Investigating your own employees, lawfully.

Two tests decide everything

When a Swiss company suspects theft, fraud, a leak or a conflict of interest involving its own staff, the instinct is to start looking. The law does not forbid that. It measures every step against two tests, and a finding that fails either one is often worse than useless — it can hand the employee a claim against the company.

Relevance. Under Article 328b of the Code of Obligations, an employer may process data about an employee only where it concerns that person's suitability for the job or is necessary to perform the employment contract. Anything wider than the working relationship is off-limits, and this protection is mandatory: it cannot be signed away, even with the employee's consent.

Proportionality. Under the revised Federal Act on Data Protection, in force since 1 September 2023, any processing must be lawful, carried out in good faith and proportionate — as much data as the purpose genuinely needs, and as little as possible. Transparency is the default; secrecy is the exception that has to be justified.

What you may monitor day to day

The starting rule is strict. Article 26 ArGV 3 prohibits monitoring and control systems whose purpose is to watch how employees behave at the workplace. Permanent behavioural surveillance, run for its own sake, is not permitted — and because this sits in public labour law, it cannot be fixed with a clause in the contract.

Systems introduced for a different, legitimate reason are a separate question. Where monitoring is genuinely needed for safety, security, quality or organisation, it is allowed — provided it is designed so that it does not impair employees' health or freedom of movement, and provided people are told it exists. Counting output, logging the number of calls in a contact centre, or recording vehicle routes to plan them efficiently can be lawful for those purposes. Turning the same data into a running score of individual conduct is not.

Email, files and company devices

Most internal matters now turn on digital evidence, and this is where good intentions create bad cases. The Federal Data Protection and Information Commissioner's guidance sets a clear order of operations.

• Have a written usage policy first: what business and private use of email, internet and systems is allowed, and what counts as misuse.
• Look at logs and metadata in anonymised or pseudonymised form before anyone is named — you are testing whether there is a problem, not who to blame.
• Move to a specific, identified person only on concrete grounds, and only as far as the suspicion warrants.
• Always choose the least intrusive method that can answer the question.

Content marked or evidently private attracts stronger protection than business correspondence. A concrete suspicion of criminal conduct can change the balance, but it does not switch the proportionality test off. And the device matters: a company-owned or company-managed device, a corporate container on a personal phone, and a purely private device are three different legal situations, not one.

Observation and covert measures

Following, filming or otherwise covertly observing an employee sits at the top of the risk scale. It is only defensible where there is a concrete, articulable suspicion; where less intrusive measures genuinely cannot answer the question; and where the measure is limited in time, place and scope. Even then, it is a court — not the company — that decides afterwards whether the resulting evidence can be used at all.

Two traps recur. Covert monitoring whose real purpose is to watch behaviour runs straight into Article 26 ArGV 3. And surveillance ordered on a hunch, without a documented analysis of why nothing milder would do, tends to produce exactly two things: evidence a court excludes, and a personality-rights claim by the employee against the employer. Where conduct may be criminal, the better route is often to involve the authorities rather than to run the operation in-house.

The decision you write before you start

The single most useful thing a company can do is boring: record the decision in writing before acting. Not for the file's sake — because it is what makes the evidence hold and keeps the measure inside the law. A workable note sets out:

• the specific suspicion, and the evidence already in hand;
• the less intrusive measures considered, and why they are inadequate;
• the permitted scope, duration and locations of what will be done;
• whether employment counsel has cleared it, where the subject is an employee;
• how material will be secured, retained and, on schedule, deleted;
• the point at which the matter should go to the police rather than stay internal.

This is not administrative overhead. It is part of the product — the difference between a finding a board, an insurer or a court can rely on, and one that falls apart on contact.

Where it usually goes wrong

• IT examines a suspect's laptop or mailbox on the live system, altering timestamps and destroying the very evidence the company needs.
• HR interviews too early and asks questions that stray well beyond the job, tainting later accounts.
• Someone takes a "quick look" at a private inbox, and the whole matter is now contaminated.
• Surveillance is ordered on suspicion alone, with no record of why less intrusive steps would not do.
• Everything is kept forever, in breach of the purpose and retention rules.

Each of these is avoidable, and each is easier to avoid before the first step than to repair afterwards.