How to Conduct Internal Investigations in Germany (2026): Practical, Step‑by‑step Guide

Internal investigations Germany present a demanding intersection of criminal law, employment protections, data privacy and professional privilege. Thes are currently not expressly regulated by law. Their
framework is derived only indirectly and in a general sense from a series of legal provisions and remains controversial in many respects.Ongoing debate and professional guidance have refined the standards for how companies handle employee interviews, preserve evidence and document legal advice, making an out-of-date playbook a genuine liability. This guide sets out a defensible, step-by-step procedure for German corporate internal investigations, written for compliance officers, general counsel, managing directors and D&O advisers who must either open a probe or respond to one under pressure. It combines statutory grounding, StGB, StPO, HinSchG, BDSG and GDPR, with practical checklists, a role matrix, timing tables and realistic cost ranges.

Read it as a regulator-style procedural reference, not a marketing brochure.

Overview, What this guide covers

This guide addresses corporate internal investigations in Germany where the underlying conduct may carry criminal or regulatory consequences: fraud, corruption, embezzlement, accounting manipulation, tax offences, sanctions breaches or data misuse. It assumes an audience that must act quickly and defensibly, balancing the need to uncover facts against employee rights, works council co-determination and data-protection constraints. The emphasis throughout is on producing an evidentially sound record that survives later scrutiny by prosecutors, regulators or a court.

The deliverables are practical: a numbered workflow, a Step/Who/Duration timeline table, a required-documents table with privilege flags, deadline guidance, cost ranges and a privilege-versus-confidentiality comparison. Each section is designed to be lifted directly into an investigation protocol.

When to use this guide

Use this guide when a credible trigger, a whistleblower report under the Whistleblower Protection Act (Hinweisgeberschutzgesetz, HinSchG), an audit finding, a regulatory contact, a dawn raid or a suspicious transaction, creates a reasonable basis to investigate. It is equally relevant where you are stress-testing an existing compliance investigation Germany framework before a crisis arrives. It is not a substitute for tailored legal advice on a live matter.

Outcomes and possible escalation paths

An internal investigation in Germany can resolve along several paths. The most common is internal remediation: disciplinary measures, control fixes and policy updates with no external disclosure. A more serious matter may warrant voluntary disclosure to a regulator, or contact with the public prosecutor, where cooperation may be taken into account at sentencing or in the exercise of prosecutorial discretion. In tax matters, a formal self-disclosure (Selbstanzeige) mechanism exists under the Fiscal Code (Abgabenordnung, AO). The chosen path should always follow, not precede, a sober legal assessment of exposure under the German Criminal Code (Strafgesetzbuch, StGB), the Code of Criminal Procedure (Strafprozessordnung, StPO) and the Act on Regulatory Offences (Ordnungswidrigkeitengesetz, OWiG).

Eligibility, When to open an internal investigation in Germany

The threshold question is whether you have moved from vague concern to reasonable suspicion. Information-gathering, clarifying an anomaly before deciding anything, is not yet a formal investigation. Once specific facts point to possible wrongdoing by identifiable persons, corporate internal investigations Germany obligations engage, and you should preserve evidence and involve counsel immediately.

Quick risk triage checklist

• Source credibility. Is the trigger a documented whistleblower report, an audit exception, a regulator letter or an anonymous tip? A whistleblower investigation Germany channel under the HinSchG carries statutory handling and protection obligations.
• Potential offence. Does the conduct plausibly fall under StGB provisions (fraud, breach of trust, corruption) or tax law?
• Scale and duration. Isolated incident or systemic pattern across periods and jurisdictions?
• Evidence volatility. Is there a real risk of data deletion, document destruction or witness coordination?
• Regulatory exposure. Are supervisory or prosecutorial authorities already aware, or likely to become aware?

Assessing criminal exposure & D&O risk

German law does not currently have a general corporate criminal statute in the common-law sense. Instead, companies face administrative fines and confiscation of proceeds primarily under the Act on Regulatory Offences (OWiG), while individual directors and officers face personal exposure under the StGB, and the StPO governs how evidence is gathered and how authorities may search and seize. Managing directors carry organisational duties: a failure to investigate a credible red flag can itself become a breach-of-duty allegation and a director-and-officer liability driver. This is why the eligibility decision should never sit with business management alone, legal input belongs in the triage from the first hours.

Step‑by‑step internal investigations Germany procedure

The internal investigation procedure Germany workflow below is expressed as seven sequential steps. Each has a lead role, supporting roles and a realistic duration. Treat the durations as working spans for a mid-size matter; complex, cross-border probes run longer. The mandatory timeline table follows the narrative.

1. Step 1, Initial intake and triage (1–3 days). Record the allegation precisely (who, what, when, source). Issue an immediate legal hold to preserve documents and data. Assign a single lead investigator and, critically, obtain an early legal-privilege assessment so that sensitive analysis is structured to attract protection from the outset. Where the matter may become adversarial or criminal, engage external counsel at this stage. Determine what the company’s interests are, and seek advice on whether and how those interests can be addressed. Clarify who who commissioned the internal investigation.
2. Step 2, Scope and strategy (3–7 days). Define the issues, the persons of interest and the evidence universe (IT, finance, HR, procurement). Draft a written scope memo that governs the investigation without over-committing. Complete a data-protection analysis: identify the personal data you will process, the lawful basis under the GDPR and the Bundesdatenschutzgesetz (BDSG), and set proportionality and retention limits before collection begins.
3. Step 3, Evidence preservation and forensic collection (3–21 days). Instruct qualified forensic specialists to image devices with cryptographic hashing, maintain a chain-of-custody log and capture cloud and collaboration data, email, shared drives, and messaging platforms such as Slack or Teams. Access logs and system metadata are often decisive. Defensible collection matters: evidence gathered without documented integrity risks being challenged if the matter reaches court.
4. Step 4, Witness and employee interviews (1–14 days). Plan and conduct interviews once the documentary picture is sufficiently developed. This step carries the highest procedural risk and is addressed in detail below.
5. Step 5, Analysis and legal assessment (7–21 days). Review the collected evidence against the alleged offences, quantify criminal and regulatory risk, and conduct a privilege review of every analytical work-product. External counsel should lead so that legal memoranda are created in a privileged posture. This is where facts become a legal position.
6. Step 6, Reporting and remediation (7–30 days). Prepare the internal report and a remediation plan (controls, discipline, restitution, policy changes). Decide, with counsel, whether to approach a regulator or the public prosecutor. In tax matters, weigh a formal Selbstanzeige. The report should distinguish clearly between privileged legal advice and factual findings that may need to be shared.
7. Step 7, Closure and records retention (ongoing). Archive materials under a defined retention policy, close the legal hold only on counsel’s advice, update policies and controls, and deliver targeted training so the same failure does not recur.

Step 4 in depth, employee interview rights Germany

Interviews are where legal, employment and data-protection risks converge. Plan each interview deliberately: decide who will be interviewed and in what order (typically peripheral witnesses first, key subjects last), where the interview will take place, and whether external counsel will attend to advise the company.

Employee interview rights Germany considerations are distinct from common-law expectations. Employees generally owe a duty to cooperate with legitimate internal inquiries arising from the employment relationship, but this duty is not unlimited, and self-incrimination concerns can arise where conduct may also be criminal. Counsel conducting the interview acts for the company, not the employee, this must be made explicit at the outset (a warning adapted to German practice, comparable to the common-law Upjohn warning) so the interviewee is not misled about whose interests are represented.

Works council co-determination is a frequent trap. Under the Works Constitution Act (Betriebsverfassungsgesetz, BetrVG), the works council (Betriebsrat) has participation and co-determination rights that can extend to investigation-related measures affecting employees, and an employee may in certain circumstances be entitled to request works-council representation. Ignoring these rights can render disciplinary outcomes vulnerable and sour employee relations for the wider probe.

Sample interview checklist, do’s and don’ts

• Do prepare a written interview plan with the key documents and a timeline.
• Do deliver a clear statement that counsel represents the company, not the employee.
• Do grant employees being interviewed the right to remain silent, in
  accordance with the provisions of criminal procedure.
• Do give interviewd employees the opportunity to be accompanied by
  an attorney. The employees being interviewed are not entitled to be accompanied by a member of the works council or by any other representative.
• Do inform the employees being interviewed that the documentation of their
  interview may, if necessary, be forwarded to (law enforcement) authorities or
  seized by them.
• Do provide the interviewed employees with a copy of the interview transcript
  and give them the opportunity to add to it. File the additions together with the documentation. 
• Do record accurately and confirm the interviewee’s account before closing.
• Do observe works council and data-protection obligations from the planning stage.
• Don’t promise confidentiality or immunity you cannot deliver.
• Don’t apply coercion or improper pressure, it undermines both admissibility and fairness.
• Don’t circulate interview notes widely, which erodes any privilege claim.

Required documents

Documentation is the backbone of a defensible internal investigation. Each artefact should be created with its evidentiary function and privilege exposure in mind. The table below sets out the core documents, why they matter and whether they carry privilege risk.

Legal privilege

Statues of limitations

Limitation periods for economic offences are set by the StGB and vary with the offence and its statutory maximum penalty. More serious offences carry longer periods, and limitation can be interrupted by defined prosecutorial acts. Because the analysis is offence-specific and fact-sensitive, confirm the applicable period with counsel before assuming a matter is time-barred, a misjudgement here can be costly.

When to consider urgent escalation to law enforcement

Escalate promptly where there is ongoing loss, imminent evidence destruction outside your control, or a legal obligation to report. Escalation is a legal decision balancing potential cooperation benefits against the loss of narrative control, and it should follow, not replace, the internal legal assessment.

What may change, evolving standards & practical impact

Reform debate continues to push German practice toward greater formality and clearer boundaries. The recurring themes are threefold: clearer articulation of employee rights during interviews; more sharply defined limits on legal-professional protection for in-house and external counsel communications; and stricter, better-documented evidence-handling protocols. An earlier legislative attempt to introduce a dedicated corporate sanctions regime (the proposed Verbandssanktionengesetz) did not enter into force, so companies should treat these as evolving professional standards and policy positions rather than enacted statutory change, and track official materials as they are published.

The likely practical effect is that compliance teams will need to document legal advice more rigorously, keep more formal interview records, and involve the works council earlier and more explicitly. These expectations are increasingly used as benchmarks by which prosecutors and courts assess whether an internal investigation Germany process was conducted properly. Building the discipline now is cheaper than retrofitting it under scrutiny.

Conclusion & practical next steps

Conducting internal investigations Germany well in 2026 comes down to three immediate actions: triage and preserve evidence promptly after a credible trigger; engage specialist counsel early so that protection and strategy are safeguarded from the outset; and standardise your process using a tested checklist and role matrix.

Sources

1. Strafgesetzbuch (StGB), German Criminal Code
2. Strafprozessordnung (StPO), German Code of Criminal Procedure
3. Ordnungswidrigkeitengesetz (OWiG), Act on Regulatory Offences
4. Abgabenordnung (AO), Fiscal Code (self-disclosure/Selbstanzeige)
5. Gesetz zum Schutz von Hinweisgebenden (HinSchG), Whistleblower Protection Act
6. Bundesdatenschutzgesetz (BDSG)
7. GDPR (Regulation (EU) 2016/679), EUR-Lex
8. Betriebsverfassungsgesetz (BetrVG), Works Constitution Act
9. Rechtsanwaltsvergütungsgesetz (RVG), Lawyers’ Remuneration Act
10. Bundesrechtsanwaltskammer (BRAK), German Federal Bar
11. Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI)
12. Bundesgerichtshof (BGH), decisions/search portal