In general, HR internal investigations in Greece are typically initiated when the employer receives a formal complaint or report (either through the channels established under the Greek Labour Code (p.d. 62/2025 – the GLC) or internal policies). Under the GLC provisions on preventing and addressing violence and harassment in the workplace, employers must ensure that complaints are properly received and examined. This obligation is activated when an employee (or other protected person, such as an independent contractor or a trainee/intern) submits a report alleging conduct that may constitute prohibited behaviour. The employer may also initiate an investigation upon receiving sufficiently specific, credible information, even from an anonymous source, suggesting a potential breach of workplace rules or ethics. However, purely informal remarks or vague rumours do not, on their own, trigger a legal duty to investigate. Employers may nonetheless conduct a preliminary assessment to determine whether a formal investigation is warranted.

Greek law provides the following primary legal bases for carrying out HR internal investigations, distinguishing between cases where an investigation is required by law and cases where it is carried out within the framework of employment discipline and workplace governance.

• Articles 58–9 GLC – Violence and Harassment in the Workplace: Employers are under a statutory obligation to investigate formal complaints relating to violence or harassment in the workplace. Such investigations must be conducted promptly, confidentially and impartially, in accordance with the procedures laid down by law and the employer’s internal policies, ensuring the protection of the people involved and compliance with due process requirements.
• Law 4990/2022 – Whistle-Blowing and Breaches of EU Law: Organisations falling within the scope of Law 4990/2022 are required to establish internal reporting channels and to investigate reports concerning breaches of EU law. The Internal Reporting Officer is legally required to follow up on reports and take appropriate action, which may include conducting an internal HR investigation, subject to statutory timelines, confidentiality obligations and safeguards for reporting people.
• Articles 422–424 GLC – Internal Work Regulations and Disciplinary Matters: Employers with 70 or more employees are legally required to adopt Internal Work Regulations, which typically include disciplinary rules and procedures and provide a framework for conducting HR internal investigations into disciplinary misconduct. Employers with fewer than 70 employees are not subject to such a statutory obligation but may voluntarily adopt internal work regulations; in such cases, HR internal investigations may likewise be carried out on the basis of those regulations. In all cases, investigations must be limited to employment-related matters and conducted in accordance with applicable labour law and data protection requirements, including the principles of necessity, proportionality and data minimisation.

Beyond the cases expressly provided for by law, any other type of HR internal investigation, as well as the specific manner in which such investigation is conducted (as further described below), is based on the employer’s right to manage his/her company and recognised best practices, usually reflected in company policies, given that Greek law does not exhaustively regulate or specify the procedural steps for the conduct of HR internal investigations outside the above statutory frameworks.

Employers must maintain dedicated channels enabling employees to report concerns. For violence and harassment matters, the GLC requires confidential, accessible reporting mechanisms, though it does not prescribe a specific format. Employers typically implement HR mailboxes, designated officers or secure internal systems.

Under Law 4990/2022, reporting channels must include written, oral and electronic options, such as telephone lines, voicemail systems and an online platform accessible to people with disabilities. A personal meeting with the Internal Reporting Officer (IRO) must be available upon request. Anonymous reporting is not mandatorily accepted. In all cases, confidentiality of the reporter’s identity and any third parties involved shall be strictly protected (see also 8.1 Whistle-Blowing for further details).

Responsibility for internal investigations in Greece depends on the applicable legal framework.

In cases of violence and harassment in the workplace, the responsible person for receiving the complaints and handling the internal investigation is defined in the respective company policy (see 5.1. Requirements). Generally, investigations are typically carried out by HR, legal or compliance functions that are sufficiently independent from the reporting line of the individuals concerned. Even the employer may carry out an HR internal investigation in cases of smaller enterprises. External counsel is commonly engaged, particularly where allegations involve senior management or increased legal, reputational or data protection risks.

Whistle-blowing reports are governed by a distinct and mandatory regime under Law 4990/2022. Such reports must be handled by the IRO, who operates independently, safeguards confidentiality and determines whether and how the matter should be referred to competent internal bodies or external authorities. Whistle-blowing investigations are not conducted by HR as such, and any involvement of external counsel must be co-ordinated through the IRO and remain aligned with the statutory safeguards set out in the law.

An investigation is mandatory by law in two scenarios. First, when a formal complaint alleging violence or harassment in the workplace is submitted under the GLC. The employer must examine the complaint with confidentiality and diligence. Second, when a whistle-blowing report is submitted under Law 4990/2022, triggering the IRO’s statutory duties to acknowledge receipt, assess the report and take appropriate follow-up action. Failure to investigate in these contexts may expose the employer to administrative penalties, liability for breach of workplace safety obligations or claims of insufficient protection of employees’ rights.

Internal investigations may be restricted or temporarily inadvisable where data protection rules prevent lawful processing. Employers cannot conduct investigative steps that are disproportionate, unnecessary or lack a lawful basis under GDPR. Processing special category data (eg, health information) is restricted unless specific legal conditions are met. Investigations may also be paused where they risk interfering with ongoing criminal proceedings, as investigative acts falling within prosecutorial or police competence cannot be replicated internally.

Where an investigation is neither legally required nor prohibited, employers exercise discretion. Factors considered include the specificity and credibility of the information, severity of the alleged behaviour, potential impact on the business, legal and reputational risks and internal policy requirements. A preliminary assessment often precedes the decision: if concerns are minor, unclear or manageable through informal resolution (eg, mediation or managerial intervention), a full investigation may not be necessary. Where allegations suggest potential policy breaches or risks to workplace integrity, employers commonly proceed with a formal investigation to ensure due diligence and compliance.

Greek law differentiates between the procedural safeguards applicable under the whistle-blowing regime and the more general framework governing violence and harassment in the workplace.

Under Law 4990/2022, the Internal Reporting Officer is expressly required to acknowledge receipt of the internal report within seven working days and maintain communication with the reporter throughout the follow-up process. Accordingly, the reporter must be informed that the matter has been taken up and that appropriate actions are being undertaken. The law does not require disclosure of investigative strategy, sources, or evidence at this stage, but the reporter must receive an update on follow-up actions within three months from the acknowledgement of the report.

For cases relating to violence and harassment in the workplace under the GLC, the employer is under a duty to receive, investigate and manage complaints confidentially and without delay. Although the legislation does not prescribe a formal notice procedure, good faith handling of complaints requires that the reporter is informed that their complaint has been received and will be duly examined. This communication typically focuses on reassurance regarding confidentiality, procedural fairness and non-retaliation guarantees rather than specifics of investigative steps.  Also, as regards the respondent, Greek law does not impose an automatic right to be notified upon the initiation of an internal investigation or about its progress. As a result, the handling of this issue depends on general principles applicable in the Greek legal order as well as on best practices. Therefore, principles of due process, fairness and the respondent’s right to be heard require that, at an appropriate stage of the process and before the respondent is heard, the respondent is duly informed of the essential elements of the allegations. Failure to observe such basic procedural safeguards may expose the investigation to challenges, including the risk that it may be considered biased or lacking impartiality.

The above general rules regarding the notification obligation towards the reporter and the respondent also apply in all other cases of HR internal investigations.

There is no general rule requiring employers to notify authorities when an internal HR investigation is opened. Notification obligations arise only in defined circumstances.

First, in the context of violence and harassment, if the matter escalates into a dispute that falls within the Inspectorate’s competence – such as cases where the employee seeks intervention – employers must co-operate fully with the Inspectorate’s requests. Although the employer is not obliged to self-report every internal investigation, once the Inspectorate becomes involved, the employer must provide relevant information, documentation and explanations upon request.

Second, where an internal investigation reveals indications of criminal conduct – such as physical assault, sexual violence, serious threats, or conduct punishable under criminal law – employers may have a duty to report the incident in line with general criminal-law obligations. In practice, employers tend to notify authorities when the conduct poses immediate risks, when legal obligations to protect employees are implicated or when the affected employee requests that criminal action be pursued.

Under the whistle-blowing regime, internal reports that fall outside the scope of EU law violations, or which are unfounded or unintelligible, may be closed by the IRO. While the organisation does not need to notify authorities in such cases, the reporter retains the right to submit the matter to the external reporting channel. Employers should therefore anticipate that authorities may indirectly become aware of the issue and should preserve documentation demonstrating that internal procedures were correctly followed. In addition, under the applicable legislative framework, where the IRO identifies indications of a criminal offence subject to ex officio prosecution, it is entitled – and obliged – to promptly transmit the report to the competent Public Prosecutor, irrespective of whether the reported conduct falls within the material scope of Law 4990/2022, subject to the applicable confidentiality and personal data protection safeguards.

Outside these defined scenarios, the opening of an internal investigation may be communicated to authorities when doing so serves operational, safety or compliance objectives – for example, where urgent protective measures or co-ordinated action are required. In such cases, the employer typically limits information to the essential elements necessary for the authority to intervene effectively.

Parties involved in an internal investigation may be asked to sign confidentiality agreements. The purpose is to protect the integrity of the process, ensure that evidence is not compromised and prevent retaliation or undue pressure on witnesses. Such undertakings must, however, respect legal limits. They cannot restrict statutory rights, for example, the right to submit a whistle-blowing report through internal or external channels, or to co-operate with competent authorities. Nor can they impose unreasonable constraints that would undermine labour or constitutional rights, such as freedom of expression or the right to lodge complaints with public bodies. Nor may they restrict the obligation to testify if a party is summoned by a court, including in relation to the internal investigation itself.

The fact that information or documents are subject to a confidentiality agreement does not, per se, render their use as evidence unlawful or inadmissible in the context of judicial proceedings, where such use is necessary for the exercise or defence of legal rights.

Even in the absence of a confidentiality agreement, the parties are subject to a general duty of discretion arising from employment law, the employer’s right to direct and organise work, and the statutory confidentiality obligations applicable in whistle-blowing cases. Disclosure of sensitive information in breach of these duties may give rise to disciplinary measures or, in serious cases, liability for damages if the disclosure causes harm. Conversely, employers must ensure that confidentiality obligations are not used in a manner that could discourage lawful reporting or shield unlawful conduct.

There is no legal provision prescribed by Greek law for the conduct of a preliminary investigation. Employers may conduct a preliminary or initial assessment before launching a full internal investigation, and this is standard practice. Such a preliminary stage allows the employer to determine whether the information received constitutes a complaint within the meaning of the GLC or a report within the scope of the whistle-blowing law, and whether there are sufficient indications to initiate a formal process, etc.

During this phase, the employer may review available documents, clarify the nature of the concern, assess potential risks and determine the need for immediate protective measures. Preliminary steps must remain proportionate and avoid breach of confidentiality, as well as extensive data processing until a proper legal basis is established. Once it becomes clear that the matter falls under statutory obligations – such as violence and harassment or whistle-blowing – the employer must escalate to a full investigation and follow the procedures mandated by law.

Scope-setting at the outset is essential. Employers typically define the allegations under review, identify the individuals involved, determine the type of evidence to be collected and assess whether external expertise is required. A well-structured preliminary phase enhances procedural fairness and minimises later challenges regarding the adequacy or impartiality of the investigation.

In Greek HR investigations, employers typically interview the complainant, the respondent and any witnesses proposed by either party who may have firsthand or contextual knowledge of the events. The number of interviews varies depending on the complexity of the issue, but employers generally try to speak with all the people involved to gain a complete and balanced view of the facts. The aim is to obtain sufficient, reliable information in a proportionate manner.

Employees are not obliged to participate in internal investigations unless such an obligation is expressly provided for in the employment agreement or the internal regulation (which, however, is not common practice). Nevertheless, employers expect employees to co-operate with such investigations as part of their general duty of good faith and loyalty in the employment relationship. When an employee refuses to participate or selectively responds, the employer must continue the investigation using any other evidence available. In exceptional cases, especially where the refusal obstructs essential fact-finding, this behaviour may be considered in assessing credibility or potential disciplinary consequences, provided the employer acts fairly and proportionately. Clear communication about why participation matters often helps resolve reluctance.

Interviews may be conducted in person or remotely. Employers commonly use remote formats such as video-conferencing tools (Teams, Zoom, etc) when geography or timing makes in-person meetings impractical. Remote interviews must still maintain confidentiality and a secure environment, particularly in sensitive matters. The chosen format usually depends on the seriousness of the allegations, the comfort of the parties and the need to preserve the integrity of the process.

No rules prescribed by law regarding the interviewers. Most employers appoint one or two interviewers to ensure consistency, impartiality and objectivity, while avoiding confusion for participants. Interviewers are typically HR professionals, compliance officers or legal counsels (internal or external) who have no personal involvement in the matter. Objectivity is essential, and employers must avoid appointing someone who could be perceived as biased. Seniority is also important, and employers must ensure that interviewers have an appropriate level of seniority. In harassment or discrimination cases, appointing an interviewer of a particular gender may help create a more comfortable and balanced environment, although this is not legally required. In exceptional cases where the internal investigation includes a physical search of the person under investigation, such search must be conducted by an investigator of the same gender.

It is not mandatory by law to include a neutral observer in interviews, but employers sometimes involve a second person to support the primary interviewer and ensure transparency. This may be another HR representative or, in complex or sensitive cases, an external consultant or lawyer. The presence of a neutral person can help reassure participants that the process is being conducted fairly and that the employer is committed to impartiality. A neutral observer may also help safeguard the primary interviewer against unfounded allegations regarding the procedure.

There are no rules prescribed by law concerning the right of interviewees to be accompanied by a support person and/or a lawyer. In common practice, interviewees are not accompanied by a support person or lawyer. Nevertheless, permitting it can contribute to a more balanced and co-operative investigation process.

There is no mandatory information prescribed by law that must be provided to interviewees at the start and/or at the end of an interview. At the beginning of the interview, the interviewer usually explains the purpose of the investigation, the role of him/her and how the information will be used. It is also good practice to clarify confidentiality expectations and the process for handling personal data. Interviewees should be informed that they can raise additional points, provide documents or suggest further witnesses. At the end of the interview, the interviewer typically outlines the next steps and how follow-up communication will take place.

If an interviewee wishes to pause or end the meeting, the interviewer will generally accommodate the request, particularly if the discussion is sensitive or the individual is distressed. The interview may be rescheduled, or the employer may proceed using the information already gathered.

Under Greek labour law, the interviewer is not obliged to take minutes. In practice, however, employers generally take minutes to ensure an accurate record of what was discussed. Summaries are acceptable provided they reflect the substance of the interview without distorting the content. Interviewees are often given an opportunity to review the minutes and propose clarifications. While signatures are not legally required, obtaining confirmation helps avoid disputes later. Minutes are usually kept by HR.

Recording interviews is generally possible. When recordings are made, the interviewee must provide clear, informed consent, to be recorded at the very beginning of the interview. Employers who record interviews typically prepare a transcript that is shared only with individuals directly involved in the investigation. Auditors should remind participants that recording is not permitted unless expressly agreed and, especially in remote interviews, should use platform settings that limit unauthorised recordings.

Employers may supplement interviews with any other means of proof, including document reviews, possibly email checks, or even CCTV footage, provided that these methods comply with privacy principles and have been properly communicated to employees in advance. They may also review access logs, timesheets or any other operational records relevant to the matter. Practices that intrude excessively into personal privacy, such as covert monitoring or accessing private communications, are not permitted. The goal is to gather reliable evidence while respecting proportionality and the rights of all individuals involved.

Any form of retaliation, meaning punishment of someone or the taking of adverse employment actions (eg, termination of employment contract, detrimental change in working conditions, disciplinary action) because (s)he raised a concern or complaint about potential harassment, discrimination, violence, or retaliation, or because (s)he participated in an investigation is strictly prohibited. Article 66 of GLC provides that the termination of employment effected as a retaliatory measure against an employee who has filed a complaint concerning incidents of violence or harassment is null and void. However, that prohibition is not intended to protect persons who intentionally make false reports. In the case of employees who, knowingly, make a false complaint, disciplinary penalties may be imposed, including the termination of the employment agreement.

Furthermore, according to Article 65 GLC, any person who is subjected to an incident of violence or harassment shall have the right to leave the workplace for a reasonable period of time, without loss of pay or any other adverse consequence, provided that, in their reasonable belief, there exists an imminent and serious risk to his/her life, health, or safety. This applies in particular where the employer is the perpetrator of such conduct, or where the employer fails to take the necessary, appropriate measures to restore workplace peace, or where such measures are insufficient to stop the violent or harassing behaviour. In such a case, the person leaving the workplace must first inform the employer in writing, specifying the incident of violence or harassment and the circumstances substantiating his/her belief that a serious risk to his/her life, health, or safety is imminent. If the risk does not exist or has ceased to exist and the reporter refuses to return to the workplace, the employer may refer the matter to the Labour Inspectorate for resolution of the dispute.

An internal investigation must be conducted in a confidential manner and in a way that fully respects human dignity. In this context, the employer must substantiate that all statutory duties were duly fulfilled, including the obligation to provide a safe and dignified working environment, to take immediate and proportionate actions upon receiving a complaint, and to conduct a prompt and impartial investigation. The employer shall further ensure that all parties are afforded appropriate procedural safeguards, including the right to be heard, the right to present evidence, and the right to respond to allegations. Confidentiality must be maintained to the fullest extent possible, consistent with the need to carry out an effective investigation. Nevertheless, confidentiality often does not align with effectiveness. If certain information is not disclosed to the respondent for confidentiality reasons, the results of the investigation may have limited evidentiary value, as the allegations cannot be properly assessed. Failure to meet these obligations may give rise to employer liability, irrespective of whether the alleged conduct is ultimately established.

There are no specific rules prescribed by Greek law regarding the measures which may be taken against the respondent prior to concluding an HR internal investigation. In practice, during an internal investigation, the respondent may, where justified by the seriousness of the allegations, be placed on paid leave if the investigation concerns alleged serious violations of company policy or conduct that may constitute criminal offences. Such a measure shall be imposed only where it is necessary to safeguard the integrity, impartiality, or effectiveness of the investigation, to prevent interference with witnesses or evidence, or to protect the interests of the undertaking or any affected persons. In general, no disciplinary measure shall be taken against the respondent prior to concluding an HR internal investigation and the collection of sufficient evidence. The presumption of innocence in favour of the respondent also applies throughout the HR internal investigations.

Furthermore, according to Article 65 GLC, if a violation of the prohibition of violence and harassment is discovered or assessed, the employer is obliged to take all necessary, appropriate, and proportionate measures to prevent and avoid the recurrence of a similar incident or conduct. Such measures may include a warning to the respondent, modification of duties, working hours, place or manner of work, or even the termination of the employment relationship. Such measures shall be taken following the conclusion of the HR internal investigation.

Under Greek labour law, the employer owes a general duty of care towards employees. In this context, the employer must ensure the protection of the individual rights of all employees who may be involved or otherwise affected. In this context, the employer must guarantee respect for human dignity, privacy, and personal data, and must conduct the investigation in a manner that is impartial, fair, and free from any form of discrimination or retaliation. Such obligations also apply to the reporter and the respondent.

There are no rules prescribed by Greek law that must be put in place when conducting an HR internal investigation. General principles apply, such as the following.

• A disciplinary sanction may be imposed only for offences provided by law (reflecting a principle similar to the criminal law concept of “nullum crimen, nulla poena sine lege”, albeit applied in a more limited manner in a disciplinary context).
• The disciplinary sanction must comply with the principle of proportionality, taking into account the seriousness of the disciplinary offence. An obvious disproportionality between the disciplinary sanction and the disciplinary offence renders the imposition of the sanction abusive (Article 281 of the Civil Code) and therefore unlawful.
• The retroactive application of a disciplinary provision is prohibited.
• The principle of “non bis in idem” applies, according to which only one disciplinary sanction may be imposed for the same disciplinary offence.
• The imposition of a sanction without respecting the respondent’s right to be heard is unlawful. A person subject to disciplinary proceedings must be invited to submit an oral or written defence before the sanction is imposed.
• The disciplinary procedure must be initiated within a reasonable period of time from the commission of the disciplinary offence. The employment regulations may also provide for a limitation period for disciplinary offences.

According to Article 62 of the GLC, undertakings employing more than 20 persons are required to adopt a policy for the prevention and combating of incidents of violence and harassment at work, as well as for the management of internal reports on the same. The policy shall expressly declare zero tolerance for such forms of conduct, set out the rights and obligations of employees and the employer in relation to the prevention and handling of such incidents or behaviours, and describe the procedure for the submission and examination of related complaints in a manner that ensures the protection of the victim and respect for human dignity. Τhis policy may be incorporated into, or accompanied by, a policy for the promotion of equal opportunities and the elimination of discrimination, and shall include, at a minimum, the following:

• an assessment of the risks of violence and harassment in the workplace;
• measures for the prevention, control, mitigation, and management of such risks, as well as for the monitoring of such incidents or behaviours;
• awareness-raising and information actions for staff;
• information on the rights and obligations of employees, the employer, and persons exercising managerial authority or representing the employer, to the extent and within the scope of their responsibilities, in the event that such incidents occur or are reported, as well as on the relevant procedure;
• the designation of a person within the undertaking to act as a point of reference (“liaison”), responsible for guiding and informing employees on the prevention and handling of violence and harassment at work;
• the protection of employment and the support of employees who are victims of domestic violence, insofar as possible, by any appropriate means or reasonable accommodation;
• safe and easily accessible communication channels for the submission of complaints, together with the identification of the persons within the undertaking who are responsible for receiving and examining such complaints and for informing complainants;
• the investigation and examination of complaints with impartiality and with due protection of confidentiality and personal data concerning both victims and respondents;
• the prohibition of retaliation and further victimisation of the affected person;
• a description of the consequences in the event that violations are established; and
• co-operation with, and provision of all relevant information to, the competent authorities, where requested.

The policy referred to in 5.1 Requirements must form an integral part of the employer’s internal regulation (which is mandatory for companies employing more than 70 employees and optional for companies employing less than 70 employees). In all cases, non-compliance with the provisions of the internal regulation by the employer may give rise to employer liability, and non-compliance with the provisions of the internal regulation by the employee may lead to the imposition of disciplinary sanctions.

According to Greek law, the person who raises a claim must be able to fully prove the factual circumstances necessary to support it. By contrast, where an employee invokes incidents that may reasonably be construed as constituting violence or harassment, the employer bears the burden of proof to demonstrate “beyond reasonable doubt” that no such misconduct has occurred and that all statutory and internal procedural obligations have been duly observed (Article 68 GLC – reversal of burden of proof).

Greek law does not prescribe a fixed threshold for ending an investigation. In practice, the person who is conducting the investigation brings it to a close once enough information to make a well-grounded decision has been gathered. The standard is whether further steps would meaningfully change the outcome, taking into account proportionality and fairness. Investigations may also end if allegations are clearly unfounded or if key facts cannot be established despite reasonable efforts. Employers are expected to act promptly, avoiding unnecessary delays that could affect workplace relations or increase legal risks.

There is no statutory procedure for closing an investigation, but employers typically follow internal guidelines and policies to ensure consistency. Once the investigation is complete, the decision maker or investigator should document the basis for ending the process and communicate the outcome to the relevant parties.

When the investigation is concluded early, for example, due to insufficient evidence, the communication may be more limited, but it still generally explains that no further action will be taken.

Where the investigation has reached a full conclusion, employers often outline next steps, including any remedial or disciplinary measures.

There is no legal requirement that conclusions be recorded in a particular format. Nevertheless, most employers prepare an investigation report because it provides clarity, supports consistency and may be needed if decisions are later challenged. Smaller or less complex investigations may result in a shorter written report, while more serious matters – particularly those involving harassment, misconduct or compliance issues – usually require a more detailed report. The level of formality depends on the nature of the allegations and the potential consequences for the employees involved.

Reports usually follow a clear structure but are not subject to statutory requirements. They often include:

• a brief description of the allegation and scope of the investigation;
• the steps taken, including interviews and evidence reviewed;
• key factual findings and how credibility was assessed;
• a conclusion on whether the allegation is supported, partially supported or not supported; and
• recommended next steps, which may range from no action to disciplinary measures or organisational improvements.

Employers aim to produce a document that is factual, neutral and suitable for internal decision-making.

There is no rule prescribed by law regarding the information provided to the parties on the outcome of an HR internal investigation. As a general rule, complainants and respondents are entitled to receive copies of the full investigation report; however, in exceptional cases, due to confidentiality and data protection considerations, this right may be limited to access to relevant parts of the report and/or the provision of a summary thereof. Complainants are typically informed about whether their concerns were substantiated and the general measures that will follow, without disclosing sensitive information about other individuals. Respondents are informed of the conclusions and any disciplinary actions/measures that directly relate to them.

There is no general rule requiring employers to notify authorities when an internal HR investigation is closed. In certain circumstances, employers must escalate matters to the authorities (see 2.2. Communication to Authorities for further details). This includes credible indications of criminal conduct, serious health and safety breaches or mandatory reporting obligations that arise under specific regulatory frameworks. In harassment and violence cases, employers may need to notify labour authorities if the complainant opts to pursue a formal complaint before them.

In other situations, employers may choose to involve authorities if the investigation uncovers risks that extend beyond the workplace or if transparency is necessary to limit legal exposure. The type of information shared is usually limited to the essential facts and steps taken to address the issue.

Employers may update individuals who assisted in the investigation, such as witnesses, particularly when their co-operation was essential, although it is not a common practice in Greece. These communications are usually brief and confirm only that the investigation has concluded, without sharing confidential or personal details. Managers or team leaders may also receive limited information when they need to implement workplace adjustments or monitor conduct going forward. The aim is to preserve privacy while ensuring that operational needs are met.

Internal working regulation (which is mandatory for companies employing more than 70 employees and optional for employers with fewer than 70 employees) set out the available disciplinary measures. Depending on the seriousness of misconduct, these may range from warning to reprimand or suspension or fine. Any disciplinary decision must be proportionate and supported by the investigation findings. In severe cases where the trust between employer and employee has been breached, although dismissal is not considered a disciplinary measure under Greek labour law, the employer may choose to proceed with immediate termination of employment.

Timing is important. Employers typically act without undue delay once the investigation is completed, especially where misconduct poses an ongoing risk. However, they should also allow sufficient time to consider the employee’s explanation and ensure that the decision is procedurally sound.

Many employers implement additional measures to support a healthier workplace, even when allegations are unsubstantiated. These may include refresher training, mediation between team members or steps to improve communication and supervision. In harassment cases, employers often consider reassigning tasks or adjusting reporting lines to restore a safe environment. Such measures help reduce the likelihood of future conflicts and demonstrate a proactive approach to maintaining respectful working conditions.

Data protection in Greece is regulated by the GDPR, Greek law 4624/2019 as well as any specific/sectoral legislation, and interpreted and enforced by the Hellenic Data Protection Authority (HDPA) and the courts. The matter of data processing in HR investigations is not explicitly regulated (with the exception of Law 4990/2022 on Whistle-Blowing). An employer is allowed to collect personal data for the purpose of an HR investigation as long as the general obligations set by the legal framework are respected, as outlined below.

Legal Basis

The key to lawful data collection/processing is the selection of the appropriate legal basis. In most instances the legitimate interests (GDPR Article 6(1)(f)) basis will apply. In such a case, the employer should be able to demonstrate that the processing is necessary and proportionate, and employees’ rights are not overridden. A Legitimate Interests Assessment (LIA) is expected or a specific analysis in the Data Protection Impact Assessment on employees.

For specific matters, the legal basis of compliance with Legal obligation (GDPR Article 6(1)(c)) would apply, when a specific law requires investigative processing (for example, obligations arising from Greece’s whistle-blower framework, Law 4990/2022, including operating internal reporting channels).

Regarding special category data (GDPR Article 9), if the investigation necessarily involves the processing of sensitive data (eg, health, union membership), an Article 9 GDPR legal basis should be employed in addition to Article 6 – most commonly, the necessity for the establishment, exercise, or defence of legal claims (Article 9(2)(f)) or, where applicable, employment and social security law requirements.

GDPR Principles

Employers must abide by the core GDPR principles:

• proportionality, necessity, and minimisation – demonstrate that the data collection is strictly necessary for defined investigative purposes and that no less intrusive alternative exists;
• transparency and notice – provide clear prior notices via policies on investigations and monitoring; for email/IT/device monitoring the Acceptable Use/Access Policies must define purposes, scope, methods, safeguards, and retention;
• telecommunications secrecy – comply with rules governing traffic and communications content data;
• data subject rights and restrictions – enable access, rectification, restriction, and objection, subject to lawful exceptions; and
• security measures – implement appropriate technical and organisational controls (need-to-know handling, role-based access, encryption, logging, evidence segregation, and secure workflows).

HR investigations must comply with the principles for lawful data processing under the GDPR, Greek Law 4624/2019, and HDPA guidelines and decisions, which necessitate clear, proportionate and documented controls throughout the investigation’s life cycle as well as prior notices. In addition to the rules described in 7.1 Collecting Personal Data,ensuring the lawfulness of data processing, employers must implement the following:

Key Legal Safeguards

• Necessity, Proportionality, Minimisation: The employer must narrowly define purpose, custodians, timeframes, and tools employed during an investigation.
• Transparency: Employees must be notified via clear policies about how investigations are to be conducted and the tools used, explaining in clear language the scope, the means and rights of both the employer and the employee.
• Special Considerations: Workplace CCTV footage can be used only for protection of persons/property (not performance evaluation). Email/IT/device monitoring must be targeted and necessary, and a clear Acceptable Use Policy and Access Policy defining the purposes, scope, methods and safeguards governing the employer’s access to the email/IT/devices as well as the retention periods must have been provided to the employees. 
• Compliance with telecommunications secrecy rules for traffic/content data is required. 

Risk Assessment, Security, and Rights

• A DPIA must be conducted when high-risk processing is the case (eg, when the investigation involves employee monitoring, large-scale processing, special categories, profiling).
• Security: The appropriate technical and organisational measures must be implemented, such as limited access policies (need-to-know access), encryption, logging, segregation/chain of custody.
• Rights: Employees maintain the rights afforded to them by the GDPR with very limited exceptions (see 7.3 Access) only if a disclosure would seriously impair the investigation or others’ rights. Thus, the appropriate mechanism to enable employees’ exercise of rights of access/rectification/restriction/objection must be in place.

Accountability, Processors, Transfers, Retention

The accountability principle mandates that the investigation process must be documented. If an external party is engaged, the appropriate obligations under Article 28 must be implemented. If data transfers outside the EEA are to take place, the appropriate mechanisms/safeguards provided for in Articles 45–49 of the GDPR must be employed. The investigation data must be retained for the time period necessary to fulfil the relevant purpose unless an extension is justified, and must be deleted or properly anonymised upon closure of the investigation, taking into account any applicable appeal or limitation periods.

Regardless of whether they are the subject of an investigation or have initiated it, the employees, as data subjects, fully retain their rights under the GDPR. Under the GDPR and Greek law, any person whose data is processed in an HR investigation typically has a right of access to their own personal data; thus, in principle, the data subject (complainant, respondent, or witness) can obtain their personal data found in notes, emails, logs, documents, CCTV footage, etc, plus the required Article 15 information (purposes, categories, recipients, retention, source, and safeguards for transfers).

However, the right to access is not an absolute right. The employer can invoke the limitations provided by the applicable law and provide extracts or redacted copies if an exception applies:

• Protecting the Rights and Freedoms of Third Parties: The employer may redact or withhold third-party identifiers, witness statements, or data that would reveal someone else’s identity or privacy (GDPR Article 15(4), Recital 63) if a disclosure would result in a violation of the rights and freedoms of persons involved.
• Ongoing Investigation Integrity: For example, there may be grounds for protecting whistle-blowing confidentiality, protecting the reporting person’s identity and related confidential details under Greece’s whistle-blower framework (Law 4990/2022)). In this case, the rationale and the justification for any temporary or other limitation of access should be documented.
• Legal Confidentiality and Proprietary Information/Trade Secrets: In these cases, the employer may be able to withhold privileged communications and proprietary information, or provide summaries where feasible.
• Confidentiality of Telecommunications: The employer can restrict access where disclosure would breach applicable law.
• Regulatory Constraints: Disclosure may be limited where mandated by law.

AI is not very common in HR investigations in Greece yet. However, AI tools may be used to facilitate and expedite evidence review such as AI-assisted review for emails and chats, detection of suspicious activity in logs and transactions, audio transcription and machine translation.

Data protection questions arise under the GDPR, Greek Law 4624/2019, and Greece’s Law 4961/2022 on emerging technologies in the employment sector as well as the AI Act. Law 4961/2022 emphasises trustworthy, human-centric AI (transparency, accountability, risk management, non-discrimination) and promotes governance measures (impact/risk assessments, human oversight, documentation). These provisions are in alignment with both the GDPR and the AI Act and must be taken into account when using an AI system in HR investigations.

• High-Risk Processing: Many AI tool uses (monitoring, profiling, video analytics, large-scale review, special categories) would result in a high risk to the freedoms and rights of the employees and thus trigger the need for conducting a DPIA. If residual high risk remains, prior consultation with the HDPA should be obtained.
• Automated Decisions: AI systems should not be allowed to take decisions that produce legal or similarly significant effects on employees without Article 22 GDPR safeguards. Human oversight and the involvement of a person in the final decision-making process are legally required.
• Transparency: Employees must be informed about the use of AI tools in the investigation in clear but detailed language and in a simple manner. A transparency report should be available to all employees if AI systems are involved in HR investigations, explaining the reasoning, the parameters and the criteria used in a determination made by the AI system.
• Accuracy and Bias: The employer must document the due diligence performed to ensure that the AI systems used are free of bias and are trained on accurate data.
• Vendor and Transfer Controls: If a third-party provider is engaged, it must be bound by the obligations of Article 28 GDPR. In addition, special clauses should be put into place to prevent the provider from using the employer’s inputs for model training, to map data flows, and to ensure that a lawful transfer mechanism and a transfer impact assessment are in place for any access to data outside the EEA.
• Security and Confidentiality: Strict role-based access, encryption, and logging should be implemented.
• Retention: Data retention must be limited and purpose-bound, with investigation data deleted or anonymised upon the closure of the matter.

Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law has been incorporated into Greek legislation through law 4990/2022. Law 4990/2022 applies for the protection of persons who report or disclose:

• breaches of Union law in the following areas:
1. public procurement;
2. financial services, products and markets, crypto-asset markets, as well as the prevention of money laundering and terrorist financing;
3. product safety and compliance;
4. transport safety;
5. environmental protection;
6. radiation protection and nuclear safety;
7. food and feed safety, and animal health and welfare;
8. public health;
9. consumer protection; and
10. protection of privacy and personal data, as well as the security of network and information systems;
• breaches affecting the financial interests of the European Union within the meaning of Article 325 of the Treaty on the Functioning of the European Union (TFEU) and the specific Union measures adopted thereunder;
• breaches relating to the internal market, including infringements of EU competition and state aid rules;
• breaches of domestic law concerning the offences of bribery and trading in influence; and
• breaches of EU restrictive measures.

Whistle-blowers are entitled to protection (i) provided that, at the time of the report, they had reasonable grounds to believe that the information concerning the reported violations was true, (ii) when they submit a report either internally or externally, or through public disclosure, as well as when they submit a report to the competent institutional and other bodies and organisations of the European Union and (iii) in the case of anonymous reporting, if they are subsequently identified.

Private sector entities employing 50 or more employees shall designate an IRO with respect to breaches falling within the scope of law 4990/2022, while those employing fewer than 50 employees may designate an IRO. Where no such officer is appointed, a report may be submitted to the National Transparency Authority. Private sector entities operating in the fields of financial services, products and markets, transport and the environment, as well as entities operating under decisions approving environmental terms, or whose activities by their nature may pose risks to the environment and public health, are required to designate an IRO, irrespective of the number of employees they employ (see also 1. Opening an HR Internal Investigation for further details).

Reports may be made either internally to the IRO or externally to the National Transparency Authority.

According to Article 18 Law 4990/2022, any form of retaliation against the reporters is prohibited, including threats and acts of reprisal. The following forms of retaliation are, in particular, prohibited:

• suspension, dismissal, or any equivalent measure;
• demotion, omission or withholding of promotion;
• removal of duties, change of workplace, reduction in wages, change in working hours;
• withholding of training;
• negative performance assessment or employment reference;
• reprimand, imposition of disciplinary or other measures, including financial penalties;
• coercion, intimidation, harassment, or ostracism;
• discrimination or unfair treatment;
• failure to convert a fixed-term employment contract into a permanent one;
• failure to renew or early termination of a fixed-term employment contract;
• deliberate harm, including damage to reputation – particularly through social media – or financial loss, including business loss and loss of income;
• blacklisting on the basis of an official or unofficial sectoral or industry-wide agreement, which may result in the person being unable to secure future employment in the sector or industry;
• early termination or cancellation of a contract for goods or services;
• withdrawal or cancellation of a permit or licence;
• referral for psychiatric or medical evaluation; and
• refusal or deprivation of reasonable accommodation for persons with disabilities.

Reporters are also protected from committing criminal offences or judicial proceedings regarding the acquisition of information or access to the information reported or publicly disclosed.

If the report or public disclosure constitutes, for the reporter, a criminal, disciplinary, administrative offence or a tortious act, any criminal, disciplinary, administrative, or civil proceedings initiated against the reporter in relation to the reported violation shall be suspended until the completion of the investigation of the report.

Reporters are also entitled to free-of-charge legal advice and psychological support. In case of retaliation, they are entitled to full compensation. Moreover, they have access to all remedies and legal means and enjoy the rights to a fair trial, including, in particular, the right to an effective remedy before an impartial tribunal, as well as the presumption of innocence and the rights of defence, including the right to be heard and the right of access to their file.

All employees under any legal status are protected by the GLL in case of violence/(sexual) harassment.

Violence and harassment (Article 60 GLL) include any forms of conduct, acts, practices, or threats thereof which are intended to cause, result in, or are likely to result in physical, psychological, sexual, or economic harm, whether occurring as isolated incidents or on a repeated basis.

Harassment (Article 60 GLL) includes any form of conduct which has the purpose or effect of violating a person’s dignity and of creating an intimidating, hostile, degrading, humiliating, or offensive environment, irrespective of whether it constitutes a form of discrimination, and includes harassment on the grounds of sex or on any other ground of discrimination. Harassment also includes bullying and mobbing.

Sexual harassment (Article 35 GLL) includes any form of unwelcome verbal, psychological, or physical conduct of a sexual nature which results in an affront to a person’s dignity, in particular by creating an intimidating, hostile, degrading, humiliating, or offensive environment.

Any person who is affected by a potential incident of violence and harassment is entitled to lodge an internal complaint as well as a complaint before the Labour Inspection and before the Ombudsman.

In case of violation of the prohibition of violence and harassment by the employer, the affected person may claim full compensation, covering both pecuniary and non-pecuniary and moral damages, and administrative fines may also be imposed by the competent Labour Inspectorate.

In general, any form of direct or indirect discrimination in all aspects of employment (from the hiring process, including interviews, until termination) is strictly prohibited.

Articles 34–57 GLC establish a protective framework for the prohibition of discrimination on grounds of sex, setting out, inter alia, that men and women are entitled to equal pay for the same work or for work of equal value.

Τhe termination of an employment agreement is null and void if it is the result of discrimination on grounds of gender, race, skin colour, political ideology, religious or philosophical beliefs, ancestral origin, national or ethnic origin, sexual orientation, age, identity or gender characteristics, disability or participation in a trade union (Article 350 GLL).

As concerns bullying and/or mobbing, see 8.2. Sexual Harassment and/or Violence.

In general, Greek criminal legislation provides for a reporting obligation in the case of serious criminal offences (felonies). As concerns the IRO’s obligation to report a crime, see 2.2. Communication to Authorities.

From an employment law perspective, the only case where the employer is not obliged to pay statutory severance is when an employee has committed a criminal offence and the employer has filed criminal charges against the employee before termination.

In multi-jurisdictional HR internal investigation cases there are no special procedures that shall be followed; the rules applied depend mainly on the employer’s respective policies.