No Entitlement to a Copy of a Compliance Report

Federal Labour Court (BAG), Judgment of 16 April 2026 – 8 AZR 169/25

Internal compliance investigations are a standard instrument in corporate practice to investigate breaches of employment contract obligations. When personnel measures are initiated on the basis of such proceedings, the question regularly arises as to the extent to which the affected individual may demand access to the investigation results. In its judgment of 16 April 2026 (8 AZR 169/25), the Federal Labour Court (Bundesarbeitsgericht – BAG) ruled for the first time on the entitlement to a copy of a compliance investigation final report under Article 15 GDPR, thereby clarifying the limits of the data protection right of access in the context of internal investigations.

Facts of the Case

The plaintiff was employed as a senior executive by the defendant. In early April 2023, the defendant’s ombudswoman informed the compliance department of complaints from three whistleblowers, who independently described the plaintiff’s management style as intimidating, demeaning, disrespectful, and dishonest. The defendant thereupon commissioned a law firm to conduct a compliance investigation, which was carried out from 25 August 2023 to 11 January 2024. Two versions of the final report exist: a preliminary version dated 31 January 2024 containing supplementary legal analyses and client advisories, and a final version dated 6 February 2024 without these components. Both versions contain, in identical substance, a structured summary of the investigation findings as well as the commissioned firm’s assessments of witness statements by named whistleblowers and witnesses.

The plaintiff had been on parental leave since 21 July 2023. On 20 February 2024, the defendant applied to the Trade Supervisory Authority (Gewerbeaufsichtsamt) for approval of a dismissal during parental leave, relying on the results of the compliance investigation. The Trade Supervisory Authority did not approve the dismissal. The plaintiff sought the production of complete copies of the compliance reports in order to be able to verify what statements had been made and stored about her and whether they were accurate.

Decision

The Munich Labour Court (Arbeitsgericht München) granted the claim. On the defendant’s appeal, the Munich Higher Labour Court (LAG München) dismissed the requests for the provision of copies of the compliance reports, but ordered the defendant to grant the plaintiff inspection of the compliance final report. The BAG dismissed the plaintiff’s appeal on points of law (Revision). The decision addresses two central aspects:

No Entitlement to a Complete Copy Under Article 15(1) in Conjunction with Article 15(3) GDPR

The BAG clarified that Article 15(3), first sentence, GDPR does not confer an independent entitlement to the provision of a document as such, but only to the personal data contained therein. While the compliance report did contain personal data of the plaintiff – the concept being understood broadly and encompassing subjective information such as opinions and assessments regarding management behaviour – the report did not contain exclusively personal data: in particular, the legal analyses and client advisories contained solely in the preliminary version of 31 January 2024 did not constitute personal data. A copy of entire documents would only permissable where this is “indispensable” for the effective exercise of GDPR rights, for instance where contextualization of the data is necessary for their comprehensibility. In the case at hand, the BAG denied this requirement: the plaintiff did not need knowledge of the legal analyses in order to exercise her rights to rectification, erasure, or restriction of processing under Articles 16–18 GDPR.

No Entitlement to a Complete Copy Under the Right to Inspect the Personnel File

The BAG also denied an entitlement to make a complete copy of the compliance final report from the perspective of the plaintiff’s right to inspect her personnel file (Section 26(2) of the Senior Staff Committee Act (Sprecherausschussgesetz – SprAuG) and Section 83(1) of the Works Constitution Act (Betriebsverfassungsgesetz – BetrVG)). While the right of inspection in principle encompasses the right to make copies from the personnel file at one’s own expense, it is limited to a reasonable scope. This right does not extend to a complete copy of the entire personnel records. Additionally, the BAG expressed doubt as to whether the legal analyses and client advisories contained in the version of 31 January 2024 can be regarded as part of the substantive personnel file at all.

Practical Guidance

The BAG’s decision clarifies the scope of the data protection right of access in the context of internal compliance investigations and has immediate practical implications for employers.

Employers should, already at the time of commissioning a compliance investigation, ensure that the factual report and interview documentation are kept separate – both organisationally and in documentary form – from the legal assessment and client advisories.

In addition, versions capable of anonymisation and reliable redaction protocols should be prepared at an early stage. The Munich Higher Labour Court has clarified that a failure to anonymize does not justify a blanket denial of access.

Before promising absolute confidentiality to whistleblowers and witnesses, employers must consider the legal limits of the right of inspection.

The use of investigation results for personnel measures – as in this case, the application for approval of a dismissal – increases the likelihood that investigation documents will be classified as part of the substantive personnel file. This applies irrespective of the formal filing location or the engagement of an external law firm. Employers should not assume that the preparation by legal counsel or the mere designation as a trade secret will categorically exclude the report from the right of inspection.

Employers are well advised to consider, already at the planning and documentation stage of internal investigations, the subsequent management of data access and personnel file inspection requests.