Internal Investigations in China After Suspected Employee Misconduct: The First 72 Hours

1. Scope: a credible signal is not a finding of crime

This guide is for businesses operating in Mainland China that receive a credible allegation involving an employee, manager, intermediary or transaction—such as commercial bribery, embezzlement, fraud or falsified records. It is not a substitute for criminal defence once an individual or company enters formal proceedings, and it does not attempt to cover every special rule for supervision investigations.

A hotline report, unusual payment or email fragment may justify preservation and review, but it does not establish intent, unlawful appropriation, corporate attribution or an offence. Frame the mandate as testable questions: who authorised what, where value moved, what business advantage followed, and which records support or contradict each account.

2. First six hours: preserve native evidence and separate continuity controls

Issue a targeted hold covering relevant custodians, email, workplace messaging, phones, cloud storage, payments, expenses, contracts, company chops and access logs. Preserve native files, metadata, system logs and integrity information where practicable. Screenshots and converted PDFs may omit source, time and context.

Dual approvals, proportionate access restrictions and physical counts may be needed to stop further payments, asset movement or unauthorised chop use. Do not reimage devices, purge accounts, alter history or let a potentially involved custodian export the only copy. PRC electronic-evidence rules emphasise extraction records, inventories and integrity—disciplines that also make an internal collection explainable later.

• Map custodians, systems, devices, accounts and deletion dates
• Record every collection, transfer, seal and access event
• Keep continuity-control records separate from evidential copies
• Suspend auto-deletion, archive purges and device resets

3. By 24 hours: identify the corporate client and any individual conflict

The investigation should report to directors, audit or compliance personnel not implicated by the allegation. If the legal representative, controlling shareholder, general manager, legal head or original sponsor is involved, reset the mandate and reporting line. Company counsel acts for the company and does not automatically represent an employee under review.

The PRC Lawyers Law imposes confidentiality duties concerning state secrets, commercial secrets, privacy and information a client does not wish to disclose, subject to statutory exceptions. That duty should not be equated with an automatic common-law privilege over every email, interview note or consultant report. Define the client, purpose, labels, recipients and likely disclosure scenarios at the outset, and arrange separate advice when interests diverge.

4. HR necessity permits some processing, not unlimited employee surveillance

Article 13 of the PIPL permits personal-information processing necessary for HR management under lawfully established workplace rules or a collective agreement. Purpose limitation, minimisation, transparency, security and retention rules still apply. Financial accounts, location, health and biometric information may be sensitive personal information requiring stricter necessity and safeguards.

Before searching, record the purpose, custodians, keywords and date ranges; exclude obviously irrelevant private material and limit downloads and onward circulation. Any disciplinary or dismissal step should also test whether the workplace rule was lawfully made and communicated, whether the evidence fits it and whether the response is proportionate. An investigation conclusion does not replace employment procedure.

5. Overseas headquarters access is a separate China data-export question

Uploading employee mailboxes, interview notes or payment records to an overseas e-discovery, hotline or compliance platform may amount to providing personal information abroad. Even where a cross-border HR exemption applies, notice, personal-information protection impact assessment, minimisation and security duties may remain. Important data and statutory volume thresholds require separate checks of security assessment, standard-contract or certification routes.

A safer sequence is to map and narrow the review set in China, then decide what fields the overseas team genuinely needs, whether redaction or de-identification works and which lawful transfer route applies. Group ownership or lawyer involvement is not, by itself, a transfer mechanism.

6. Interview from stable facts inward, rather than confronting the main subject first

Start with the reporter, process owners and peripheral witnesses, then use the documents to decide whether and when to interview the central subject. Explain the interviewer's identity, whom the interviewer represents, the purpose and the limits of confidentiality. Do not impersonate an authority, unlawfully restrict movement, threaten or coach an account.

Notes should separate what the witness said, what documents show and what the investigator infers, while recording materials shown and corrections offered. Do not convene witnesses to align stories or broadcast untested accusations. If an employee is already a suspect or an authority requires secrecy, PRC criminal counsel should set the next communication step.

7. When an authority approaches: verify the instrument, power, scope and deadline

For a call, production notice, assistance request or inspection from public security, a procuratorate, market regulation, customs or another body, record the authority, officer, case number, document, deadline and requested data. PRC counsel should verify power and response route. Physical, documentary, audio-visual and electronic evidence entering criminal proceedings is subject to statutory collection and review rules.

Do not conceal, destroy or alter material. Equally, do not deliver unrelated employee privacy, trade secrets or overseas datasets wholesale before checking scope. Restrict internal notice where the process lawfully requires secrecy. External communications should use verified facts and avoid promises about liability, outcome or leniency.

8. A 72-hour decision matrix for four recurring fact patterns

If conduct is continuing and money or safety is at risk, impose proportionate controls while preserving records. If the allegation is credible but incomplete, run a narrowed review and peripheral interviews without labelling a crime. If an authority is formally involved, make procedure and independent PRC advice the main workstream and pause duplicative interviews that could contaminate evidence. If headquarters needs data, classify it and settle the export route first.

A police report or regulatory approach is case-specific. Relevant variables include known facts, possible corporate exposure, continuing harm, mandatory reporting duties, evidence integrity and effects on PRC and overseas proceedings. Neither automatic leniency for self-reporting nor safety through purely internal handling should be promised.

• 0–6 hours: hold records, stop automatic deletion and contain continuing payment or access risk
• 6–24 hours: settle authority and conflicts; build evidence and data maps
• 24–48 hours: narrow the review and interview peripheral witnesses
• 48–72 hours: decide separately on controls, employment, export, reporting and authority response
• Throughout: preserve reasons, contact logs, inventories and integrity records

9. When targeted legal advice should be urgent

Urgent PRC advice is warranted where an employee has been taken away or summoned, an authority demands devices or data, senior management or company benefit is alleged, overseas payments or headquarters collection are involved, state secrets or important data may be present, or key accounts face imminent deletion. Criminal, employment and data counsel should have defined roles, coordinated with foreign counsel where necessary.