Compliance report: does the employer have to hand it over?

The case

The proceedings were triggered by complaints from several whistleblowers about the management style of a senior employee — intimidating, demeaning, disrespectful. The company instructed a law firm to carry out a compliance investigation lasting several months. The resulting final report listed the allegations, named whistleblowers and witnesses, reproduced the content of interviews partly verbatim and additionally contained a legal assessment by the instructed law firm together with recommendations for action to its client. When the company relied on the results of the investigation to prepare a dismissal, the person concerned demanded a complete copy of the report — based on her right of access under Art. 15 GDPR.

The BAG's decision

The BAG (Federal Labour Court) rejected this claim (judgment of 16.4.2026 – 8 AZR 169/25). According to the court, Art. 15(1) in conjunction with (3) GDPR does not grant an independent right to the document as such, but only to the personal data contained in it. A copy of entire documents or extracts may exceptionally be owed — but only if this is indispensable for the intelligibility of the personal data because they cannot be meaningfully understood without the context. In the court's view, this exception does not apply here: the legal assessment and the advice to the client in the report are not information about the claimant in the first place, but information about how the employer or its advisers assess the legal position. Anyone who wishes to challenge a legal assessment they consider incorrect must do so in the unfair dismissal proceedings themselves — not by way of a data protection detour.

Other legal bases

Nor did the works constitution law right to inspect the personnel file (§ 83(1) BetrVG (Works Constitution Act) or the identically worded § 26(2) SprAuG (Executives' Committees Act)) give rise to a more extensive claim. The right to make copies from one's own personnel file is, in substance, limited to a reasonable extent — a complete copy of all documents is no longer covered by it, irrespective of whether the report is considered part of the personnel file in the substantive sense at all.

Consequences for employers

For employers, the judgment provides practical relief: anyone who documents a compliance investigation properly does not automatically have to disclose to the person concerned the entire legal analysis including the defence strategy. What matters is a clear conceptual separation between the personal data (allegations, witness statements, assessments of the person concerned) and the legal remarks of the instructed law firm — only the former is subject to the right of access. Conversely, for employees: the right of access remains a powerful instrument for finding out what is stored about oneself and how it was collected — but it does not replace inspection of files in civil proceedings or a challenge to a dismissal based on it.