Corporate Investigation in the Philippines: How Companies Conduct Internal Probes

A corporate investigation in the Philippines is an internal inquiry by which a company examines suspected wrongdoing by its directors, officers, or employees — such as fraud, conflict of interest, or policy breaches. It is not a single law but a process shaped by three regimes: the Revised Corporation Code (Republic Act No. 11232), which governs how the board exercises corporate powers; the Labor Code, which governs the employment relationship and union-related matters; and the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules, which govern how personal data gathered during the probe may be collected, used, and disclosed. The board normally authorizes the investigation, and the findings may support disciplinary action, civil claims, or a referral to prosecutors.

Who has the authority to order an internal investigation

Under Section 22 of the Revised Corporation Code, the board of directors or trustees exercises the corporate powers, conducts all business, and controls all properties of the corporation. That provision is the legal foundation for an internal investigation: the power to look into suspected misconduct within the company is an exercise of the board's authority to conduct corporate business and control corporate property.

In practice, the board adopts a resolution authorizing the investigation, defines its scope, and may create a committee or engage external counsel. A director who ceases to own at least one share of stock — or a trustee who ceases to be a member — ceases to hold office under the same section, which can matter when the subject of the probe sits on the board.

The role of the Labor Code when employees are involved

When the subject is an employee, the investigation intersects with the Labor Code. Two provisions are directly relevant.

Article 245 states that managerial employees are not eligible to join, assist, or form any labor organization, while supervisory employees may not join the bargaining unit of rank-and-file employees but may form their own. This matters when a probe touches union officers or bargaining unit members.

Article 258-A provides that in certification election proceedings the employer is a mere bystander — not a party with a right to oppose the petition, and limited to being notified and submitting the list of employees during the pre-election conference. An internal investigation must not be used as a backdoor to influence union representation.

Article 245-A provides that including employees outside the bargaining unit as union members is not a ground to cancel the union's registration; those employees are simply deemed removed from the membership list. This limits how far an employer may use a probe to attack a union's composition.

Data privacy limits during the investigation

Because an investigation collects and processes personal data, the Data Privacy Act of 2012 and its Implementing Rules apply. Under the IRR, "personal information" is any information from which an individual's identity is apparent or can reasonably and directly be ascertained, and "sensitive personal information" includes data about race, ethnic origin, marital status, age, color, religious or political affiliations, health, education, genetic or sexual life, and proceedings for an offense.

Processing must follow the principles of transparency, legitimate purpose, and proportionality set out in the IRR. In an investigation this means:

• Collect only what the legitimate purpose requires.
• Do not retain personal data longer than necessary.
• Put organizational, physical, and technical security measures in place.
• Give the data subject the rights the IRR guarantees — to be informed, to object, to access, to correct, and to rectification, erasure, or blocking.

A personal data breach — accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data — triggers the breach notification rules under the IRR. Investigations that involve surveillance or interception of communications must be assessed against the IRR's provisions on those activities.

Conducting the investigation: a practical sequence

1. Board authorization. Secure a board resolution defining the scope, the investigating body, and reporting lines.
2. Preserve evidence. Identify and secure documents, systems, and records before they can be altered.
3. Map the data. Determine what personal and sensitive personal information will be processed and confirm a lawful basis.
4. Gather facts. Interview witnesses and review records, keeping the inquiry within the authorized scope.
5. Observe employment rules. Where employees or unions are involved, check the Labor Code provisions on managerial and supervisory employees and on employer neutrality in representation proceedings.
6. Document findings. Prepare a written report supporting whatever action the board decides — discipline, civil recovery, or referral to authorities.

Frequently asked questions

Can a Philippine company investigate its own employees? Yes. The board's power to conduct corporate business and control corporate property under Section 22 of the Revised Corporation Code supports an internal investigation, provided employment and data privacy rules are observed.

Is an internal investigation covered by the Data Privacy Act? Yes. Any processing of personal data during the probe is covered by Republic Act No. 10173 and its Implementing Rules, including the principles of transparency, legitimate purpose, and proportionality.

Can an employer use an investigation to oppose a union certification election? No. Under Article 258-A of the Labor Code, the employer is a bystander in certification election proceedings, limited to being notified and submitting the employee list.

Practical takeaways

• Anchor the investigation in a board resolution — Section 22 of the Revised Corporation Code makes the board the source of corporate authority.
• Treat every investigation as a data processing activity under the Data Privacy Act and its IRR.
• Apply the transparency, legitimate purpose, and proportionality principles from the start.
• Check Labor Code rules on managerial and supervisory employees, and keep the employer neutral in representation proceedings.
• Document findings in writing to support any disciplinary, civil, or criminal step.

Primary sources

The rules discussed above are drawn from the following primary sources, as published in the Official Gazette and the national statute book.

• REPUBLIC ACT NO. 11232 - AN ACT PROVIDING FOR THE REVISED CORPORATION CODE OF THE PHILIPPINES

• NPC IRR OF REPUBLIC ACT NO. 10173, August 24, 2016

• REPUBLIC ACT NO. 9481 - AN ACT STRENGTHENING THE WORKERS' CONSTITUTIONAL RIGHT TO SELF-ORGANIZATION, AMENDING FOR THE PURPOSE PRESIDENTIAL DECREE NO. 442, AS AMENDED, OTHERWISE KNOWN AS THE LABOR CODE OF THE PHILIPPINES

This article is general information and not legal advice. For your specific situation, consult a lawyer or ask ASG Legal AI.