Employee cooperation obligations in internal investigations: The boundary between the enterprise’s management rights and employees’ right to privacy
Internal investigations are an important tool for enterprises to verify signs of violations, protect assets, and maintain workplace order. In this process, enterprises often need employees (“Employees”) to provide information, explain matters, or submit documents. Enterprises may also need to inspect devices and accounts used for work.
However, an employer’s rights to manage, direct, and supervise are not absolute. These rights do not mean that Employees must comply with every investigation request. Nor do they automatically allow an enterprise to access every device, account, or item of data used by Employees. Therefore, Employees’ cooperation obligations must be considered within the framework of labor law, privacy rights, and personal data protection laws.
This article analyzes three issues: (i) the basis and scope of the cooperation obligation; (ii) limitations on disciplinary action when an Employee does not cooperate; and (iii) limitations on an enterprise when inspecting devices, accounts, and data. On that basis, the article provides several practical recommendations for enterprises.
1. Cooperation obligations and limitations on disciplinary action
1.1. Basis for establishing the cooperation obligation
Current labor law does not directly provide for an Employee’s obligation to cooperate in an internal investigation. This obligation is indirectly derived from the Employee’s general obligations. Specifically, Employees must perform their employment contracts, comply with labor discipline, and follow the lawful management, direction, and supervision of the employer.1
On that basis, an enterprise may specify the cooperation obligation in its Internal Labor Regulations or internal investigation procedures, which may include the obligation to provide information when an incident arises and the obligation to cooperate in verifying labor disciplinary violations. However, this is neither an independent nor an unlimited obligation. The scope of any request must be based on its lawfulness, the purpose of verification, necessity, and connection with the work. At the same time, the request must safeguard the lawful rights and interests of Employees.
a) Employees under investigation: Non-cooperation does not replace the enterprise’s burden of proof
A core principle of disciplinary action is that the employer must prove the Employee’s fault,2 this burden remains with the enterprise even if the Employee does not provide a statement, does not submit documents, or refuses to cooperate. Therefore, the enterprise cannot rely solely on the Employee’s non-cooperation to conclude that the alleged violation occurred or that the Employee was at fault. Non-cooperation also does not shift the burden of proof from the enterprise to the Employee.
In addition, Employees have the right to defend themselves or to have a lawyer or an employee representative organization defend them. Therefore, the enterprise should distinguish between an Employee exercising the right of self-protection and an Employee failing to cooperate with a lawful verification request. An Employee’s failure to provide a statement or documents adverse to his or her interests does not automatically constitute a separate disciplinary violation.3
This does not preclude consideration of liability for other acts of non-cooperation, provided that the relevant conduct is specifically identified and there is a lawful basis for handling it. In the authors’ view, an enterprise may consider providing in its Internal Labor Regulations that non-cooperation by an Employee under investigation may be treated as an aggravating factor when determining the disciplinary measure for the very violation under investigation. This approach is more appropriate than separating the non-cooperation into an independent violation and imposing an additional disciplinary measure.
Note
The 2019 Labor Code does not provide for the concept of an “aggravating factor” in labor disciplinary action. If the above approach is adopted, the Internal Labor Regulations should ensure that:
- the relevant act of non-cooperation is clearly described;
- it is applied only where the non-cooperation can be established;
- it is not used to restrict the right of defense, compel an Employee to incriminate himself or herself, or replace the enterprise’s burden of proof.
b) Related Employees: The cooperation obligation is linked to work duties and employment responsibilities
For Employees who are not the subject of the investigation, the cooperation obligation is determined by the scope of their work. The enterprise may require them to provide information, documents, or verification support within the scope of their duties, responsibilities, and employment obligations.
Conversely, an enterprise’s request may fall outside the scope of lawfully established employment obligations. In that case, an Employee’s refusal does not automatically constitute a disciplinary violation. If disciplinary action is nevertheless imposed, the enterprise may be regarded as disciplining conduct that is not prescribed in the Internal Labor Regulations, the employment contract, or labor law.4 In other words, the cooperation obligation must be determined on the basis of specific work and obligations, rather than merely by invoking the enterprise’s general management rights.
1.2. Distinguishing non-cooperation from intentional obstruction of an investigation
Not all acts of non-cooperation are of the same nature. A failure to provide a statement, a refusal to answer a question, or a refusal to comply with a request exceeding the scope of employment obligations should be distinguished from active conduct that distorts or obstructs the verification process, such as intentionally destroying evidence, falsifying documents, threatening witnesses, or intentionally preventing access to documents or assets lawfully managed by the enterprise. This distinction helps correctly assess the nature of the conduct. However, labeling conduct as “obstruction of an investigation” does not itself create a disciplinary basis. The enterprise must still identify the specific conduct, prove fault, and assess it against a lawful basis for disciplinary action.
Labor law does not permit disciplinary action against conduct that is not prescribed in the Internal Labor Regulations, the executed employment contract, or labor law. Therefore, internal rules should describe the relevant conduct with sufficient clarity and limits and in compliance with law, rather than using overly broad concepts that may encompass the lawful exercise of Employees’ rights.5
Table 1. Assessment approach for categories of non-cooperation
| Conduct | Assessment approach |
| An Employee under investigation does not provide a statement or documents adverse to his or her interests | Does not automatically constitute a separate disciplinary violation. Does not replace the enterprise’s burden of proving fault. |
| A related Employee refuses a request falling outside the scope of employment obligations | Does not automatically constitute a disciplinary violation.
Disciplinary action carries a risk of violating the 2019 Labor Code. |
| A related Employee refuses a request falling within his or her duties and employment responsibilities | Liability may be considered if the conduct is prescribed in the Internal Labor Regulations, the employment contract, or labor law. |
| Intentional obstruction: destroying evidence, falsifying documents, threatening witnesses | Disciplinary action may be considered if the conduct is specifically prescribed and the enterprise can prove fault. |
1.3. Forms of labor discipline and limitations on applying dismissal
Labor law provides for four (04) forms of labor discipline: reprimand, extension of the salary increase period for no more than 06 months, removal from office, and dismissal. An enterprise should select the disciplinary measure appropriate to the verified violation, based on the applicable legal grounds and in compliance with the corresponding process and procedures.6
An Employee’s non-cooperation or conduct that creates difficulties for an internal investigation does not mean that the enterprise may automatically apply dismissal. Dismissal may only be applied where the violation falls within one of the cases prescribed by law. However, the acts of “non-cooperation” or “creating difficulties for an investigation” in themselves are not among the statutory grounds for dismissal. Therefore, the right to conduct an investigation does not expand the grounds for dismissal. Before deciding on disciplinary action, the enterprise must identify the violation, assess the applicable legal basis, and evaluate the relevant conditions for application.7
For other violations, the enterprise should consider the nature of the conduct, lawful internal rules, and the disciplinary measures permitted by law, and avoid dismissal where there is insufficient basis.
2. Inspection of Employees’ devices, accounts, and data in internal investigations
As analyzed in Section 1, an Employee’s cooperation obligation is always subject to limitations relating to the scope of work and the grounds for disciplinary action. However, in many cases, important evidence is contained in devices, accounts, and electronic data. In such circumstances, the enterprise’s management rights directly intersect with Employees’ privacy rights and personal data protection laws. A request to submit a device or grant access should be assessed based on three factors: ownership, management rights, and the nature of the data.
2.1. Work devices and accounts: Management rights must be linked to purpose and scope
For computers, phones, email accounts, or systems provided and managed by the enterprise, the enterprise may establish appropriate management and inspection mechanisms for work purposes and lawful verification activities. However, any inspection must still be limited by its purpose, scope, and necessity; it must also comply with personal data protection laws and avoid access to unrelated private content.
In judicial practice, the case between Mr. Le Van Tach and Toyota Vietnam is a reference concerning the boundary between an enterprise’s management rights and Employees’ right to privacy. In this case, the Court did not accept Mr. Tach’s claims; in considering the case, the Court referred to internal rules under which the email account provided by the enterprise was to be used solely for work purposes. However, this case is not a precedent and was resolved in a context where personal data protection laws were not as developed as they are today. Therefore, the outcome of the case should not be understood to mean that an enterprise automatically has an unlimited right to access or inspect data on work devices or accounts.8
From 01 January 2026, the 2025 Personal Data Protection Law imposes more specific requirements on the processing of Employees’ personal data, including where data is collected through technological or technical measures in employment management. In the authors’ view, from the perspective of risk management and the principle of personal data protection, even for work devices and accounts provided by the enterprise, access to or inspection of data should only be conducted where there is a clear basis and purpose, the Employee has been informed of the inspection mechanism, and the scope of access is limited to what is necessary and directly related to the matter being verified.
From 01 January 2026, the 2025 Personal Data Protection Law imposes more specific requirements on the processing of Employees’ personal data, including where data is collected through technological or technical measures in employment management. In the authors’ view, from the perspective of risk management and the principle of personal data protection, even for work devices and accounts provided by the enterprise, access to or inspection of data should only be conducted where there is a clear basis and purpose, the Employee has been informed of the inspection mechanism, and the scope of access is limited to what is necessary and directly related to the matter being verified.
2.2. Personal devices and private accounts: No automatic right to compel submission or disclosure of passwords
The law protects the inviolability of private life, personal secrets, family secrets, and the confidentiality of correspondence, telephone conversations, telegrams, and other forms of private information exchange; it also protects the security and confidentiality of correspondence, telephone communications, electronic databases, and other forms of private information exchange. Accordingly, the law does not grant an employer an automatic unilateral right to compel an Employee to submit a personal device or provide access to a private account for an internal investigation. The enterprise should also not treat an Employee’s refusal to comply with such requests as a basis for disciplinary action.9
If there are grounds to believe that a personal device or private account contains relevant information, the enterprise may request that the Employee voluntarily provide specific information, rather than requiring submission of the entire device, disclosure of passwords, or full access.
2.3. Personal data protection during the investigation
In particular, for data collected through technological or technical measures in the management of Employees, the enterprise must ensure that the measures applied comply with law, protect the lawful rights and interests of Employees, and ensure that Employees are informed of the relevant measures.
For data collected by technological or technical measures in the management of Employees, the enterprise must ensure that the measures applied comply with law, protect the rights and interests of data subjects, and are based on provisions in the employment contract, Internal Labor Regulations, or other internal regulations/policies of which Employees have been notified.
For the processing of sensitive personal data such as information concerning private life, personal secrets, family secrets, health, biometric data, location data, electronic identification account authentication information, financial data, and data tracking behavior in cyberspace, the organization must establish rules on access authorization and access restrictions, processing procedures, and security measures.
At the same time, a data subject’s consent must be voluntary and based on the data subject’s clear knowledge of the type of data being processed, the purpose of processing, the data controller or the data controller and processor, and his or her rights and obligations.10 Consent must be expressed clearly and specifically and be verifiable; consent must be determined for each purpose, and silence or failure to respond shall not be regarded as consent.11
These provisions show that internal investigations should be designed as a data processing activity with a defined purpose and limits, rather than as a basis for indiscriminate data collection. The enterprise should clearly determine the scope of data to be accessed, the purpose, the persons authorized to access it, and the applicable security measures.
2.4. Risks of inspecting or processing data beyond permitted limits
Unlawful access to, control of, or seizure of correspondence, email, and other forms of private information exchange may give rise to risks of administrative penalties and even criminal liability. Therefore, the enterprise should limit data access and collection to what is necessary, avoid requesting passwords for personal accounts, indiscriminate copying of data, or disclosure of information to unauthorized persons.12
3. Practical recommendations for enterprises
3.1. Establish an internal investigation procedure that distinguishes categories of Employees
The internal investigation procedure should clearly distinguish two groups: (i) Employees under investigation; and (ii) related Employees. For each request, the enterprise should record its purpose, content, connection with the work, and a reasonable response period. Such records help clarify the scope of the obligation if a dispute arises.
3.2. Separate the fact-finding process from the disciplinary decision
The enterprise should separate four steps: (i) collecting and verifying information; (ii) assessing evidence and identifying the conduct and fault; (iii) considering the grounds for disciplinary action; and (iv) carrying out the procedures and issuing the decision. If an Employee is absent or does not confirm attendance at the meeting, the enterprise must still comply with the statutory process and procedures. The enterprise should not automatically treat such silence or absence as evidence establishing fault.
3.3. Establish a procedure for inspecting work devices and accounts
The enterprise should determine who has authority to request an inspection, the devices and systems falling within the scope of inspection, the purpose of access, methods for preserving data, and confidentiality responsibilities. Priority should be given to relevant work-related data, access should be restricted to authorized persons, and the inspection process should be logged. These principles and requirements should be notified, agreed upon, and recorded in the employment contract or accompanying documents at the time of signing, so that Employees are informed in advance and implementation is facilitated.
3.4. Review internal rules and train personnel conducting investigations
Internal rules on cooperation obligations should identify specific conduct, link it to employment obligations, and comply with legal limitations. Enterprises should avoid broad wording that could be understood as requiring Employees to provide all information, including private information. Personnel directly conducting investigations should be trained on these principles. For complex matters involving sensitive data or a risk of dispute, the enterprise should conduct a legal assessment before collecting data or deciding on disciplinary action.
4. Conclusion
Internal investigations are a necessary tool for enterprises to verify and address issues arising in employment management. However, requiring Employees to cooperate, applying disciplinary measures, or accessing relevant data, devices, and accounts must be carried out on a basis consistent with labor law, privacy rights, and personal data protection regulations.
Therefore, enterprises should establish a clear internal investigation framework that defines in advance the scope of cooperation obligations, the grounds for disciplinary action, and the principles governing access to data. This approach both supports effective verification and handling of violations and helps reduce legal risks while safeguarding the lawful rights and interests of Employees.
Submission date: August 20, 2026
Author of post: Hoa Hua, Nam Nguyen, Trang Pham
Related posts
- Working capacity decrease of under 5%: Employer’s responsibilities and employee’s rights
- Authorization for employees to receive wages: Key considerations for enterprises
Disclaimers:
This article is for general information purposes only and is not intended to provide any legal advice for any particular case. The legal provisions referenced in the content are in effect at the time of publication but may have expired at the time you read the content. We therefore advise that you always consult a professional consultant before applying any content.
For issues related to the content or intellectual property rights of the article, please email cs@apolatlegal.vn.
Apolat Legal is a law firm in Vietnam with experience and capacity to provide consulting services related to Business and Investment and contact our team of lawyers in Vietnam via email info@apolatlegal.com.
Nguồn: https://ift.tt/ckIt6qb
Map: https://goo.gl/maps/JbCF1FiWPuD2Jsnx6
Thông tin: https://www.google.com.vn/search?q=Apolat+Legal&kponly=&kgmid=/g/11jkvqgmw_
Comments
Post a Comment