Access Requests in Internal Investigations: Swiss Federal Supreme Court Clarifies the Limits of Employee Data Access

In decision 4A_504/2025 of 16 June 2026, the Swiss Federal Supreme Court clarified to what extent an employee may obtain access to an internal investigation report containing personal data. The judgment is particularly relevant for employers conducting workplace assessments and compliance reviews. It highlights that an employee’s statutory right of access is substantial, but does not amount to an unrestricted right to inspect an entire investigation report where disclosure would affect overriding interests of other employees.

General Overview: Data Protection in the Employment Context

Under Art. 328b of the Swiss Code of Obligations (CO), employers may process employee data as far as it concerns the employee’s suitability for the employment relationship or is necessary for its performance. The Federal Act on Data Protection (FADP) applies in addition.

Art. 25 FADP grants individuals a right to obtain information about personal data processed about them. However, this right is—as shown in the present case—not absolute. Under Art. 26 FADP, access may in particular be restricted where overriding private interests, including the personality and confidentiality interests of other employees, justify doing so. This determination is especially relevant in internal investigations, where reports frequently contain personal data concerning several individuals.

Facts of the Case

A university professor requested an extension of his appointment to complete an externally funded research project. At the same time, the university commissioned an external lawyer to conduct an assessment of the working environment within his department. The professor and other members of the department were interviewed.

Following the assessment, the university declined to extend the professor’s appointment. The former professor subsequently requested access to the complete investigation report under the FADP.

The university refused full disclosure because the report contained confidential statements and personal data relating to other interviewees.

Key Legal Findings

The Federal Supreme Court confirmed in the present case that a data-access request does not provide a general right to inspect an entire internal investigation file. The right under Art. 25 FADP is limited to personal data concerning the requesting individual.

Where a passage contains information concerning both the requester and third parties, the employer must balance the respective interests under Art. 26 FADP.

Importantly, simply removing names may not be sufficient. In the case at hand, the department was small and the statements contained enough contextual information for the professor potentially to identify individual interviewees despite anonymisation. The Court therefore accepted that their confidentiality and personality interests justified restricting disclosure.

The confidentiality assurances given to interviewees were also relevant. While such assurances cannot automatically override statutory access rights, employees participating in sensitive internal investigations have a legitimate interest in their statements not being disclosed to colleagues or managers without sufficient justification.

At the same time, the employer could not withhold the entire report. The professor was entitled to receive certain sections concerning him personally, including information on the investigator’s mandate and selected passages from the summary and conclusions.

The Court therefore rejected both extremes: neither automatic disclosure of the entire report nor a blanket refusal is appropriate.

 

Practical Significance

The decision provides important guidance for employers conducting internal investigations. We strongly advise considering disclosure risks from the outset rather than only once an access request is received.

Investigation mandates should clearly define the purpose and scope of the investigation, reporting lines and intended recipients. Interviewees should also receive accurate information about how their statements may be used. Confidentiality can be an important safeguard, but employers should avoid promising absolute confidentiality where this cannot be reconciled with statutory disclosure obligations.

When an access request is received, employers should conduct a passage-by-passage review and distinguish between:

• personal data relating to the requester;
• information relating exclusively to third parties; and
• mixed information concerning both the requester and other individuals.

Particular caution is required in small teams. Removing names does not necessarily provide effective anonymisation where individuals can still be identified from their role, reporting line, particular incidents or other contextual information.

In conclusion, employers should consider the potential for later access requests when structuring investigation reports. Separating the mandate, interview material, factual findings, conclusions and recommendations can make it considerably easier to disclose information where required while protecting confidential source material and third-party data.