Sexual Harassment

  • Defined in Article L.1153-1 of the Labour Code as repeated conduct or remarks of a sexual or sexist nature that either undermine dignity or create an intimidating, hostile, or offensive work environment.
  • Protection extends even if the conduct occurs outside of work hours or premises (Cass. Soc., 19 October 2011, No 09-72.672).
  • Recent case law recognises that “harassment by atmosphere” may also constitute sexual harassment (Cass. Crim., 12 March 2025, No 24-81.644).
  • The burden of proof is adjusted, as for moral harassment: the employee must present facts that give rise to a presumption of harassment (Article L.1154-1).
  • Employers are obliged to prevent and sanction harassment, taking all necessary measures and acting promptly once aware (Article L.1153-5; Cass. Soc., 1 June 2016, No 14-19.702).
  • Victims or witnesses are protected against sanctions or discriminatory measures, with certain protections akin to those for whistle-blowers (Article L.1153-2).

Sexist Conduct

  • Article L.1142-2-1 of the Labour Code prohibits any conduct related to sex that undermines dignity or creates an intimidating, hostile, degrading, humiliating, or offensive environment.
  • Unlike sexual harassment, repetition is not required, allowing early intervention to prevent escalation.
  • Article R.625-8-3, Criminal Code, also criminalises sexist and sexual insults.

Recent Developments

Legislative and judicial trends continue to strengthen protections for victims of sexual and sexist conduct.

France provides specific protections against moral harassment, bullying, and other forms of workplace harassment under the Labour Code.

Moral Harassment

  • Defined in Article L.1152-1 of the Labour Code as repeated conduct that degrades working conditions, undermines rights or dignity, harms physical or mental health, or jeopardises career prospects.
  • The French Supreme Court has clarified that moral harassment may be established even if:
        • the perpetrator did not intend to harm (Cass. Soc., 10 Nov. 2009, No 08-41.497);
        • the acts are not of the same nature (Cass. Crim., 26 Jan. 2016, No 14-80.455);
        • the acts occur over a short or long period (Cass. Soc., 26 May 2010, No 08-43.152; 25 Sept. 2012, No 11-17.987); and
        • harassment arises from management methods (Cass. Soc., 10 Nov. 2009, No 07-45.321).

Employer Obligations

  • Employers must take all necessary measures to prevent moral harassment (Article L.1152-4).
  • They must also sanction perpetrators; liability cannot be avoided unless the employer implemented all preventive measures and acted promptly once aware of the harassment (Cass. Soc., 1 Jan. 2016, No 14-19.702).

Burden of Proof and Protection

  • Victims benefit from an adjusted burden of proof: they need only present facts giving rise to a presumption of harassment (Article L.1154-1).
  • Victims or witnesses are protected against sanctions or discriminatory measures, with some protections akin to whistle-blower protections (Article L.1153-2).

Recent Developments

Since the entry into force of the “Barème Macron” in 2017 (Article L.1235-3), which caps statutory or contractual dismissal compensation, claims related to moral harassment have significantly increased, reflecting heightened awareness and enforcement.

In France, employers are generally not under a specific legal obligation to report criminal offences of which they become aware.

Exceptions

Employers must report certain crimes under the Criminal Code, such as crimes or abuse, assaults, or sexual offences committed against minors or vulnerable persons.

Criminal Nature of Workplace Harassment or Discrimination

  • Moral harassment (Article 222-33-2, Criminal Code) and sexual harassment (Article 222-33, Criminal Code), as well as discrimination (Articles 225-1 to 225-4, Penal Code), are criminal offences.
  • Employees may pursue the perpetrator directly in criminal court, in addition to any internal investigation or labour court proceedings (Conseil de Prud’hommes).
  • Internal investigations may continue during a criminal investigation, but must not obstruct it.

Practical considerations  include the following.

  • Due to lengthy criminal proceedings and psychological impact, employees often prefer to pursue labour claims first, which allow for comprehensive remedies regarding working conditions or contract termination.
  • Initiation of criminal proceedings can delay or block labour court proceedings until a criminal decision is rendered.
  • Employers are advised to cooperate with criminal authorities to demonstrate good faith.
  • Employers who suffer a prejudice (eg, reputational harm) due to the actions of an employee may join criminal proceedings as a civil party (Cass. Crim., 14 Nov. 2017, No 16-81.161).

In France, there are no specific legal procedures for multi-jurisdictional or cross-border internal investigations.

Domestic Investigations With an International Dimension

Any internal investigation conducted in France, regardless of its international scope, must comply with the guiding principles outlined in 5.1 Requirements, including impartiality, confidentiality, and respect for fundamental rights.

Investigations conducted in France by a foreign employer must:

  • comply with French labour law;
  • respect fundamental rights and freedoms; and
  • comply with data protection requirements under the GDPR.

Investigations conducted abroad by a French employer must:

  • respect the applicable local laws;
  • ensure GDPR compliance for any personal data transferred to France; and
  • adapt investigative methods to local regulations.

Practical considerations for international investigations:

  • central co-ordination by an ethics/compliance team is recommended;
  • a global protocol to harmonise local legal requirements and practices across jurisdictions should be implemented; and
  • local counsel should be engaged where necessary to ensure procedural compliance.
Axipiter

5 rue de Téhéran
75008 Paris
France

+33 646722670

ek@axipiter.fr www.axipiter.fr
Author Business Card

Trends and Developments


Author



Axipiter is an independent French law firm with a strong international leaning and around 30 lawyers in France. It offers comprehensive expertise in business law, with a recognised Employment Law department, advising a wide spectrum of clients – from SMEs to large international groups – on all aspects of legal and employment matters. Axipiter’s Employment Law team is known for its pragmatic and tailored approach, with a strong focus on human, organisational and compliance-related challenges. In providing customised solutions adapted to both French and international settings, the firm helps clients navigate their HR issues and make strategic, informed decisions. The team frequently advises on sensitive internal HR investigations. For instance, it recently managed inquiries following allegations of moral harassment for a leading retail and luxury group, and optimised internal investigation processes for an industrial mining client. It delivers practical, compliant solutions protecting both reputation and workforce integrity.

Internal HR Investigations, Pay Transparency and Digitalisation

Internal HR investigations are increasingly recognised as a strategic tool for managing risks and ensuring compliance at both national and international levels. Companies face complex challenges, including allegations of harassment, discrimination, compliance breaches, and pay inequities. The landscape of internal investigations is evolving due to regulatory changes, including the EU Pay Transparency Directive (EU 2023/970), and technological developments, such as digital investigation tools and AI-assisted analytics.

In France, internal investigations are shaped not only by general labour law protections but also by specific obligations on reporting, equality, and employee consultation. Employers must navigate both traditional HR risks and challenging issues, including pay equity, hybrid work arrangements, and digital oversight. They also face heightened responsibilities regarding the protection of personal data, as internal investigations frequently involve sensitive employee information, emails, and HR records. Ensuring GDPR compliance has thus become a central consideration, balancing investigative needs with legal obligations on data privacy.

Effectively handled internal investigations serve as both a risk management mechanism and a strategic tool, helping companies protect employees, ensure compliance, safeguard personal data, and reinforce trust and corporate reputation.

This section highlights three complementary trends that are reshaping internal HR investigations: (i) the impact of pay transparency obligations as a trigger for investigations; (ii) the digitalisation of investigative processes; and (iii) data privacy and GDPR compliance, reflecting broader shifts in corporate governance and HR management.

Pay transparency and internal investigations

Regulatory context

The EU Pay Transparency Directive (EU 2023/970) aims to reduce gender pay gaps and ensure equitable remuneration practices across member states.

In France, the directive is scheduled to be transposed by 7 June 2026. Once implemented, companies will be required to provide salary information upon employee request, conduct regular pay audits, and launch measures to address systemic disparities.

Although the formal obligations focus on reporting and documentation, in practice, pay transparency requests may trigger internal investigations like those conducted for harassment, discrimination, or compliance issues.

Employers must collect and analyse payroll data, verify pay practices, and document outcomes. These processes will function as structured investigations, linking regulatory compliance to operational governance.

Pay transparency-related investigations serve several purposes:

  • they ensure compliance with future EU and French laws;
  • detect systemic pay inequities;
  • prevent disputes and mitigate reputational risk; and
  • strengthen employee confidence in fair treatment.

Recent developments and practices

  • Right to information as a trigger: Under the future framework introduced by the Pay Transparency Directive, employees will have the right to request information on salary levels for comparable roles, including base salary, variable compensation, and benefits. In practice, each request may trigger a structured internal review to verify the accuracy and fairness of pay practices. This review functions as an investigative exercise, including the verification of job classifications, benchmarking roles across departments, and documenting the rationale behind compensation decisions. The requirement for timely and accurate responses also pushes companies to establish clearer internal protocols, ensuring consistency and defensibility in the information provided to employees or their representatives.
  • Data collection and analysis: Pay transparency-related investigations will require the collection and analysis of payroll data, bonus schemes and historical adjustments. Employers will need to collect payroll data across comparable roles, assess bonus structures and review historical salary adjustments. The aim is to identify potential gaps, determine whether differences can be justified by legitimate, non-discriminatory criteria (such as experience, skills, performance, or market factors), and prepare documented justifications. Many organisations are already strengthening their HR systems and adopting analytical tools to map pay structures more accurately and anticipate potential areas of risk before the new obligations come into force.
  • Integration with compliance and whistle-blowing channels: Pay transparency requests may also be submitted through internal reporting systems, particularly where employees suspect discrimination or systemic inequities. This creates an overlap between pay transparency rights and whistle-blowing channels. Companies must therefore adopt a formalised investigative methodology, setting clear timelines, ensuring confidentiality and maintaining neutrality throughout the process. Co-ordination among HR, legal, and compliance departments becomes essential, not only to ensure a robust review but also to guarantee the procedural fairness required when dealing with potential discrimination claims.
  • Cross-border considerations: Multinational groups will face additional complexity when responding to pay transparency requests. Differences in national employment laws, collective bargaining structures and data protection requirements can significantly affect how information is collected and disclosed. Ensuring GDPR-compliant processing of salary data (particularly where cross-border transfers are involved) is a central challenge. Companies must reconcile transparency obligations with strict data minimisation principles and ensure that disclosures do not inadvertently reveal the personal data of other employees. Developing harmonised global frameworks that accommodate local legal requirements is a growing priority.

Practical guidance for employers

  • Establish internal review procedures: Define standardised steps for handling pay requests, including timelines, data sources to be consulted and validation processes to ensure accurate and consistent responses.
  • Cross-functional collaboration: HR, legal, and compliance departments should jointly assess requests and findings to ensure that analyses are both legally sound and aligned with internal policies. Clear allocation of responsibilities helps reinforce neutrality and procedural fairness.
  • Proactive audits: Conduct regular pay equity audits to detect disparities early, identify structural issues and anticipate future compliance needs. These audits can support risk mitigation and strengthen the organisation’s overall pay practices.
  • Data protection and confidentiality: Handle sensitive payroll information within secure systems and restrict access to authorised personnel only. Apply data minimisation principles and ensure compliance with GDPR in both data processing and disclosure.
  • Document outcomes: Maintain detailed records of the review process, methodologies applied, data analysed, and conclusions reached. Thorough documentation strengthens the defensibility of decisions and supports consistency in handling future requests.

Key points/outlook

The directive effectively transforms pay transparency into a potential driver of internal investigations.

In practice, this means that companies will need to approach requests for pay information not simply as a reporting obligation but as an opportunity to conduct a structured, thorough review of compensation practices. Such reviews may include verifying job classifications, benchmarking roles across departments or business units, assessing historical pay adjustments, and ensuring that bonus and incentive schemes are applied fairly.

In the future, companies should treat pay information requests as triggers for structured internal reviews, not merely reporting obligations. This will involve clear procedures for data collection and analysis, defined responsibilities across HR, legal, and compliance departments, and standardised templates to ensure consistent and defensible outcomes. Companies may also consider using digital tools or analytics platforms to map pay structures, identify potential gaps, and track progress over time, while maintaining strict confidentiality and compliance with data protection laws.

Integrating these processes into routine HR and compliance practices helps companies meet legal obligations and manage risk proactively. By doing so, they can detect and correct inequities before they give rise to disputes, demonstrate a transparent and fair approach to compensation, and reinforce employee trust. Ultimately, a structured and proactive approach to pay transparency enables organisations to strengthen overall HR governance, mitigate potential legal and reputational exposure, and signal their commitment to social responsibility and equitable treatment of employees.

Digitalisation of internal HR investigations

Digitalisation is fundamentally reshaping the processes and efficiency of internal HR investigations. Tools such as secure investigation platforms, AI analytics, and workflow management systems enable more efficient, auditable, and accurate investigations. These tools are particularly valuable in remote or hybrid work environments, where evidence collection and employee interviews require innovative approaches.

Recent developments and practices

  • Digital platforms: Secure digital platforms centralise emails, chat messages, payroll records, HR files, and other relevant evidence, while access is strictly controlled and audit trails maintain accountability. Such platforms enable access to be strictly restricted to authorised personnel, while audit trails provide a detailed record of all actions taken during the investigation. By consolidating evidence and automating workflow management, these platforms reduce administrative complexity, minimise errors, and enhance regulatory compliance. For example, some French multinational groups use secure portals to collect, organise, and review evidence during investigations, streamlining collaboration between HR, legal, and compliance departments and ensuring defensible outcomes.
  • AI-assisted analytics: AI and advanced analytics help detect patterns, anomalies, and early warning signs of potential misconduct, enabling investigators to prioritise high-risk cases. AI use must comply with legal and ethical standards, complementing rather than replacing human judgment.
  • Remote and hybrid investigations: The rise of remote and hybrid work has prompted the adoption of virtual interviews and online evidence collection. Digital tools enable investigators to conduct interviews securely, collect and store evidence, and maintain procedural fairness even when participants are geographically dispersed. Platforms supporting secure video calls, encrypted file sharing, and collaborative document review ensure investigations can continue uninterrupted while respecting data privacy and confidentiality requirements.
  • Cross-border considerations: Multinational companies must navigate varying employment laws, data protection regulations, and cultural expectations while maintaining consistent investigative practices.

Practical guidance for employers

  • Formalise digital investigation protocols: Employers should establish clear, step-by-step procedures for all stages of digital investigations, from initial data collection to evidence review and final documentation. This includes defining which types of data can be collected, specifying how digital evidence such as emails, chat logs, or HR records should be preserved, and ensuring that all actions are traceable for audit purposes. Formalised protocols help ensure consistency, support defensibility in case of legal scrutiny, and facilitate co-ordination between HR, legal, and compliance departments.
  • Train teams on digital tools: HR, legal, and compliance departments should receive targeted training on the digital platforms and AI tools used in internal investigations. This training should cover the functionalities of the platforms, how to analyse data securely, and the legal and regulatory requirements associated with data processing, including GDPR. Well-trained teams are better equipped to leverage technology efficiently while mitigating the risks of errors, data breaches, or procedural flaws.
  • Protect confidentiality: Maintaining confidentiality is critical in digital investigations. Employers should limit access to sensitive information to authorised personnel only, implement secure storage solutions (such as encrypted databases or access-controlled platforms), and maintain audit logs to track data access and handling. Clear policies on confidentiality and security reduce the risk of unauthorised disclosures and help protect employee trust and company reputation.
  • Integrate digital and traditional approaches: While digital tools can greatly enhance efficiency and analytical capabilities, they should complement rather than replace human judgment. Investigators should combine AI-assisted data analysis with qualitative assessments, interviews, and contextual interpretation. For example, AI may flag anomalies or patterns in employee communications or payroll data, but human evaluators must assess the relevance, context, and intent behind these signals to make fair and defensible conclusions. Integrating technology with traditional investigative practices ensures procedural fairness and maintains the credibility of the investigative process.

Key points/outlook

Digitalisation has significantly improved the efficiency, documentation, and auditability of internal HR investigations. Secure platforms, AI-assisted analytics, and workflow management tools allow companies to centralise evidence, track investigative steps, and generate reliable records that can support regulatory compliance or legal defence if necessary. Investigators can process larger volumes of information more quickly, identify patterns or anomalies in employee behaviour or payroll data, and maintain detailed audit trails that reinforce accountability and transparency.

However, the adoption of digital tools also introduces new compliance challenges. Companies must ensure that data collection, storage, and processing comply with GDPR and local privacy laws, that access to sensitive information is strictly controlled, and that AI or automated tools are used responsibly to avoid biased or unfair conclusions. Efficiency must also be balanced with procedural fairness, ensuring that employees are treated equitably and that their rights are respected throughout the investigative process.

Structured and well-governed processes are therefore essential. By combining clear protocols, appropriate training, secure digital tools, and human oversight, organisations can manage operational and legal risks effectively. Moreover, adopting a proactive and transparent approach to digital investigations can enhance employee trust, strengthen the credibility of HR and compliance functions, and demonstrate a forward-looking commitment to ethical and responsible governance in the workplace.

Data privacy and GDPR compliance in internal HR investigations

Internal HR investigations increasingly involve the collection, processing and storage of sensitive personal data, including emails, payroll records, performance evaluations and health-related information. Ensuring compliance with data protection laws – particularly the EU General Data Protection Regulation (GDPR) and national privacy regulations – has therefore become a central consideration. Employers must balance the need for thorough investigations with strict requirements for confidentiality, data minimisation and lawful processing.

Recent developments and practices

  • Data collection and minimisation: Investigators must collect only personal data strictly necessary for the investigation’s objectives. This principle of data minimisation ensures that irrelevant or excessive information is not processed, reducing potential privacy risks. Companies are increasingly adopting structured intake forms and pre-screening questionnaires to determine the precise data required before commencing an investigation. Limiting access to sensitive information is essential: only personnel directly involved in the investigation (typically HR, legal, and compliance departments) should have access to the data. Audit logs and access controls can further reinforce accountability and traceability of all data handling activities.
  • Secure storage and access controls: All evidence and personal data must be securely stored with technical and organisational measures to prevent unauthorised access, loss, or breaches. Digital investigation platforms allow centralised and encrypted storage of emails, HR files, interview notes, and other sensitive records. These platforms also support detailed audit trails, ensuring that every access, modification, or download is recorded. Such measures not only facilitate GDPR compliance but also improve operational efficiency, as investigators can access necessary documents quickly without compromising data security.
  • Consent and transparency: Employees should be fully informed about the processing of their personal data during internal investigations. Where feasible, explicit consent should be obtained, particularly when processing sensitive data such as health information or disciplinary records. Privacy notices should clearly outline the types of data collected, the purpose of the processing, the legal basis for processing, and the retention period. Transparent communication with employees helps build trust, reduces the risk of disputes, and reinforces the perception that investigations are conducted fairly and responsibly.
  • Integration with digital tools: Advanced analytics, AI, and machine learning can assist investigators by detecting patterns, anomalies, or early warning signs of potential misconduct. For example, AI can flag unusual patterns in payroll, email communications, or access logs, helping prioritise investigations efficiently. However, the use of automated systems must comply with GDPR principles, including purpose limitation, fairness, and accountability. Companies must ensure explainability of automated decision-making and avoid any processing that could result in unfair or discriminatory outcomes. Integration of digital tools should complement human judgment, not replace it, ensuring that procedural fairness is maintained throughout the investigation.
  • Cross-border considerations: For multinational groups, conducting internal investigations across multiple jurisdictions presents unique challenges. Companies must navigate different data protection laws, employment regulations, and cultural expectations. Cross-border data transfers require strict compliance with GDPR standards, including the use of standard contractual clauses, binding corporate rules, or adequacy decisions where applicable. Companies should implement consistent global policies while allowing flexibility for local legal requirements. This ensures investigations remain effective and compliant.

Practical guidance for employers

  • Implement clear policies for the processing of personal data during internal investigations: Employers should establish comprehensive internal policies that outline how personal data will be handled during internal HR investigations. Policies should define which data can be collected, the purpose of processing, the legal basis for processing, and the responsibilities of each team involved. Clear policies provide consistency, help prevent data misuse, and ensure compliance with GDPR and national privacy laws.
  • Train HR, legal, and compliance departments on GDPR requirements and privacy best practices: Training programmes should ensure that personnel understand key GDPR principles such as data minimisation, purpose limitation, transparency, and accountability. Teams should also be familiar with internal procedures for handling sensitive employee data, including special categories of data such as health information or disciplinary records. Well-trained teams reduce the risk of errors or breaches and strengthen the credibility and defensibility of the investigation process.
  • Limit data access to authorised personnel and maintain audit logs of all processing activities: Access to personal data should be strictly limited to authorised personnel involved in the investigation. Audit logs should be maintained to track all processing activities, including data access, modifications, or transfers. This ensures accountability, facilitates monitoring of compliance, and provides documentation to demonstrate lawful and secure handling of sensitive information.
  • Secure digital platforms and ensure encrypted storage of sensitive information: Companies should use secure digital platforms for the collection, storage, and management of personal data during investigations. Platforms should employ encryption, strong authentication protocols and controlled access mechanisms to prevent unauthorised disclosure or data breaches. Centralised, secure systems also allow for efficient management of evidence and documentation while ensuring compliance with privacy obligations.
  • Data retention and disposal: Personal data should be retained only for as long as necessary to achieve the purpose of the investigation, in line with internal retention policies and legal requirements. Once the investigation is completed, data should be securely archived or deleted. This limits unnecessary exposure of sensitive information and reduces risks associated with long-term storage, while demonstrating compliance with GDPR principles of storage limitation and data minimisation.
  • Additional considerations for cross-border investigations: Companies should harmonise global policies while accommodating country-specific legal requirements to maintain both compliance and operational consistency.

Key points/outlook

Data privacy considerations have become central to the legitimacy and effectiveness of internal HR investigations. Far from being ancillary, compliance with GDPR and other data protection requirements is now integral to how investigations are designed and conducted. Companies must ensure that personal data is collected, stored, and processed securely; that access is strictly controlled; and that all handling activities are fully documented.

Integrating data protection into investigative processes serves several purposes. First, it safeguards sensitive employee information and ensures confidentiality, crucial for maintaining trust and encouraging full employee cooperation. Second, it mitigates legal and reputational risks by demonstrating adherence to regulatory obligations and best practices. Third, it promotes procedural fairness, ensuring that individuals are treated equitably and that decisions are based on accurate, lawfully processed information.

Integration of privacy considerations also enables organisations to manage complex scenarios, such as cross-border investigations or the use of AI-assisted analytics, in a compliant and defensible manner. By establishing clear policies, training teams, and adopting secure digital tools, companies can conduct investigations efficiently while reinforcing accountability, transparency, and trust. Ultimately, prioritising data privacy is more than a regulatory requirement – it is also a strategic facilitator of effective, credible, and ethically sound HR investigations.

Conclusion

The combination of pay transparency obligations, digitalisation and data privacy is reshaping HR practices in France and internationally.

Employers face both traditional risks (harassment, discrimination, compliance breaches) and emerging challenges related to equity in pay, remote work, and technology-driven oversight and the protection of personal data.

Companies that implement structured procedures, coordinate HR, legal, and compliance functions effectively, and leverage compliant digital and privacy-conscious tools can reduce legal and reputational risks while demonstrating leadership.

Axipiter

5 rue de Téhéran
75008
Paris
France

+33 646722670

ek@axipiter.fr www.axipiter.fr
Author Business Card

Law and Practice

Authors



Axipiter is an independent French law firm with a strong international leaning and around 30 lawyers in France. It offers comprehensive expertise in business law, with a recognised Employment Law department, advising a wide spectrum of clients – from SMEs to large international groups – on all aspects of legal and employment matters. Axipiter’s Employment Law team is known for its pragmatic and tailored approach, with a strong focus on human, organisational and compliance-related challenges. In providing customised solutions adapted to both French and international settings, the firm helps clients navigate their HR issues and make strategic, informed decisions. The team frequently advises on sensitive internal HR investigations. For instance, it recently managed inquiries following allegations of moral harassment for a leading retail and luxury group, and optimised internal investigation processes for an industrial mining client. It delivers practical, compliant solutions protecting both reputation and workforce integrity.

Trends and Developments

Author



Axipiter is an independent French law firm with a strong international leaning and around 30 lawyers in France. It offers comprehensive expertise in business law, with a recognised Employment Law department, advising a wide spectrum of clients – from SMEs to large international groups – on all aspects of legal and employment matters. Axipiter’s Employment Law team is known for its pragmatic and tailored approach, with a strong focus on human, organisational and compliance-related challenges. In providing customised solutions adapted to both French and international settings, the firm helps clients navigate their HR issues and make strategic, informed decisions. The team frequently advises on sensitive internal HR investigations. For instance, it recently managed inquiries following allegations of moral harassment for a leading retail and luxury group, and optimised internal investigation processes for an industrial mining client. It delivers practical, compliant solutions protecting both reputation and workforce integrity.

Compare law and practice by selecting locations and topic(s)

{{searchBoxHeader}}

Select Topic(s)

loading ...
{{topic.title}}

Please select at least one chapter and one topic to use the compare functionality.