Workplace Investigations Versus Privacy: Why Investigation Data Does Not Automatically Belong In Personnel Files

Compared with Anglo-American jurisdictions, Germany has traditionally imposed stricter requirements on background checks and the processing of employee personal data. This is due in no small part to the GDPR and the high value placed on the protection of individual privacy rights. As a result, the tension between internal investigations and data protection has been a recurring issue for employers.

Following a recent decision by the Court of Justice of the European Union (CJEU) (CJEU, judgment of 4 June 2026, Case C-312/24, Darashev), it is now clear that personal data may not be retained indefinitely in a personnel file merely because it was originally collected lawfully in the context of an investigation. Once information obtained during a criminal or internal investigation is transferred into a personnel file, this constitutes a new processing purpose and therefore a separate processing activity. In most cases, that activity falls within the scope of the GDPR and requires an