How to Conduct a Workplace Investigation in Italy, Step‑by‑step Guide (2026 Update)

Knowing how to conduct a workplace investigation in Italy in 2026 is now a baseline compliance requirement for every employer operating in the country. Whether triggered by a disciplinary allegation, a harassment complaint, a whistleblowing report or a suspicion of fraud, the investigation process in Italy must satisfy overlapping obligations under the Italian Civil Code, GDPR, collective bargaining agreements and, since early 2026, the expanded protections introduced by Decree‑Law No.62/2026. This guide sets out the full procedure in sequential, actionable steps, together with required documents, realistic timelines, indicative costs and the specific changes employers must implement in 2026. It is addressed to HR managers, in‑house counsel and decision‑makers who need a practical playbook before they act.

Updated to reflect Decree‑Law No.62/2026.

Overview of the Workplace Investigation Process and Who It Applies To

A workplace investigation in Italy is a structured, employer‑led fact‑finding exercise designed to establish whether alleged misconduct, policy breach or unlawful behaviour actually occurred. It sits between the initial receipt of a complaint and any formal disciplinary action. The scope can cover employees, agency workers, contractors and, in whistleblowing scenarios, even third parties who interact with the organisation.

It is critical to distinguish a preliminary investigation from the disciplinary procedure itself. Under Article 7 of the Statuto dei Lavoratori (Law No. 300/1970), an employer may not impose a sanction without first giving the worker an opportunity to respond. The investigation provides the evidentiary foundation for that process but is not, on its own, a disciplinary act. Skipping or compressing the investigation stage is one of the most common grounds on which Italian labour courts overturn dismissals.

Legal risks run in both directions. A poorly managed investigation can expose the employer to unfair‑dismissal claims, GDPR enforcement by the Garante per la protezione dei dati personali, and, under the 2026 framework, administrative penalties for failing to respect whistleblower protections or pay‑transparency obligations. Conversely, failing to investigate at all may constitute a breach of the employer’s duty of safety under Article 2087 of the Civil Code.

Eligibility and Prerequisites for Opening a Workplace Investigation in Italy

Not every complaint warrants a full investigation. The threshold question is whether there is a credible allegation or objective evidence of potential misconduct that, if substantiated, would require corrective or disciplinary action. Employers should also consider whether a legal or regulatory reporting obligation exists, for example, mandatory health‑and‑safety notifications to the Ispettorato Nazionale del Lavoro or criminal‑law referrals where fraud or physical harm is involved.

Who may be the investigator?

The investigator must be impartial. Internal investigators are typically senior HR professionals or compliance officers with no prior involvement in the matter. Where the allegation involves senior management or raises complex legal questions, appointing an external investigator, an employment lawyer or a specialist investigation firm, is the safer course. Italian case law emphasises that the individual who investigates must not also be the decision‑maker on discipline; conflating the two roles undermines procedural fairness and can invalidate a subsequent dismissal.

Preliminary risk assessment

Before opening the investigation, carry out a rapid triage covering immediate safety (does anyone need to be separated from a risk source?), reputational exposure, data‑protection implications (will personal data or special‑category data be processed?) and whether the matter overlaps with a criminal probe. If the police or the public prosecutor are already involved, the employer must avoid interfering with the criminal investigation while still fulfilling its own duty‑of‑care obligations, a balance that usually requires legal advice.

Step‑by‑Step Procedure for a Workplace Investigation in Italy

The steps of a workplace investigation can be condensed into five phases for quick reference: (1) intake, (2) appointment and scoping, (3) evidence gathering and interviews, (4) findings and report, (5) decision and closure. The expanded eight‑step procedure below breaks each phase into distinct, actionable tasks with clear ownership and time expectations.

Step 1, Receive and record the allegation

Log the complaint on a standardised intake form as soon as it is received. Record the date, the identity of the complainant (or note that it is anonymous), the nature of the alleged conduct and any immediate evidence. Where the allegation arrives through a whistleblowing channel, acknowledge receipt in writing within the timeframe mandated by Decree‑Law No.62/2026. Preserve any physical evidence and instruct IT to retain relevant electronic records. Do not delete, overwrite or allow auto‑purge routines to run on potentially relevant data.

Step 2, Appoint investigator and set Terms of Reference

Issue a written appointment letter confirming the investigator’s identity, confirming that no conflict of interest exists, and defining the scope of the investigation in a Terms of Reference (ToR) document. The ToR should specify the allegations to be examined, the individuals to be interviewed, the types of evidence to be reviewed, the expected timeline and the reporting format. Setting a clear scope at the outset prevents scope creep and protects the employer against arguments that the investigation was a fishing expedition.

Step 3, Evidence preservation and data‑protection screening

Work with the Data Protection Officer (DPO) and IT department to identify, preserve and export relevant data, including email archives, access logs, CCTV footage and instant‑messaging records. Italian data‑protection law, enforced by the Garante per la protezione dei dati personali, requires that any processing of employee personal data during an investigation be grounded in a lawful basis (typically the employer’s legitimate interest or a legal obligation). Where large‑scale monitoring or access to employee devices is contemplated, a Data Protection Impact Assessment (DPIA) is mandatory. Chain‑of‑custody documentation must be maintained from this point forward so that evidence remains admissible if the matter proceeds to litigation or arbitration.

Industry observers expect the Garante to continue tightening its enforcement posture on covert monitoring and blanket device searches throughout 2026, making DPO involvement at this stage indispensable.

Step 4, Witness interviews

Prepare a written interview plan listing the witnesses, the topics to be covered and the questions to be asked. Each interview should be conducted in private, with contemporaneous notes taken and, where possible, signed by the witness. Recording an interview requires explicit prior consent under Italian law; absent consent, rely on detailed written notes. Remind each witness of their confidentiality obligations and explain how their data will be processed. For whistleblowing investigation scenarios, take additional steps to protect the identity of the reporting person.

Step 5, Respondent interview

Send the respondent a formal written notice containing a summary of the allegations, the date and time of the interview, and a clear statement of their right to be accompanied by a union representative or a person of their choosing (in accordance with the applicable collective bargaining agreement). Allow adequate notice, a minimum of five working days is standard practice, though the applicable CCNL may specify a different period. If the respondent has been suspended pending the investigation, the suspension letter must state the reason, expected duration and pay status.

Step 6, Analysis of evidence and making findings

Collate all evidence, documents, data exports, interview records, and assess it against the allegations set out in the ToR. The standard of proof in an internal investigation is the balance of probabilities (not the criminal standard of beyond reasonable doubt). The investigator should document their reasoning, noting which evidence was relied upon and which was discounted and why. The output is a written investigation report containing factual findings and, where the ToR requires it, recommended courses of action.

Step 7, Disciplinary meeting, corrective action or closure

The decision‑maker, who must not be the same person who investigated, reviews the report and determines the appropriate outcome. Options range from no further action, through a verbal or written warning, to suspension, demotion or dismissal. Under Article 7 of the Statuto dei Lavoratori, the employer must issue a written disciplinary charge letter (contestazione disciplinare) and give the employee at least five days to respond before imposing any sanction (unless the applicable CCNL provides a longer period). The disciplinary decision letter must set out the sanction, the factual basis and the available appeal routes.

Step 8, Record keeping, post‑investigation monitoring and appeals

Retain all investigation records, the intake form, ToR, appointment letter, witness statements, evidence exports, the final report and the disciplinary decision, in a secure, access‑controlled file. Retention periods should reflect the limitation periods for employment claims in Italy, which can extend to five years for contractual claims and ten years for certain civil‑law actions. Comply with any data‑subject access requests filed by the respondent or witnesses within one calendar month, as required by GDPR. Where the investigation identified systemic issues (e.g., a policy gap), implement and monitor corrective measures.

Required Documents, Investigation Checklist for Italy

Every workplace investigation in Italy generates a defined set of documents. Missing or incomplete records are a frequent cause of procedural failure at tribunal. The investigation checklist below identifies each document, its issuer and key retention notes.

Data‑protection quick checklist: confirm a lawful basis for processing before collecting any personal data; involve the DPO for special‑category data; comply with the Garante’s guidance on proportionality; respond to data‑subject access requests within one month; and retain data only for as long as the purpose requires.

Employer Investigation Timeline in Italy, Key Deadlines

Italian law does not prescribe a single statutory deadline for completing the investigation process in Italy. Instead, case law requires the employer to act within a “reasonable time”, and what is reasonable depends on the complexity of the matter, the number of witnesses, the volume of documentary evidence and whether specialist expertise (forensic IT, external counsel) is needed. Nevertheless, employers should set internal service‑level targets to avoid allegations of delay that could undermine discipline.

For whistleblowing cases governed by Decree‑Law No.62/2026, internal reporting channels must issue an acknowledgment of receipt to the reporting person within the timeframe specified in the Decree. Employers should also be aware that the Decree‑Law No.62/2026 primer introduces mandatory follow‑up obligations within defined windows. Failure to meet these deadlines can trigger administrative sanctions independently of the outcome of the underlying investigation.

Costs of a Workplace Investigation in Italy

Investigation costs vary widely depending on complexity, the number of individuals involved and whether external specialists are engaged. The table below provides indicative ranges that employers should budget for when planning an investigation.

Investigation costs are generally treated as ordinary, deductible business expenses for corporate‑tax purposes. Employers should consult their tax adviser on the treatment of any unusually large one‑off investigation expenditure.

What Changes in 2026, Decree‑Law No.62/2026 and Enforcement Trends

Decree‑Law No.62/2026 is the most significant regulatory development affecting how employers conduct a workplace investigation in Italy in 2026. Its key implications for the investigation process are as follows.

• Enhanced whistleblower protections. Employers must operate mandatory internal reporting channels that allow anonymous or confidential submissions. Acknowledgment of a whistleblowing report must be issued within the timeframe stipulated by the Decree, and the employer must provide feedback to the reporting person on the progress or outcome of the investigation within the follow‑up window. Non‑retaliation protections are strengthened, and any adverse action taken against a whistleblower during or after an investigation is presumed retaliatory unless the employer can demonstrate otherwise.
• Pay‑transparency enforcement overlap. Where an investigation touches on pay discrimination or equal‑pay allegations, the employer’s duties under Italy’s 2026 pay‑transparency compliance framework apply concurrently. Investigators must be careful not to suppress or delay disclosure of pay data that the employee is entitled to receive under transparency rules.
• Limits on intrusive evidence collection. Case law from 2025–2026 has progressively tightened the boundaries on employer access to employee personal devices, covert CCTV monitoring and keystroke logging. The likely practical effect is that employers must route any device‑level forensics through the DPO, document the proportionality analysis and, for matters that may involve criminal conduct, seek judicial authorisation or involve law enforcement rather than acting unilaterally.
• Administrative fines and inspectorate involvement. The Ispettorato Nazionale del Lavoro and the Garante now have broader powers to impose administrative fines where an employer fails to comply with whistleblowing channel obligations or processes employee data unlawfully during an investigation. Early indications suggest that both regulators are increasing the frequency of compliance audits, making it essential for employers to document every procedural step.

Common Pitfalls in Workplace Investigations and How to Avoid Them

• Initiating disciplinary action before completing an impartial investigation. Italian labour courts routinely set aside sanctions where the employer conflated investigation and discipline. Mitigation: always complete and document the investigation under a formal ToR before issuing a contestazione disciplinare.
• Conducting overly broad IT searches or covert monitoring. Blanket device searches without a proportionality assessment violate Garante guidelines and risk evidence being ruled inadmissible. Mitigation: involve the DPO at the outset, define the scope of any data collection in writing and maintain chain‑of‑custody records.
• Failing to protect the whistleblower’s identity. Decree‑Law No.62/2026 treats disclosure of a whistleblower’s identity as a standalone breach. Mitigation: redact identifying information from all documents shared outside the investigation team, restrict file access to named individuals and use the statutory reporting channel infrastructure.
• Missing internal acknowledgment and follow‑up deadlines. Under the 2026 framework, failure to acknowledge a whistleblowing report within the mandated window triggers administrative liability. Mitigation: implement automated acknowledgment workflows and calendar‑based follow‑up reminders.
• Using the investigator as the decision‑maker. Combining both roles creates a procedural‑fairness objection. Mitigation: assign investigation and discipline to different individuals and document the separation in the ToR and disciplinary decision letter.
• Inadequate record retention. Destroying investigation files prematurely can leave the employer unable to defend a subsequent unfair‑dismissal claim. Mitigation: retain all records for at least five years (longer if civil‑law claims with a ten‑year limitation period are possible) and comply with GDPR storage‑limitation principles by restricting access rather than deleting early.

Sources

1. Gazzetta Ufficiale, Decree‑Law No.62/2026 (official text)
2. Garante per la protezione dei dati personali, guidance on employee data and investigations
3. Ministero del Lavoro e delle Politiche Sociali, employer obligations
4. Chambers Practice Guides, HR Internal Investigations 2026 (Italy)
5. K&L Gates, Italy Employer Guide
6. Lexellent, Internal investigations in Italy
7. Global Law Experts, Pay transparency Italy
8. Global Law Experts, Decree‑Law 62 Italy primer