Disputes Insights #9: Internal Investigations and Data Access Rights – Swiss Supreme Court Clarifies the Limits of Access under the DPA

Internal investigations are formal reviews conducted by companies and other organisations to establish the facts surrounding suspected misconduct, legal or regulatory violations, or breaches of internal policies. They serve to identify and address potential wrongdoing, mitigate legal, financial, and reputational risks, inform strategic decisions, and enable the implementation of appropriate remedial actions.

Such investigations frequently involve interviews with employees and other individuals whose willingness to provide open and candid information may depend on an expectation that sensitive information will be handled with appropriate confidentiality. At the same time, information obtained during such interviews may constitute personal data relating to other individuals. This gives rise to a typical tension in internal investigations: between the organisation's interest in conducting an effective investigation, the confidentiality and personality interests of interviewees and other third parties, and the data protection rights of individuals concerned by the investigation.

Against this background, an important question arises under Swiss data protection law: to what extent can an individual obtain access to information provided during confidential interviews, related interview records, or an investigation report containing personal data concerning them?

In its decision 4A_504/2025 of 16 June 2026, the Swiss Federal Supreme Court provided important guidance on the limits of the statutory right of access under the Swiss Federal Data Protection Act ("DPA"). The Court emphasised that access rights remain subject to overriding confidentiality interests of third parties.

Data Access Rights Have Limits

The case concerned an internal investigation conducted by the Graduate Institute of International and Development Studies (IHEID) in Geneva.

An external attorney was retained to conduct an internal investigation into the working climate and possible dysfunctions within an academic department. At the time, a long-serving professor in the department had requested a further extension of his appointment beyond retirement age. While the investigation was not specifically directed at him, matters concerning him were addressed, and the report was also relevant to the question of whether his appointment would be further extended. Numerous professors and staff members were interviewed under assurances of anonymity and confidentiality, and their statements formed a basis of the investigation report. After the investigation, the professor sought access to the investigation report, contending that it contained his personal data.

The institution refused. It maintained that disclosure would compromise the confidentiality promised to interviewees and violate the personality rights of third parties.

The DPA Does Not Create Unlimited Access Rights

The Court reaffirmed the well-established principle that the right of access under Articles 25 et seq. DPA serves an important transparency function. Individuals are entitled to know whether personal data concerning them is being processed and to obtain the information necessary to exercise their rights under data protection law.

The Court emphasised, however, that the DPA's broad right of access is not without limits.

The right of access extends only to personal data concerning the requesting individual. It does not create a general entitlement to inspect internal files or obtain documents merely because they contain some references to the requesting individual.

As a result, organisations remain entitled, and indeed required, to protect information relating to other individuals. Where personal data relating to the requesting individual and personal data relating to third parties cannot be separated, the competing interests must be balanced in accordance with Article 26 DPA.

Protection of Confidential Interviews

In the present case, the interviewees had been promised anonymity and confidentiality. The Court attached considerable weight to those assurances. It accepted that even extensive redactions may not adequately protect the identity of interviewees in a specialised or close-knit environment. In this case, the relatively small size of the department and the professor's long-standing familiarity with the department meant that interviewees could potentially have been identified through contextual information even if their names had been redacted.

Against this factual background, the Court therefore held that the institution was entitled to withhold entire sections of the report containing statements and the investigator's detailed analysis.

In doing so, the Court recognised that the confidentiality and personality interests of employees and other participants who provide information during internal investigations may constitute overriding third-party interests. However, confidentiality assurances do not automatically defeat an access request: the competing interests must be assessed in the circumstances of the individual case, including whether measures such as anonymisation can adequately protect the third parties concerned. In this respect, the Court referred to its earlier decision 1C_375/2024 of 1 May 2025, in which it upheld access restrictions because redaction would not have been sufficient to preserve anonymity in the circumstances of the case.

No Access Through Procedural Backdoors

The claimant also argued that he should be given access to the report based on his procedural right to be heard in the present litigation, or that access should have been granted to his lawyers subject to confidentiality restrictions ("attorney’s eyes only").

The Court rejected these arguments. It held that granting access to the report on the basis of the procedural right to inspect the court file would effectively prejudge the merits of the access request itself.

The Court also rejected access limited to the claimant’s counsel. It considered such an arrangement impracticable in the circumstances, as counsel would need to address the contents of the report when representing the claimant, potentially revealing the protected information indirectly.

What Must Be Disclosed?

Importantly, the Court did not endorse complete secrecy.

In this case, the claimant was granted access to selected portions of the report concerning his personal data, including information sufficient to understand why the information had been collected and portions of the report's conclusions relating to him.

By contrast, information which did not constitute his personal data – such as certain information regarding the interviews themselves – did not fall within his right of access merely because it appeared in the investigation report.

The Court emphasised that statements concerning the claimant could also constitute personal data of the individuals who made them. In this case, the interviewees' confidentiality and personality interests outweighed claimant’s interests with respect to substantial portions of the report.

Key Takeaways: Confidentiality and Access in Internal Investigations

The decision has important implications for organisations conducting internal investigations. In light of the Court’s reasoning, organisations should consider the following:

• clearly define the purpose and scope of the investigation at the outset;

• establish and communicate confidentiality protocols in advance;

• carefully document any assurances given to interviewees;

• structure reports to distinguish statements obtained during interviews from conclusions where possible;

• anticipate future access requests by considering how competing privacy interests may be assessed;  

• recognise that anonymisation is not enough if identification remains possible through context; and

• be aware that confidentiality assurances alone do not automatically exclude access rights and that any restriction should be based on a concrete assessment of the competing interests and the proportionality of the restriction.

The decision addresses access rights under data protection law. It does not address the separate question of what information may have to be disclosed or otherwise made available under employment law, for example where findings from an internal investigation are relied upon as a basis for measures affecting an employee. Any disclosure obligations arising in such circumstances must therefore be assessed separately.

Conclusion: Confidentiality and Data Access Rights in Internal Investigations

The decision confirms that Swiss data protection law affords individuals a broad right of access to their personal data, but not a general right to inspect internal investigation files.

Where disclosure would reveal confidential statements, compromise anonymity, or infringe the legitimate interests of third parties, those competing interests may, following the balancing exercise required by the DPA, justify restricting or even refusing access to particular personal data.

For organisations, the decision confirms that confidentiality interests arising in internal investigations may justify restrictions on data access rights where overriding third-party interests are at stake. For employees and other individuals seeking access to investigation records, the decision underscores that the DPA promotes transparency but does not guarantee access to the entire investigation file.

Decision: Swiss Federal Supreme Court, 4A_504/2025, 16 June 2026