Which items should be redacted when submitting harassment investigation data to an external labor law firm?

📌 Answer first

When sending materials to an external labor law firm, simply choosing between "providing all" and "hiding names" is insufficient. You must first determine the purpose of the request, the facts required, the sensitivity of the data, and the need to preserve the originals, and then organize packages for each recipient. Even if the company possesses the data, it is safer not to send health information, conversations with family or third parties, or private account contents that are irrelevant to the investigation without separate review.

Perform masking on a copy, not directly on the original file. Record the filename, version, masked item, reason for masking, and reviewer, and link this to the original location so that you can explain which information was omitted if questions arise later. Apply this principle consistently to every stage of delivery.

🧭 ① Define the external recipient's task in one sentence.

Even within the same labor law firm, the required information varies depending on whether the firm supports fact-finding, reviews legal issues, or advises only on procedural operations. Write the “questions to be verified in this review” on the first line of the request form, and exclude any materials that are not necessary to answer those questions.

🗂️ ② Please create a summary of the facts and a list of original sources separately.

The summary distinguishes between confirmed facts, unconfirmed claims, the location of the materials, and any further verification required. Do not alter the parties' wording to reflect the company's judgment; instead, link the speaker, time, place, and material ID to enable the recipient to request the original.

In the source list, record the filename, format, collection date, submitter, storage location, and viewing restrictions. Instead of copying the full original text in the summary, indicating the document ID, page number, and time period can reduce unnecessary exposure of personal information.

🔐 ③ For the masked version, preserving context takes precedence over 'name deletion'.

Even if names are obscured, the identity can be inferred if job titles, rare incident dates, team size, and conversation partners remain. Conversely, if both dates and the order of remarks are erased, the facts cannot be examined. By comparing the purpose before and after obscuration, direct identifiers, unnecessary third-party information, and private content unrelated to the incident are excluded first, while the chronological order and relationships of remarks necessary for the issue are retained.

🧾 ④ Connect the versions of the Original, Hidden, and Question List

If only the masked version is sent, external consultants cannot compare it with the original, and if only the original is sent, the scope may become excessively broad. Link the Original ID, Masked ID, and Question Number in a single list, and record the delivery date, recipient, storage location, and confirmation of retrieval or deletion. If a translation is required, indicate the translator and translation date separately, and do not treat it as a substitute for the original text.

📝 ⑤ Please send the list of questions first before forwarding.

If you simply provide the materials to an external consultant, the reviewer will estimate the scope of judgment the company desires. In the list of questions, list the facts you wish to verify, the regulations to review for application, the necessary deliverables, and the desired response time. Rather than requesting only a conclusion, such as "Please determine if this is harassment," it is better to break down the questions into reviewable items, such as "What additional facts need to be verified from the current materials, and what are the procedural considerations?"

✅ ⑥ Pre-delivery Checklist

⚠️ Common errors

You must avoid bulk sharing of entire original mailboxes, storing masked copies as if they were originals, or copying external advisory opinions verbatim into the company's factual confirmation documents. External advisory services do not serve as a substitute for the company's investigation or personnel decision-making, and legal judgments regarding specific cases require the latest laws and expert review.

🧮 ⑦ Please double-check the scope when adding data requests.

Even if additional materials are requested during the external consultation process, do not automatically add them to the initial bundle; instead, rewrite the purpose of the request and the necessary items. Even for the same case, the required materials may differ if the questions change. In the list of additional materials, displaying the ID of the existing material, the ID of the newly sent material, the reason for provision, and the recipient makes it easy to verify the cumulative scope of sharing.

Avoid requesting the personnel records or counseling and medical records of all parties at once. First, narrow down the time period and document types directly related to the issue, and mark unclear parts as "requires further verification" to avoid confusing advisory opinions with the confirmation of facts.

📮 ⑧ Please promise safe delivery and return methods

Rather than transmitting materials solely through email attachments, we use repositories, access permissions, and expiration dates approved by the company and the advisory body. If a download is required, we verify the recipient's account and set an expiration date and redelivery restrictions on the shared link. After delivery is complete, we obtain the advisory body's storage location, retention period, and methods for confirming return or deletion, and link this to internal records.

🔄 ⑨ Please organize the company records after the consultation is completed.

Once the consultation is complete, separate the external agency's opinion, facts verified by the company, the final procedural decision, and remaining measures into separate documents. Do not copy the wording of the external opinion verbatim as the investigation results; instead, rewrite in the internal document what measures the company decided upon based on the facts. If further investigation or notification to the parties involved remains, assign a deadline with the person in charge and re-evaluate whether further data sharing is necessary.

Access permissions are not kept open simply because a case has been closed. After confirming the consultation termination date and the necessity of retention, temporary accounts, shared links, and downloaded files are cleaned up, and the storage locations of the originals and final versions are checked. However, as the retention period or the timing of destruction may vary depending on the nature of the case and applicable regulations, you must confirm this with the company's legal and privacy officers.

📊 ⑩ Leave the provision matrix by recipient

In cases where materials are distributed to multiple people, a table defining access scopes by role is useful rather than simply listing names. For example, distinguish whether a fact-finding officer needs to view the originals, whether a legal reviewer can rely solely on masked copies and issue summaries, and whether a procedure supporter only needs to check schedules and guidelines. Actual access is limited to accounts assigned to the respective roles, and existing permissions are revoked first when a role changes.

The Matrix is ​​not a document that replaces legal correct answers, but rather a basis for determining the scope of delivery. Please review workplace regulations, advisory agreements, and the risk level of the actual case together to make adjustments.

🧠 ⑪ Scope Adjustment through Case Studies

For example, if an external agency is reviewing whether there were “repeated public criticisms,” you can initially group only the meeting notices, related messages, and key points of witness statements from that period. Conversely, including organization-wide performance evaluation data or personal emails unrelated to the incident may exceed the scope required for the question. To ensure that reducing the amount of material does not result in concealing the facts, please also include the types of materials excluded and the reasons for exclusion in the list.

If facts are stated differently, do not conclude in advance which is correct; instead, list each statement as a separate item. Ask the external advisor, “What additional verification is required?” and the company must record the verification results and the progress of the procedures separately.

🛡️ ⑫ Check the history after delivery

After delivery, verify who accessed the materials, whether there were additional downloads, and which version of the reply document was received. If the advisory body re-entrusts the task to another expert or re-transmits the materials, it must notify the company in accordance with pre-established conditions and request that unauthorized re-transmissions be stopped. As the initial retention requirements may change if the case becomes prolonged, re-verify the validity of access rights and sharing links at regular intervals.

History checks are not a procedure for surveillance, but a safeguard to verify that data was used within its intended scope. It is important to record only facts and not to include the professional judgments of advisory bodies or speculations regarding the psychological state of the parties involved. Please record the inspection date and the results of the actions taken together so that verification can be conducted using the same standards even if the person in charge changes.

🔗 Related Posts

Access Rights and Storage Standards for Workplace Harassment Investigation Data

How to Preserve Original Messenger and Email Evidence in Harassment Investigations

Inquiry regarding Nudge EAP implementation and operation

💬 Frequently Asked Questions

Q1. If it is an external consultation, may I send the original document?

First, verify the purpose of the request and the contract and security conditions to determine if the originals are required. Start by reviewing whether the inquiry can be answered with the list of originals and copies for review; if the originals are necessary, it is advisable to establish separate criteria for access rights, retention, and deletion.

Q2. Is it sufficient to just hide the name?

No. It can be identified solely by the combination of position, date, and event. While retaining the context necessary for the issue, combinations that allow for re-identification must also be examined.

Q3. May I include the advisory opinion in the survey results as is?

Please record advisory opinions separately from the facts confirmed by the company. Final judgments and actions must be organized separately in accordance with company procedures and expert reviews.

Reduce the data while retaining the context necessary for the review.

Designing a material package tailored to the purpose of the survey and the role of the recipients reduces unnecessary sharing and enables consistent responses to follow-up questions.

📚 Source and Information

• National Law Information Center

This content provides general practical information. Specific personal information processing and investigation procedures may vary depending on workplace circumstances, contracts, current laws, and expert review. As of September 14, 2026.