Internal investigations in Italy for foreign groups
An internal investigation in Italy has to respect Italian rules on employee monitoring, privacy and criminal procedure. Ignore them, and the investigation can end up working against the company that ordered it. Led by a criminal lawyer, the same work can instead become part of the company's defence.
The trigger varies: a whistleblowing report, an invoice that makes no sense, a serious accident on the shop floor. In each case the group wants the facts quickly, and in a form it can use.
On this page: Italian rules | Confidentiality | How we run it | Summary table | The view of Avv. Soardi | FAQ
Italian rules that shape an internal investigation in Italy
- Employee monitoring: Article 4 of the Workers' Statute (Law 300/1970) limits remote controls. Checks on emails and devices need a legal basis and prior information to staff.
- Opinions: Article 8 of the same Statute forbids inquiries into the political, religious or trade union opinions of employees.
- Privacy: the GDPR and the Italian data protection authority apply to every interview and every file collected.
- Decree 231/2001: what the investigation finds may support the company's defence or the charge against it, so the findings need careful handling from day one.
Whistleblowing adds deadlines. Under Legislative Decree 24/2023 the company must acknowledge a report within seven days and give feedback within three months, while protecting the identity of the person who reported.
Confidentiality of an internal investigation in Italy
Italy does not have a general rule of legal privilege on the common law model. Even so, Italian criminal procedure protects the work of a defence lawyer. Article 200 of the Code of Criminal Procedure covers professional secrecy, and Article 103 limits searches and seizures at the lawyer's office.
Moreover, a lawyer appointed as defence counsel can carry out defensive investigations under Articles 327-bis and 391-bis, with results that a court can use. For this reason we set up the mandate so that the investigation sits inside a defence relationship whenever criminal exposure is possible.
How we run an internal investigation in Italy
- A written mandate from the board, defining scope and who receives the results.
- Preservation of documents and data, before anything is lost.
- Interviews with employees, with the guarantees Italian law requires.
- Review of accounts and processes, with forensic accountants where needed.
- A confidential report, in English, with findings and the company's criminal exposure.
- Remedial steps: changes to the Model, disciplinary action, decisions on reporting to the authorities.
The last step also matters for Decree 231. In fact, remedial action taken in time can reduce the sanctions under Articles 12 and 17, if proceedings follow.
Summary table
| Issue | Rule | What it means |
|---|---|---|
| Checks on emails and devices | Art. 4, Law 300/1970 | Legal basis and prior information to staff |
| Personal data | GDPR | Lawful basis, minimisation, information to the people involved |
| Whistleblowing report | Legislative Decree 24/2023 | Acknowledgment in 7 days, feedback in 3 months |
| Confidentiality | Arts. 103 and 200 c.p.p. | Protection of defence counsel's work |
| Remedial steps | Arts. 12 and 17, Decree 231 | Lower fine and no disqualifications, if taken in time |
The view of Avv. Soardi
The most common mistake is to start interviewing people before deciding who the investigation works for. A report written for the board, for the auditors or for a future defence is not the same document, and choosing late is expensive.
So the first hour goes on the mandate, and only then come the interviews.
FAQ on internal investigations in Italy
Must the company report what it finds to the authorities?
A private company has no general duty to report offences in Italy. However, specific rules apply in some sectors, and reporting can be part of the remedial strategy. We weigh the options with the board.
Can we use group investigators?
Yes, within Italian rules. Group investigators can work alongside us; the Italian part of the work, especially interviews and data collection, follows Italian law.
Can employees bring a lawyer to the interview?
Internal interviews are not police interviews, but fairness protects the value of the results. When an employee may face personal criminal exposure, we tell him so and he can consult his own lawyer.
Offices and first contact
From the offices in Bergamo and Brescia the firm runs investigations at companies throughout Italy, and works with group legal teams abroad in English.
Related services: Model 231 for foreign companies in Italy, external Supervisory Body for Italian subsidiaries, defence of the company in 231 proceedings. Italian version: Internal investigation e audit penale interno.
To discuss a case in confidence, write to info@studiosoardi.com or call +39 035 236659.
Avv. Stefano Soardi - updated on 21 October 2026
