How to conduct an internal investigation in an international group (Hong Kong, Mexico, China, Africa) without breaching local law and data transfer rules?

Updated 9 November 2026

Key contacts: Pascal-André Gérinier (Lawyer - Founder), William Mak (Lawyer - Founder)

Each subsidiary investigates under its own employment law and data protection law: the French method cannot be exported as it stands. Three questions before starting: who decides and who interviews the witnesses, the local entity or the parent company; which data may leave the country, since Hong Kong, Mexico and China benefit from no adequacy decision within the meaning of the GDPR and China subjects transfers to its own law; which confidentiality protects the work, from French legal professional privilege (secret professionnel) to Hong Kong's legal professional privilege, with no procedural protection in China. And one French rule: the Blocking Statute of 26 July 1968 prohibits, subject to applicable treaties and legislation, the direct transmission to a foreign authority of documents of an economic, commercial, industrial, financial or technical nature intended to serve as evidence, which may cover some of the documents in an investigation.

Key points

• The subsidiary is a separate legal entity: the parent company has no direct power over its employees; it acts through the subsidiary's bodies.
• Interviews follow local employment law; interview records follow local data protection law before they can be transferred.
• As a precaution, raw data remain in the country; only pseudonymised summaries circulate, which remain personal data and travel under intra-group clauses.
• The confidentiality of the work varies: legal professional privilege in France, privilege in Hong Kong, limited protection in Mexico, a lawyer's duty of discretion without procedural protection in China.
• No direct response to a foreign authority requesting evidence without prior analysis: Blocking Statute on the French side, authorisation required on the Chinese side.

An investigation conducted in an international group is not governed by a single law. Each subsidiary has its own employer, its own employment obligations, its own confidentiality rules and its own constraints on personal data. Cultural differences also weigh on interviews and on the way sensitive facts are reported. A procedure designed in France may produce, elsewhere, evidence that is difficult to use, expose the company to a local offence or disregard the protection of an employee. An irregular data transfer aggravates these risks. The French method is therefore a starting point to be adapted, not a model to be reproduced as it stands.

1. Governance: who decides, who investigates, who receives the report

A subsidiary is a separate legal entity, with its own employer, its own bodies and its own law. A parent company that wants to shed light on facts that occurred in Hong Kong, Mexico City or Casablanca does not have, in its capacity as shareholder alone, the power to summon its subsidiary's employees: it has the investigation decided by the subsidiary's bodies, which mandate the investigator, or receives a written delegation from the subsidiary, and the investigator remains coordinated with the group team. An engagement letter per entity sets out who investigates, under which law, who receives the report and what is passed up to the parent company. Where the parent company is subject to the Sapin II Act and prepares consolidated accounts, its obligations cover its subsidiaries and the companies it controls, and the whistleblowing system may be shared (Sapin II Act, Article 17; Article 8, C). An investigation committee bringing together the group's legal department, the whistleblowing officer and the coordinating lawyer avoids scattered country-by-country approaches.

2. Local law on interviews, country by country

In Hong Kong, the Employment Ordinance governs the employment relationship; the Sex Discrimination Ordinance and the codes of practice of the Equal Opportunities Commission govern sexual harassment complaints, and the employer may be liable for the acts of its employees, unless it has taken reasonable preventive measures. The Personal Data (Privacy) Ordinance protects the interview records.

In Mexico, Article 132 of the Ley Federal del Trabajo requires the employer to have a protocol for preventing gender-based discrimination and dealing with violence and harassment. Standard NOM-035-STPS-2018 provides for complaint mechanisms, whose confidentiality must be organised. Convention 190 of the International Labour Organization, ratified by Mexico, and the labour courts complete these reference points.

In China, the applicable employment law, the Personal Information Protection Law, which provides for its own processing bases, and the restrictions relating to state secrets govern every interview; the authorities may require cooperation. The firm involves local counsel at every stage.

In Africa, no OHADA uniform act governs employment law: each country has its own labour code, its own labour inspectorate and, increasingly, its own personal data law, such as Law 09-08 in Morocco, Law 2013-450 in Côte d'Ivoire or Law 2008-12 in Senegal; the firm relies on local counsel. In all cases, interviews follow the law of the country where the employee works.

3. Data transfers: what may leave the country

An interview record is a file of personal data. Within the meaning of the GDPR, its processing rests on the employer's legitimate interest or on its legal obligation to protect the health and safety of employees, and not on the consent of the persons concerned, which the imbalance of the employment relationship makes, in principle, unsuitable: the persons are informed, they are not asked to consent. From the European Union, its transfer to Hong Kong, Mexico or China requires, in the absence of an adequacy decision, appropriate safeguards, in practice intra-group standard contractual clauses and a transfer impact assessment (GDPR, Chapter V). In the other direction, each country lays down its own conditions. In China, the Personal Information Protection Law subjects the export of data to a security assessment, a standard contract or a certification, save for the exemptions introduced in March 2024, including that for transfers necessary for cross-border human resources management under duly adopted internal rules; it requires in principle separate consent for the transfer, a requirement that the Chinese administration's guidelines set aside where the processing rests on another legal basis, a point to be confirmed with local counsel, and prohibits, under its Article 41, the provision of data stored in China to a foreign judicial or law enforcement authority without authorisation. In Hong Kong, the personal data ordinance governs collection and use, its specific restriction on international transfers, section 33, still not having entered into force, and the Privacy Commissioner recommends contractual clauses. In Mexico, the federal law on the protection of personal data held by private parties, recast in March 2025 and now supervised by the Secretariat for Anti-Corruption and Good Governance, requires a privacy notice and, in principle, consent, implied or express depending on the nature of the data, subject to the statutory exceptions, whose scope is checked case by case.

In practice, and as a matter of prudence rather than obligation: raw data remain in the country, on the subsidiary's servers; only pseudonymised summaries are transferred, and they remain personal data subject to the same rules; the persons concerned are informed; and a written intra-group agreement allocates responsibilities.

4. The confidentiality of the work by country

In France, the lawyer's work delivered to their client is covered by legal professional privilege where the lawyer investigates as the company's counsel (Article 66-5 of the Act of 31 December 1971). In Hong Kong, legal professional privilege distinguishes legal advice privilege, relating to legal advice, and litigation privilege, linked to contemplated or pending litigation. In Mexico, professional secrecy exists, but its procedural protection may be more limited. In China, the lawyer is bound by confidentiality under Article 38 of the Lawyers Law, but this obligation does not create procedural protection comparable to privilege: documents may be seized and obligations to cooperate with the authorities may arise. It is therefore necessary to determine where to draft and keep sensitive analyses, then to limit their circulation between subsidiaries. The guide Why entrust the internal investigation to a lawyer? details French legal professional privilege.

5. Language and cultural codes in the interview

A witness interviewed in their own language, by a lawyer who knows their codes, does not express themselves in the same way as through an interpreter. In Hong Kong or China, depending on the individuals and their background, the relationship to hierarchy, the concern not to cause loss of face and indirect speech mean that a polite "yes" is not always agreement and that implicating a superior often takes a roundabout route. In Mexico, loyalty to the group and fear of retaliation weigh on what is said in an interview. In French-speaking Africa, the language of the interview is not always that of the company, and the conventions of public speech vary from one country to another. MOSAIK conducts interviews in French, English, Cantonese, Mandarin and Spanish, from Paris, Hong Kong and Mexico City, and works with local counsel in Africa and China. The written record is drawn up in the language of the interview and, where local law and the person interviewed allow it, signed on the spot; a certified translation is prepared if litigation is on the horizon, in France or elsewhere.

6. The Blocking Statute and requests from foreign authorities

Article 1 bis of the Act of 26 July 1968, known as the Blocking Statute, prohibits, subject to applicable treaties and legislation, requesting, searching for or communicating documents or information of an economic, commercial, industrial, financial or technical nature with a view to establishing evidence for foreign judicial or administrative proceedings. Transmitting directly to a foreign authority or court the documents of an investigation that fall within these categories, where they are intended to serve as evidence in foreign proceedings, therefore falls foul of this prohibition, save for an applicable treaty or legislation, even via a subsidiary; criminal penalties are provided for. Interview records concerning harassment do not necessarily fall within it, but accounting, contractual or technical documents do: hence a document-by-document analysis. The route is that of international mutual legal assistance, with the French administration's contact point. The Chinese Personal Information Protection Law, for its part, prohibits, without authorisation, the transmission of data stored in China to foreign judicial or law enforcement authorities. Do not respond without prior legal analysis: involve the lawyer and document every exchange.

7. When the investigation reveals a corruption or sanctions risk: third-party integrity checks

An HR investigation sometimes brings something else to light: commissions paid to an intermediary, a supplier linked to an employee, a customer under sanctions. In companies with at least five hundred employees, or belonging to a group whose parent company has its registered office in France and has at least five hundred employees, whose turnover, consolidated where applicable, exceeds one hundred million euros, the executives must, and the company with them, under Article 17 of the Sapin II Act, map the risks of corruption and influence peddling and assess customers, first-tier suppliers and intermediaries; others have an interest in doing so as soon as they operate in exposed countries, because the US Foreign Corrupt Practices Act, the UK Bribery Act and the sanctions regimes of the European Union and the United States apply well beyond their borders. Integrity checks, often called KYC for individuals and KYB for companies, consult beneficial ownership registers, sanctions lists, local commercial registers, the Companies Registry in Hong Kong for example, published court decisions and the press. They remain proportionate: the processing of data relating to criminal convictions is strictly regulated by the GDPR, and checks on a job applicant or an employee in France may concern only information having a direct and necessary link with the job (Article L. 1221-6 of the French Labour Code), the methods used having to be disclosed to them (Article L. 1221-8). Our International business and Customs law pages extend this aspect.

Before any integrity check, define its purpose precisely: beneficial owners, applicable sanctions, publicly available convictions or links of interest with employees. Favour official registers and reliable public sources. Keep a record of the sources consulted, the date of the searches and the justification for the data retained. Article 10 of the GDPR strictly regulates the processing of information relating to criminal convictions: their publication is not sufficient to authorise their collection. An intermediary with no real activity, an unexplained commission, a shell company or a refusal to answer calls for a proportionate response: additional checks, contractual safeguards or refusal to contract.

8. The eight-point protocol for a foreign subsidiary

1. The decision: the subsidiary's bodies decide on the investigation and mandate the investigator; the engagement letter sets out the applicable law, the scope and the recipients of the report.
2. The local law analysis before any interview: the employer's obligations, the rights of the persons interviewed, the rules of evidence, the possible presence of a representative or counsel.
3. Freezing and backing up the data on site: mailboxes, files, access logs, time-stamped copies and a documented chain of custody, with no transfer out of the country at this stage.
4. Informing the persons concerned in accordance with local law: purpose, recipients, rights of access and rectification, retention period.
5. Interviews in the person's language, by an investigator who knows their codes, with a written record read over by them.
6. The report drafted and kept where it is best protected, distinguishing established facts, unestablished facts and legal analysis.
7. The transfer to the group of pseudonymised summaries, under intra-group contractual clauses and after a transfer impact assessment.
8. Use of the findings: sanction under local employment law, possible complaint after local analysis, mutual legal assistance for any foreign authority, time-limited archiving.

What changes according to the facts

Where the firm has an office, Hong Kong and Mexico City, the investigation is conducted on site by the team; elsewhere, in Africa and China, it is conducted in coordination with local counsel who know the country's employment law and customs. The actions surrounding the investigation, reporting channel, information campaigns and manager training, are adapted to the country and to the language of the teams, so that a group has a consistent system across all its sites. Criminal conduct abroad calls for local analysis before any complaint, because a complaint may trigger investigative powers that the company no longer controls. An expatriate employee under a French-law contract remains subject to the chosen law, but, before the French courts, they cannot be deprived of the protection of the mandatory provisions of the law of the country where they habitually work when they are posted there on a lasting basis and not on a mere assignment (Rome I Regulation, Article 8); local rules apply in any event to the interview. A group subject to the Sapin II Act links the investigation with its anti-corruption system. A request for evidence from a foreign authority changes the approach: it is dealt with in principle through mutual legal assistance, never by a direct response without analysis of the Blocking Statute. For the method common to all investigations, see How to conduct an internal investigation into harassment or discrimination?; for the role of the lawyer and confidentiality, Why entrust the internal investigation to a lawyer?; for the general framework, the Internal investigations page and our Hong Kong and Mexico pages.