Federal Labour Court: No Entitlement to the Full Disclosure or Copies of Compliance Reports

With its judgment of 16 April 2026 (8 AZR 169/25), the Eighth Senate of the German Federal Labour Court (Bundesarbeitsgericht – BAG) handed down a decision of considerable practical relevance for employers: Pursuant to Art. 15 GDPR, employees generally have no right to receive copies of complete compliance investigation reports. This is because the data subject’s right of access under data protection law relates to personal data – and generally not to the document as such.

From a corporate perspective, the judgment provides important clarification regarding the limits of data protection access requests, which employees are increasingly using to challenge internal investigations. It strengthens employers’ position against attempts to use data protection law as a gateway into internal corporate decision-making processes.

What was the case about?

The case concerned a senior employee whose conduct as a manager had been reported to the company’s ombudsperson on several occasions. The company commissioned a compliance report documenting, among other things, the allegations against the manager, statements made by whistleblowers and witnesses, assessments of their credibility, as well as legal assessments by the law firm instructed by the company. The senior employee requested copies of the compliance reports pursuant to Art. 15(1) in conjunction with Art. 15(3) GDPR.

The right to a copy of personal data does not necessarily cover complete documents

In line with the case law of the Court of Justice of the European Union (CJEU), the BAG clarified that Art. 15(1) in conjunction with Art. 15(3) GDPR does not give employees a right to receive a copy of an entire compliance report, even where the report contains personal data.

The “right to a copy” under Art. 15(3) GDPR does not constitute an independent right to obtain a document “as such”. Rather, it governs the manner in which the right of access under Art. 15(1) GDPR is to be exercised. The subject matter of that right is only personal data. Art. 15(3) GDPR, in turn, does not also confer a right to receive the entire document containing such personal data.

Under the GDPR, a right to receive copies of excerpts from documents or even complete documents may arise only where this is “essential” to enable the data subject to effectively exercise their rights. This may be the case, for example, where the processing of the data can only be understood by the employee in its context. As a general rule, the employee concerned bears the burden of demonstrating this necessity.

In the case at hand, the BAG rejected such a necessity, at least with regard to the legal assessments and client-related information contained in the compliance report. In order to understand the personal data stored in relation to the senior employee, she did not need to have access to this content. Consequently, in the BAG’s view, there was no entitlement to a copy of the complete document.

No right to copies of complete documents based on the right of access to personnel files either

The BAG also held that the right of access to personnel files (§ 26(2) SprAuG, § 83(1) BetrVG) does not give rise to a right to receive copies of complete documents.

These provisions grant employees the right to inspect their personnel files, i.e. all documents relating to their personal or professional circumstances that have an internal connection with the employment relationship. While this generally gives rise to a right to make copies to a reasonable extent, that right ends where personnel records are to be copied and disclosed “as a whole”. According to the BAG, extensive documents such as a complete compliance investigation report therefore cannot be requested solely on the basis of the right to inspect personnel files.

Of particular practical relevance is the BAG’s observation that the legal assessments and client-related information contained in such a compliance report may not even form part of the “personnel file”. This means that even if the report is stored in the personnel file, this does not automatically mean that all of its contents – in particular, internal legal assessments and strategic considerations – must be provided in copy.

Practical considerations

The BAG’s decision is consistent with the fundamental principles of data protection law that have already been confirmed by several supreme courts. Art. 15 GDPR does not establish a general right of access to files. Nor can it generally be assumed that the disclosure of documents is necessary to enable data subjects to effectively exercise their rights.

Employers can and should take a restrictive approach to requests for the disclosure of documents contained in compliance files. The obligation to provide copies is generally limited to the context of personal data. From an employer’s perspective, it is therefore advisable to take a closer look at the way personnel files and compliance processes are structured: personal factual information should be clearly separated from legal, internal and business-related content. Accordingly, compliance investigation reports should be structured separately and stored independently.

Standardised processes should also be established for responding to access requests under Art. 15 GDPR in a way that ensures employees receive their personal data completely and in an intelligible form, without requiring the employer to disclose entire compliance reports or its internal legal strategy.