HR investigations are typically triggered by an employee’s complaint to a manager or the HR department, or through a dedicated whistle-blowing/reporting system. They can also be triggered by the company becoming aware of misconduct through an internal or external audit, or even via media coverage.

An investigation can also be required by the authorities in certain circumstances. For example, if an employee files a petition at a labour office (an administrative office maintained by the Ministry of Employment and Labour) alleging workplace or sexual harassment, the labour office will generally require the employer to investigate and provide a report.

Employers have a statutory obligation to promptly investigate workplace and sexual harassment if an employee files a complaint or if the company otherwise becomes aware of such conduct.

For other kinds of misconduct, such as financial fraud or IP theft, employers generally have no specific legal obligation to investigate. However, employers that are subject to specific regulatory regimes, such as financial institutions, may be obliged to investigate wrongdoing in accordance with their industry-specific regulations.

For workplaces with 30 or more employees, a labour-management council and a grievance-handling committee must be established, with their members chosen from the council. However, in practice, such committees are relatively rarely used by employees as the primary means of reporting problems.

More commonly, employees file complaints with a manager or executive, or with the HR department. At companies that operate an internal hotline/reporting system, reports may also come in through that system.

An employer does not have to maintain any mechanism to allow or facilitate anonymous reporting. However, employers must be careful not to disclose the identity of a potential whistle-blower and to prevent any retaliation against a whistle-blower.

There are no express legal rules governing who should be responsible for carrying out an investigation. However, applicable legislation requires that an employer conduct an “objective” investigation into potential workplace harassment.

Typically, an HR or audit department is responsible for conducting internal investigations. There are generally no restrictions on involving external counsel in an investigation. In practice, outside lawyers and licensed labour consultants often assist with such investigations. Typically, external counsel’s assistance is sought in cases where:

• the matters are complex or require expertise in certain legal areas; or
• when internal dynamics could raise questions about the objectivity of internal investigators.

Foreign companies also often retain local counsel to assist with investigations, due to language issues and a lack of familiarity with specific Korean legal and cultural issues.

Workplace harassment and sexual harassment must be investigated if there is a complaint or the company otherwise becomes aware of their occurrence.

Otherwise, it is generally up to an employer to decide whether to conduct an HR internal investigation. However, there may be industry-specific regulations requiring investigations under certain circumstances, such as for financial institutions.

There are no legal requirements prohibiting an internal investigation, but there may be circumstances in which it is more prudent to limit or refrain from an internal investigation.

For example, in certain cases where a reporter wishes to stop any further investigation even though there are grounds to believe misconduct occurred, it may be prudent to refrain from further investigation to avoid potential harm to the reporter. It is a delicate and case-specific matter, without clear rules or precedents. In cases of workplace or sexual harassment, it is generally recommended to initiate an investigation, even if the basis is relatively thin, to be on the safe side, given the specific legal requirement to promptly investigate such matters.

In deciding whether to investigate cases where there is no legal obligation, employers typically consider the credibility and seriousness of the accusations and the potential harm that may result from failing to determine the facts. For example, in cases involving coercive behaviour towards vendors in relation to contract renewals – eg, an employee who is responsible for contract renewal is alleged to have requested payments or favours from the vendor – the employer may be at risk of claims from the vendor, under Korea’s fair trade/antitrust laws.

Employers would also consider the potential costs of an investigation and the disruption it could create in the workplace. For instance, in cases involving potential corporate card misuse, a robust investigation may disrupt the sales department. Employers would generally evaluate ways to effectively investigate while minimising disruption to the organisation. For example, a leniency programme could be considered to alleviate the potential panic and costs associated with any investigation.

Employers may also have internal rules and regulations requiring certain kinds of investigations under certain circumstances.

Statutorily, neither the reporter nor the respondent has an explicit right to be informed of whether and when an HR internal investigation will be initiated.

However, if a company’s internal regulations require that the reporter be informed, those regulations should be followed. A major reason for this is that failure to follow internal rules and policies regarding investigations can harm the employer’s legal basis for taking disciplinary action later on.

In practice, it is often prudent to inform the reporter that the matter is under investigation to reduce the risk that the reporter will go to outside authorities before the company has a chance to investigate and take appropriate action.

Even if the reporter is not informed immediately that an investigation has been initiated, they will likely soon become aware, as they are often the first (or among the first) employees interviewed, especially in cases of workplace or sexual harassment.

As for the respondent, it is more customary not to disclose that the investigation has been initiated until the interview with the respondent is expected to take place. The primary reason for such an approach is due to the possibility that the respondent may interfere in the investigation, for example, by reaching out to the reporter or third-party witnesses. This is often a very contested area, where the employer needs to protect the reporter while providing the respondent with a sufficient chance to offer a defence. A typical approach is to interview the respondent last and provide a fair chance to defend their case with sufficient detail, while also issuing a clear warning that the respondent must in no way retaliate against the reporter.

There are generally no requirements to notify governmental authorities of the initiation of an HR internal investigation, and it is uncommon for employers to voluntarily notify them of its opening. However, employers subject to specialised regulations, such as financial institutions, may have particular reporting obligations and practices.

Although voluntary reporting to the authorities is rare, one exception is when there is a complaint of workplace or sexual harassment, and the reporter files a petition with the labour authorities before the company completes its investigation. In that instance, it can be prudent for the company to notify the labour authorities that it is investigating, before being formally instructed to do so; carry out the investigation swiftly; and then report the results to the authorities. This is to demonstrate that the company is complying with its legal obligation to promptly investigate harassment complaints and take appropriate action.

In cases of workplace harassment or sexual harassment, employers are obligated to keep all information related to the investigation confidential. To satisfy this obligation, it is prudent to obtain NDAs from all individuals who provide evidence in the investigation. Typically, the employer will receive an NDA prior to beginning each interview. If the individual refuses to sign it, or if the process of obtaining an NDA is foregone for any reason, the employer should instead instruct the individual that they are obliged to keep the matter confidential, and document that instruction.

If any individual involved in the investigation violates their confidentiality obligations, the employer may take disciplinary action according to its rules and regulations. If such a violation makes the employer liable for any compensation, the employer may, in turn, seek to hold the individual liable; however, in practice, proving causation may be difficult.

It is possible to conduct a preliminary investigation to determine whether a more complete HR internal investigation is necessary. In some cases, a limited form of preliminary investigation may even be advisable. In particular, in cases of workplace harassment or sexual harassment, if the alleged victim does not want a full-scale investigation, the employer might conduct more limited fact-finding with a narrow scope in order to learn what it can while avoiding further harm to the alleged victim and then the employer could determine whether more is needed.

An employer may also carry out a preliminary investigation before deciding whether to proceed with a full-scale investigation if a report is made anonymously or the employer receives information about alleged employee misconduct that is not specific enough to warrant a full-scale investigation. In these cases, the employer may conduct a limited fact-finding inquiry within a reasonable scope and decide whether to proceed further.

Typically, a reporter and a respondent are almost always considered necessary interviewees in an investigation.

Witnesses are usually identified from the complaint itself (or the initial information prompting the investigation) and the reporter’s interview. Typically, anyone who was present at key events described in the complaint, or who is likely to have material information about the conduct at issue, may be a witness. The number of witnesses will ultimately depend on the scope and severity of the allegations and the extent of any key facts that are in dispute, weighed against the required cost, time and potential business disruption.

Employers have limited capacity to compel employees to participate in interviews or actively participate in an investigation.

An employer can urge an interviewee to participate in an interview, and explain that the employee has an obligation to co-operate with the company’s valid exercise of its HR-management power. However, actually disciplining an employee for refusing to be interviewed may be difficult to defend. It may arguably be legally possible, depending on the specific facts and the employer’s relevant policies, but it would typically be risky and not recommendable to discipline an employee for refusal to answer questions in an interview, because it will be difficult to show that the employer’s interest in questioning the employee outweighs the employee’s right to avoid answering questions and defend themselves. In practice, employers might convey that the interviewee’s lack of co-operation could be taken into account in future assessments. The company might also consider an employee’s lack of co-operation as an aggravating factor in determining an appropriate level of disciplinary action if the investigation finds that the employee committed misconduct.

Interviews can be carried out in person or remotely via e-meeting (Teams, Zoom, Meet, etc). Remote interviews are not uncommon in investigations, especially where overseas personnel will attend.

In-person interviews are generally preferable because they allow interviewers to observe the interviewee’s reactions and demeanour, and encourage more fluid, in-the-moment responses.

As an additional note, employees may often try to record their interview. In Korea, an individual generally has the right to record (even secretly) a conversation to which they are a party. However, employers often discourage secretly recording the interview to maintain the confidentiality of the investigation. Preventing recording may be more challenging in practice when conducting interviews remotely.

There are no rules as to how many interviews need to be conducted or by whom.

The number and scope of interviews are generally determined by the information learned from the complaint and the reporter, and by the practical needs of the investigation.

Who should conduct the interviews is influenced by various practical factors, including experience, effectiveness, relationship to the interviewee, and whether the questions include sensitive subject matter (eg, sexual details), but there are no legal rules governing this other than the requirement to conduct workplace harassment investigations “objectively.”

There is no legal requirement to allow any third party to be present at interviews as a witness. The only significant applicable legal requirement is the general requirement to conduct an “objective” investigation in workplace harassment cases.

Even in other investigations, it is prudent to maintain objectivity and avoid any appearance of bias. This does not require that any neutral third party be present during interviews, but it is recommended to have two interviewers present for each interview and to leave detailed notes as a record of the interview. This can reduce the risk of any false claims about what transpired during the interview.

Although not explicitly governed by the law, it is common practice not to allow an interviewee in an HR internal investigation to be accompanied by a support person.

The rationale for this approach is to maintain the confidentiality of the investigation and efficiently complete the interviews with minimal disruption.

Whether interviewees have a right to be accompanied by legal counsel is a frequently discussed topic and there are precedents supporting both positions. However, the more widely accepted position is that there is no right for interviewees to be accompanied by a lawyer in an HR internal investigation.

In practice, it is not uncommon for an interviewee to request to be accompanied by a lawyer, and employers sometimes accommodate such requests. If such a request is denied, the employee may refuse to be interviewed.

There are pros and cons to accommodating such requests. The primary downside is the potential for delay and obstruction during the interview, due to the intervention of the interviewee’s attorney. A potential upside is that, if a dispute arises later, the employer can better show that it has been procedurally fair. There may also be certain instances where having the interviewee’s attorney present may facilitate discussion of very sensitive topics that would otherwise be difficult to question the interviewee about, because the attorney may reassure the interviewee that it is safe to discuss them, albeit this is very situation-dependent.

There is no legal requirement for an interviewer to provide information at the outset or end of the interview. Typically, interviewers may briefly explain the purpose of the interview, confirm that the person is being interviewed voluntarily, and request that the person sign an NDA obligating them to keep information about the investigation strictly confidential.

When interviewing the reporter in a harassment-related investigation, it is also common to convey that the company will ensure that there is no retaliation of any kind in relation to filing a claim. When interviewing an alleged harasser, interviewers also often convey that, regardless of the investigation outcome, they must take care not to take any action that can be perceived as retaliatory.

If an interviewee requests to stop an interview, it is generally prudent to stop. Coercive behaviour towards a reluctant interviewee could result in legal claims (eg, harassment), and could damage the credibility of any interview statements.

Should the interviewee request to stop the interview without a clear, justifiable basis, the interviewer could urge the interviewee to co-operate without coercing them to stay.

It is common to take a break during the interview if it lasts more than two hours, even if the interviewee says they can continue.

There is no legal requirement to prepare minutes of an interview, or any specific form of notes, or to involve any external party or separate department in preparing minutes. However, it is practically necessary to prepare minutes, notes, or other written documentation of what was said in an interview.

One reason good, detailed documentation is practically required is to support any subsequent disciplinary action by the employer. If an employee brings a legal challenge to overturn any disciplinary action, the employer has the burden to prove that it had just cause for the discipline imposed. In practice, employers are held to a very high standard of proof, so clear, detailed written evidence is important.

It is debatable whether employees can review the minutes of their interview. There is an argument that applicable law provides such a right. In practice, however, employers often allow employees to review their interview notes on-site to confirm accuracy. Interviewees are also typically asked to sign an acknowledgement confirming they have read and verified the notes. An employee is not legally required to sign such an acknowledgement, but is often asked to do so to prevent later disputes and strengthen the value of the notes as evidence.

It is a crime under Korea’s anti-eavesdropping law to record a conversation to which one is not a party. But an interviewer can record the interview without violating that law, even without the interviewee’s consent, as a party to the discussion. However, secret recordings could give rise to other types of civil claims for violations of privacy rights, depending on the circumstances.

Collecting information via an interview, including by recording it, may also generally constitute the collection and processing of personal information. Collecting and processing personal information generally requires informed consent, or an applicable exception, under Korean data privacy laws.

In practice, recordings are often made to verify the accuracy of interview notes if they are later disputed. Due to the potential for disputes, it will generally be prudent to notify the interviewee of the recording and refrain if the employee does not consent. Absent a recording, an employer should rely on other means to establish the accuracy of the interview record, such as signed interview notes and/or a second interviewer.

There is no explicit legal ground requiring that an interview transcript be provided to anyone. In practice, interview recordings and transcripts are not shared with interviewees, though an interviewee may be allowed to review them upon request. Employees have a right under Korean data privacy laws to inspect their personal information possessed by the employer. However, this right is subject to limitations, and an employer may decline to disclose sensitive information collected during an investigation on the basis of confidentiality concerns.

In some cases, employers have internal provisions/policies that prohibit employees from recording interviews and failure to comply can be grounds for disciplinary action. In practice, it would be difficult to verify whether the employee is not recording, even if the interview takes place in person (which would make it virtually impossible to deter one from recording). However, giving a clear warning at the outset of the interview that it must not be recorded may deter the employee from doing so. Even if such a warning is issued, the recording will likely still be admissible as evidence in a dispute, though the employee may face disciplinary action or liability for civil damages.

In addition to interviews, investigations often involve a review of relevant documents and a digital forensic review of emails and other electronic data. Digital forensic review is not always undertaken, but in certain cases especially those involving financial or business misconduct and trade secret misappropriation, it can often be the only way to uncover meaningful evidence.

Reviewing employees’ emails or computer data is considered subject to Korean data privacy protections. Korea has very strict data privacy laws, and employees are generally considered to have privacy rights in personal information contained in their work emails and files. To avoid violating data privacy laws, it is customary to have employees complete a data privacy consent form before reviewing their emails and files, thereby allowing the collection of personal information from those sources. Whether to conduct a non-consensual review of emails and files in an investigation is often an important issue that requires careful legal analysis, given Korea’s strict data privacy laws.

To warn against the deletion of electronic evidence, companies may send preservation notices to relevant individuals, and to practically prevent the potential deletion of data, employers may place a relevant employee on garden leave while conducting a digital forensic review, where there is a strong suspicion of wrongdoing.

Employers may also offer a leniency programme, under which the company agrees to reduce or forego any punishment for those who self-report certain misconduct and co-operate with any investigation. This can be useful in cases where employees are aware that the company has already disciplined others or otherwise appears to have evidence.

During investigations into alleged workplace harassment or sexual harassment, the employer has a statutory obligation to take measures to protect the alleged victim, if necessary. Typical measures include a change of workplace or working arrangement, or paid leave. Importantly, the employer should not take any such measures against the will of the alleged victim, so the employer must confirm that any such interim protective measures are acceptable to the alleged victim. Failure to take such interim protective measures as described above carries no explicit legal penalty, but it is a violation of the law and may result in higher fines if combined with other offences.

In sexual harassment investigations, the employer is also obliged to take due care to avoid causing further sexual humiliation to the alleged victim.

After a workplace harassment or sexual harassment investigation is complete and harassment is found to have occurred, the employer must take the necessary protective measures upon the request of the victim. Failure to take necessary post-investigation protective measures may be subject to an administrative penalty of up to KRW5 million. At the same time, employers retain reasonable discretion in determining the specific type and scope of protective measures. For example, even if a victim requests a particular measure such as paid leave, the employer is not strictly bound to implement that exact request. It is generally understood that the employer may determine appropriate measures and their duration by considering factors such as business needs, the nature and extent of the harm suffered by the victim, the victim’s health condition, and any required recovery or treatment period.

Since investigation details must be kept confidential and retaliation against a victim (or alleged victim) or other reporter is prohibited, an employer should also take care to prevent improper disclosure of information about the investigation, or adverse treatment of a victim (or alleged victim) or other reporter.

In other kinds of investigations besides harassment cases, there are no specific requirements to take affirmative protective measures. A reporter may qualify as a “whistle-blower” under Korea’s whistle-blower protection law, but this largely prohibits any retaliation and requires protecting the confidentiality of the report, and does not require taking affirmative protective measures.

In any case, protective measures may be practically advisable to avoid disputes or disruption, and to reduce the risk of any adverse treatment or event that could appear to be retaliation.

There are no specific legal requirements to take protective measures for a respondent. However, it is important for the employer to remain neutral toward the respondent until the allegation is confirmed. Lack of objectivity and reliability in the investigation can undercut the results, making the respondent less likely to accept the conclusions and leaving the employer vulnerable to claims that the conclusions are unreliable. In the case of workplace harassment investigations specifically, the employer may be fined up to KRW5 million for failing to maintain the objectivity of the investigation.

If an employee brings a legal challenge to overturn an employer’s disciplinary action, the employer has the burden to prove that it had just cause. The standard of proof required to establish “just cause” is typically interpreted as being very high. Therefore, except in very exceptional circumstances, employers should not take disciplinary action against a respondent until the investigation is completed and there is sufficient evidence to defend disciplinary action.

If the employer takes any disciplinary action before collecting sufficient evidence to clearly prove the misconduct, the respondent may bring a legal claim alleging unfair disciplinary action. If that claim is successful, the disciplinary action will be nullified. If the circumstances warrant it, a respondent might be placed on non-disciplinary paid administrative leave during an investigation to prevent potential disruption or interference.

There are no specific obligations to take protective measures for other employees. However, an employer is generally considered legally responsible for maintaining a safe workplace and can be held liable for preventable harms to employees, including mental distress.

Additionally, failure to take reasonable precautions may result in unnecessary harm and expose the employer to risk, so it can be prudent to take reasonable measures to prevent foreseeable harm to other employees.

For example, when a high-level executive is accused of harassment, there is a risk that the executive might take actions that could be perceived as:

• retaliation or harassment against a witness; or

• undermine the apparent fairness of the investigation.

Depending on the circumstances, the employer might take actions such as giving an appropriate explanation and instruction to the executive, removing the reporter from the executive’s reporting line, or taking other appropriate measures to protect other employees from any foreseeable harm.

HR internal investigations do not require specific procedural guarantees to be in place. The procedural rights that apply in criminal investigations, such as:

• the right to be informed of the charges;
• the right to remain silent; and
• the right to legal assistance (and the right to exclude evidence obtained in violation of these rights),

do not apply in HR internal investigations.

However, if an investigation appears biased or procedurally unfair, it can weaken the effectiveness of evidence derived from the investigation in any legal dispute, such as a legal challenge against any disciplinary action taken by the employer. An apparently unfair or biased process may also expose the employer to legal claims, such as harassment claims from the subject of the investigation. As discussed, in workplace harassment investigations, it is a statutory requirement to conduct an “objective” investigation.

An employer may have internal policies or regulations governing internal investigations, including procedural requirements and protections for the respondent, such as a right to be notified or to receive specific information about the accusations. Employers also frequently have rules regarding disciplinary procedures, such as requirements to constitute a disciplinary committee and to hold a hearing where the accused employee can present an explanation.

Any such rules must be followed, or it may damage the legal case for any subsequent discipline. If the employer fails to follow its established internal procedures during the investigation or subsequent disciplinary procedures, a court or labour tribunal may find that the process was defective and that any disciplinary action is void.

The employer bears the burden of proof that it had just cause for any disciplinary action or other adverse personnel action. In a civil legal dispute between employer and employee, such as a lawsuit to recover misappropriated funds, the plaintiff has the burden of proof.

Regarding the standard of proof, according to Supreme Court precedent, the degree of evidence required to meet this burden is proof to a “high probability”. In theory, this is a lower standard than in criminal trials. However, in practice, especially in termination cases, the courts and labour tribunals often hold employers to a very high standard of evidence, regarded by some as almost equivalent to the “beyond a reasonable doubt” standard required in criminal trials.

There are no specific legal rules on when an HR internal investigation should be completed, although the applicable laws require that a workplace harassment or sexual harassment investigation must be conducted “without delay”.

In practice, it is generally recommended that an employer conduct the investigation efficiently to minimise workplace disruption and reduce the risk that a reporter will turn to the authorities because of a perceived lack of action by the employer. At the same time, it is generally prudent to be thorough enough to properly resolve the complaint and demonstrate fairness and objectivity.

There are no general requirements for specific procedures to follow when ending an HR internal investigation. If disciplinary action is to be taken, the company’s relevant disciplinary process should be initiated and the reporter would usually be informed that the investigation has concluded and that appropriate action is being taken, as a practical measure.

However, for workplace harassment and sexual harassment cases, there are a few legal requirements if harassment is confirmed to have occurred, as outlined below.

• The employer must take appropriate corrective actions, such as disciplinary action, against the harasser.
• If requested by the victim, the employer must take necessary protective measures.
• The employer must consult with the victim in advance, before taking action against the harasser. The employer does not need to follow the accuser’s requests, but should solicit the accuser’s opinion on what should be done.

There are no legal rules regarding the form in which an investigation’s conclusions must be recorded, unless provided for in the company’s internal rules and policies.

However, in general, an employer should prepare a written report on the investigation findings. This may be practically necessary as evidence in potential disputes. It may also be required in two instances:

• where the labour authorities respond to a complaint that the company has failed to appropriately handle a complaint of workplace harassment or sexual harassment, the company will be expected to share a report showing it conducted an adequate investigation; and
• where the company is subject to special regulations (eg, a financial institution) and its regulator may expect to receive a report of the company’s investigation.

There are no legal rules governing the information to be included in an investigation report.

Typically, a report would contain:

• the accusations subject to investigation;
• the investigative actions taken (such as interviews, document review and digital forensics); and
• the factual findings, together with supporting evidence.

The level of detail varies depending on the likely use of the report, and whether it may be shared with any third party (eg, auditor) or governmental authority.

Reports may often include an analysis of legal risks and recommendations for subsequent actions based on the investigation findings. However, employers sometimes omit legal analysis or recommendations due to sensitivity concerns, particularly when the report may be shared with third parties or governmental authorities.

There is generally no legal requirement to share any particular information with any individuals regarding the outcome of an HR internal investigation.

In the case of workplace harassment and sexual harassment investigations, if harassment is confirmed, the victim has the right to be consulted before the employer takes action against the harasser. However, satisfying this requirement does not necessarily require disclosure of the specifics of the investigation findings.

Employers should not disclose sensitive information related to the investigation carelessly. In workplace harassment and sexual harassment investigations, there are specific obligations to protect the confidentiality of information derived from the investigation. There are general risks associated with disclosing excessive detail about the investigation. For example, there may be a risk of data privacy violations, and there can also be a risk of defamation claims because even true statements can be defamatory under Korean law if they unreasonably damage a person’s reputation.

In general, there is no obligation to report the result of an HR internal investigation to the authorities.

However, it may be required in two instances, as outlined below.

• Where the labour authorities respond to a complaint that the company has failed to appropriately handle a complaint of workplace harassment or sexual harassment, the company will be expected to share a report showing its conduct of an adequate investigation.
• Where the company is subject to special regulations (eg, a financial institution), its regulator may expect to receive a report of the company’s investigation.

There are no specific statutory rules requiring any particular communications about the conclusion of an HR internal investigation to other parties, such as witnesses or co-workers.

Typically, it would be imprudent to disclose any specifics regarding the investigation without the consent of the concerned parties or a justifiable need. There is potential legal liability under Korean data privacy laws for improper disclosure of personal information, and there is also a risk of defamation claims, even for disclosures of true information.

If allegations are substantiated, an employer’s policies or internal regulations should serve as the primary basis for any disciplinary measures, with consideration given to relevant precedents.

In the absence of specific requirements under a company’s internal regulations, a generally fair and objective process should be followed in which an employee subject to discipline is given a fair chance to defend against the allegations.

Common forms of disciplinary action include reprimands, pay cuts, unpaid suspensions and dismissal. A disciplinary pay cut is strictly limited by statute to a very small amount, so it is typically seen as a relatively weak disciplinary action compared to unpaid suspension or dismissal, whereas disciplinary dismissal is seen as a measure of last resort, requiring very egregious or persistent misconduct.

Depending on the findings of the investigation, an employer may take various corrective actions beyond discipline. For example, an employer may improve internal controls to prevent similar violations, provide education to prevent similar acts, provide coaching/training and more.

In general, Korean data privacy laws require informed consent (subject to specific formal requirements) for the collection, processing, and transfer of personal information. Even without specific consent to collect personal data in the course of an investigation, a general investigation may be possible to some extent based on the general data privacy consent an employee would commonly provide when first hired. However, it may be prudent to obtain a separate, specific consent related to the investigation when seeking to proceed more conservatively.

There are certain exceptions where personal data can be collected and used without consent, such as in exigent circumstances or to the minimum extent needed to maintain an employment relationship.

Generally, an employer would be allowed to collect personal data for the purpose of an HR internal investigation, provided it has obtained proper, explicit consent from the data subjects. Under exceptional circumstances, the consent requirement can be waived, but such instances are limited and strictly regulated.

Even when consent is obtained, the employer must ensure that only the minimum amount of personal data necessary for the purpose of the investigation is collected. The burden of proof for demonstrating that the data collected is strictly necessary for the stated purpose lies with the employer.

When collecting and/or processing personal data for an HR internal investigation, the Korean data privacy law must be adhered to as for any other data collection or processing activity. An employer must consider which lawful basis to rely on in order to collect and process personal data (eg, explicit consent or lawful exception).

Korean data privacy law grants data subjects specific rights, including the right to confirm whether their personal data is being processed, as well as the right to access and request the transfer of their personal data. Individuals involved in an HR internal investigation (eg, employees under investigation) are generally entitled to exercise these rights concerning the personal data collected about them during the investigation.

This is not an entirely settled legal area, but an employer may refuse to disclose sensitive information derived from an investigation on the basis that it has a duty to protect the confidentiality of such information. There are multiple bases for such a duty. Korean law specifically provides that individuals involved in investigating workplace or sexual harassment, such as those conducting the investigation, receiving reports or participating in the process, must not disclose confidential information obtained during the investigation to others without the consent of the affected party. Further, other people would have privacy rights respecting their own personal information, which may be contained in investigation-related materials. A data subject’s rights under PIPA (Personal Information Protection Act) may be restricted by these requirements. PIPA also provides a ground to refuse accessing one’s personal data in cases “where access may cause damage to the life or health of a third party, or unjustified infringement of the property and other interests of any other person...”, but the proper application of this exception to HR internal investigations is somewhat unclear.

Additionally, governmental authorities may request access to information obtained during an internal investigation for their investigative purposes. Relevant laws permit the provision of such information in these cases, but the scope of disclosure must be strictly limited to what is necessary to fulfil the purpose specified by the authority.

AI is increasingly being used in investigations. Typical uses include reviewing, selecting or summarising documents and data, and preparing draft interview questions. However, confidentiality and data privacy concerns remain a barrier to the free use of AI tools for investigations. These concerns are being addressed in part by means such as developing internal, closed-system AI tools and by anonymising and redacting sensitive data that will be reviewed by AI.

Although it may be arguable based on the specifics, under Korean data-protection rules, providing individuals’ personal information to an AI service provider for analysis may be construed as an improper third-party provision of personal information, because the AI service provider may use the data for its own purposes. This kind of third-party provision generally requires the data subject’s consent. This contrasts with entrustment of personal information purely for the provision of services, without any independent use by the provider; entrustment does not require consent but is subject to other disclosure and security requirements.

It is worth noting that where fully automated decisions have a significant impact on an individual’s rights or obligations, Korean privacy law requires notice and an opportunity to reject the automated decision and request human intervention. These rules are relatively new, having come into effect on 15 March 2024, and their precise application remains somewhat unclear. But these rules are not widely perceived as directly affecting the typical kinds of AI uses in investigations, which involve sorting and analysing data and drafting materials, rather than making final decisions about people’s rights.

Korea has also passed the AI Basic Act, which will become effective on 22 January 2026. This law is primarily intended to regulate AI developers and AI service providers, and it remains unclear how and to what extent it may affect AI use in investigations.

Korea’s whistle-blower protection law covers “public interest violations”, which refers to acts that harm public health and safety, the environment, consumer interests, or fair competition that are defined as violations of almost 400 statutes. The law provides whistle-blower protections to anyone who reports an actual or likely public interest violation to the relevant employer or organisation, or to a governmental authority.

The whistle-blower protection law prohibits taking disadvantageous measures against a whistle-blower due to their whistle-blowing, interfering with whistle-blowing disclosures, or disclosing a whistle-blower’s identity. Even when a public interest report contains confidential information, the whistle-blower is not deemed to have violated any duty of confidentiality imposed under other statutes, collective agreements, or employment rules. The law also provides mechanisms for the whistle-blower to seek protection from governmental authorities, including protection of their personal safety and mitigation or exemption from liability if the whistle-blower is involved in an illegal act. Furthermore, it allows whistle-blowers to receive monetary rewards from the Anti-Corruption and Civil Rights Commission under certain conditions.

Korean law prohibits workplace sexual harassment. Korean law also has specific rules governing the treatment of sexual harassment complaints by an employer, including obligations to promptly investigate and take appropriate action. An employee who has experienced workplace sexual harassment has a right to request that the employer take appropriate protective measures, such as a change of workplace or paid leave. An employer is also obliged to take due care to avoid causing further sexual humiliation to the alleged victim during the investigation. A victim of workplace sexual harassment must also be allowed to provide their opinion before the employer takes disciplinary action against the harasser. Furthermore, the employer is prohibited from taking any adverse action against the victim on account of reporting or experiencing harassment. The law allows the imposition of fines or penalties on employers who violate these provisions and includes joint penalty provisions that hold both individuals and companies accountable. Virtually identical obligations apply to non-sexual workplace harassment.

Sexual harassment is defined as occurring when “an employer, a superior or an employee causes another employee to feel sexual humiliation or repulsion by sexual words or actions by utilising a position in the workplace or in relation to duties, or providing any disadvantages in working conditions and employment on account of disregard for sexual words or actions or any other demands, etc”.

Meanwhile, sexual violence refers to criminal acts that are far more violent and serious than sexual harassment, such as rape, forcible indecent assault, and the illegal filming or distribution of sexual images. Korean law establishes various obligations for the state, local governments, investigative agencies, and courts to protect victims of sexual violence. Some examples include the following:

• operation of victim counselling centres, protection facilities and designated medical institutions;
• provision of legal counselling and litigation representation support for victims;
• measures to ensure the personal safety of victims and their families; and
• recognition of various special provisions during investigation and trial processes (eg, the introduction of support personnel for victim testimony, relaxed standards for witness examination methods and admissibility of evidence, and court-ordered victim compensation ex officio).

In the past year, with the continued rise in digital sexual crimes driven by technological developments, a statutory amendment was enacted to expand both the authorities responsible for providing support for the removal of illegal recordings and the scope of content eligible for such assistance.

Various forms of discrimination and harassment are prohibited under Korean law.

Discrimination

The most notable forms of prohibited discrimination, subject to meaningful penalties or remedies, include discrimination on the basis of:

• age;
• gender;
• disability;
• nationality; and
• fixed-term, part-time or dispatch-agency status.

Among these, gender discrimination is defined to occur when “an employer discriminates against an employee in employment or working conditions, or takes any other disadvantageous measures without any justifiable reason, on grounds of gender, marriage, status within family, pregnancy or childbirth, etc, (including where, even if the employer equally applies employment or working conditions, the number of men or women capable of satisfying such conditions is remarkably fewer in comparison with the opposite gender, thus putting the opposite gender at a disadvantage, and the said conditions may not be attested to be justifiable) [except where job duties inevitably require a specific gender or where lawful affirmative-action measures are taken].”

Korean law prohibits gender discrimination in employment. It allows for the imposition of fines or penalties on employers who violate these provisions and includes joint penalty provisions that enable both individuals and companies to be held accountable.

If (i) an employee experiences discriminatory treatment (mostly gender based) pertaining to hiring, wages, promotion, terminations; (ii) an employer fails to take adequate actions in relation to workplace sexual harassment; or (iii) an employer takes adverse action on account of experiencing or reporting workplace sexual harassment claims, the affected employee may file a petition for correction, or request mediation or arbitration at the Labour Relations Commission. If an employer fails to comply with a confirmed corrective order after any appeals and challenges are completed or waived, the employee may report the violation to the Ministry of Employment and Labour.

Harassment (Including Bullying and Mobbing)

Korean law prohibits workplace harassment, including bullying, mobbing and related behaviour. Workplace harassment is defined as occurring when “an employer or employee causes physical or mental suffering to other employees or deteriorates the work environment beyond the appropriate scope of work by taking advantage of superiority in rank, relationship, etc. in the workplace.”

Workplace harassment complaints are subject to virtually identical obligations as workplace sexual harassment complaints, including an obligation to promptly investigate, take protective actions during and after an investigation, and take appropriate action against a harasser.

Employers with ten or more employees are required to prepare and file employment rules, and they must include (among other things) anti-harassment provisions in those employment rules.

There are no mandatory special procedures that employers must follow when they become aware of suspected criminal conduct. However, certain laws impose a duty to report to investigative authorities in specific circumstances. For example, there is a legal obligation on the heads of certain financial companies to report employees who violate the law to investigative authorities, with fines for non-compliance. Similarly, the heads of state agencies, local governments, or certain public organisations are required to immediately report incidents of sexual violence occurring within their organisation to investigative authorities, unless explicitly opposed by the victim; and there are fines for non-compliance. Even if the victim or a third party has already filed a criminal complaint, the employer’s duty to report is not waived.

For incidents under investigation by the authorities as a result of an employer’s report or a victim’s complaint, it is customary for employers to initially suspend disciplinary proceedings and, after the investigation results are available, determine the type and severity of disciplinary action based on those results. An employee may be temporarily suspended with pay (or partial pay) if necessary under the circumstances, pending the outcome of an investigation by the authorities.

Even if an employer is not legally obligated to report certain crimes, failure to establish a system for controlling illegal activities through disciplinary procedures or for reporting suspected or actual criminal acts involving employees may expose the company’s directors to liability for breach of their duty of oversight, which may result in damages. Employers should take this into account and implement appropriate measures.

In some cases, voluntarily reporting criminal conduct may result in reduced fines or corrective measures imposed on the company, or even exemption from criminal prosecution. For instance, under the Korean fair-trade law, a leniency programme for cartel behaviour offers such benefits. These considerations should also be factored into the employer’s decision-making.

Under Korean law, certain offences are subject to joint penalty provisions. For example, when an employer takes disadvantageous measures against an employee who reported workplace harassment in violation of the Labour Standards Act, or discriminates against a worker based on sex, marital status, pregnancy, or childbirth in violation of the Equal Employment Opportunity Act, both the individual perpetrator and the corporation or employer may face criminal liability. To be exempted from such liability, the employer must demonstrate that it exercised due care and supervision over the relevant duties to prevent the employee’s violation. The Supreme Court has held that this determination requires careful consideration of multiple factors:

• the legislative purpose of the statute;
• the degree of harm to legal interests expected from the violation;
• the rationale for joint criminal liability;
• the specific circumstances and actual consequences of the violation;
• the corporation’s operational scale;
• the corporation’s capacity to supervise the perpetrator and the nature of their supervisory relationship; and
• any preventive measures the company actually implemented.

However, in practice, companies or employers are rarely exempted from joint liability.

Special procedures are not generally required when conducting a multi-jurisdictional HR internal investigation. Unlike procedures conducted by state authorities, which are strictly limited from the perspective of sovereign protection, HR internal investigations are conducted by private companies and are therefore not subject to the same jurisdictional restrictions.

However, employers must thoroughly understand and comply with the substantive and procedural laws of each applicable jurisdiction to ensure that internal investigations do not violate local regulations. Additionally, when headquarters and subsidiaries located in different countries share information related to internal investigations, particular attention should be paid to safeguarding trade secrets and other confidential information. To protect employees’ privacy, it is also essential to closely review and adhere to the data protection laws of each jurisdiction.

For reference, attorney-client privilege has not traditionally been recognised in Korea, and as a result, communications with external counsel and legal advice obtained during internal investigations could be subject to compulsory seizure during investigations or trials. However, with the passage of an amendment recognising attorney-client privilege by the National Assembly plenary session in January 2026, such risks are expected to be significantly reduced. That said, exceptions may apply where the client has voluntarily consented or where the attorney and the client are found to be in a co-conspirator relationship, and due caution is therefore required.

Another issue that sometimes arises with MNCs is that they may have different and overlapping investigative or disciplinary procedures at the local, regional and global level. It is important to understand all applicable internal rules and ensure that the procedural approach is free of material defects that may invalidate any disciplinary actions taken.

An additional issue in multi-jurisdictional investigations is language. Interviews do not necessarily have to be conducted in the local language. They can be conducted in a foreign language when feasible or through the use of an interpreter. However, it is often most effective to conduct interviews in the local language, especially if the investigation involves sexual harassment or other harassment claims, where understanding the evidence may require a delicate understanding of local culture and the nuances of each word used in the interviews.