Proof in Corporate Investigations and Its Validity in Criminal Proceedings

Diana Ferraz Kaminski; Rodrigo Silva Barreto

DOI: 10.22167/2675-6528-202602826

Article derived from a Final Course Work (TCC), with content based on the student’s original work and adapted to the editorial format of the E&S Magazine with the support of the ResumeAI tool, an artificial intelligence solution developed by the Pecege Institute for textual synthesis and organization.

Abstract

The study examined the validity of digital evidence produced in corporate investigations, especially that obtained through the monitoring and seizure of electronic devices provided by companies, such as smartphones, when used in criminal proceedings. The objective was to analyze the extent to which this evidence can be considered valid and utilized in criminal cases. An exploratory and descriptive methodology was employed, combining bibliometric analysis of international literature with the application of questionnaires to corporate compliance and legal professionals in Brazil and the Netherlands. The results revealed differences in the maturity of investigative practices, the formalization of policies, team training, and the use of digital evidence in judicial proceedings between the countries. The bibliometric analysis indicated that the contemporary debate has focused on data protection, information governance, and chain of custody. It was concluded that the admissibility and evidentiary value of digital evidence were more associated with the formalization, documentation, and legal legitimation of organizations’ investigative practices than with the technology employed, with data protection serving as an instrumental element for constructing valid and contestable evidence in transnational contexts.

Keywords: Admissibility of evidence; Digital chain of custody; Digital evidence; Information governance.

1. Introduction

The advancement of corporate investigations as a tool for ascertaining business misconduct has gained increasing relevance in the contemporary legal landscape. These internal investigations function as organizational mechanisms for identifying irregularities, documenting the measures adopted, and strengthening compliance and governance controls (Organisation for Economic Co-operation and Development, 2013). In this context, the present study develops a comparative analysis between Brazil and the Netherlands, focusing on the use of corporate devices, especially smartphones, in order to delimit the scope of the research and deepen the discussion on the validity and admissibility of evidence produced in internal investigations, when these are frequently conducted in parallel to or prior to state action within the scope of criminal proceedings.

One of the central dimensions of this issue relates to the admissibility of evidence obtained in corporate investigations and subsequently transferred to criminal proceedings. Although the Federal Constitution ensures the principles of broad defense and adversarial proceedings (Brazil, 1988), the Brazilian legal system still lacks clear normative parameters regarding the compatibility between the evidentiary means used by companies and the limits of state criminal prosecution (Faraco and Forsman, 2021). This normative gap generates uncertainties about the validity of evidence produced in the private sphere, highlighting the need to examine the tension between corporate action and the protection of criminal procedural guarantees.

This debate is intensified by the growing incorporation of new technologies in the corporate environment. The use of digital tools, such as cloud systems and corporate smartphones, has significantly altered the dynamics of business activity and the relationship between employers and employees (Castells, 2016). The use of corporate devices for monitoring and investigation purposes may involve professional and personal data of workers. For this reason, the collection and processing of this information must observe specific purpose, necessity, proportionality, transparency, and adequate safeguards (Brazil, 2018; European Parliament and Council of the European Union, 2016).

The protection of personal data adds an additional layer of complexity to the discussion. The entry into force of the General Law for the Protection of Personal Data (LGPD) in Brazil (Brazil, 2018) and the General Data Protection Regulation of the European Union (GDPR) (European Parliament and Council of the European Union, 2016) established new parameters for the collection, processing, and sharing of personal information, including that extracted from equipment provided by companies (Doneda, 2020). These normative diplomas impose the observance of principles such as purpose, necessity, and proportionality, restricting the employer’s unrestricted access to potentially private content, even in contexts of investigating illicit acts. The analysis of the impacts of these rules on the criminal process is, therefore, central to the discussion of evidentiary admissibility.

In this scenario, corporate smartphones play a prominent role, as they can store communications, documents, access logs, location data, and other professional or personal information. For this reason, their collection for investigative purposes must have a previously defined scope and observe the principles of purpose, necessity, and proportionality (Brazil, 2018; European Parliament and Council of the European Union, 2016). The definition of the conditions under which such content can be legitimately used as evidence in criminal proceedings goes beyond the corporate sphere, directly reaching the constitutional protection of intimacy and privacy (Brazil, 1988).

The intersection between compliance, corporate governance, and data protection highlights a field of normative tensions that challenges private organizations and public authorities. In Brazil, the absence of a specific legal framework for corporate investigations, coupled with regulatory fragmentation, increases uncertainty regarding the limits of corporate action and the use of internally produced evidence (Faraco and Forsman, 2021). Although the Netherlands has a greater tradition of regulated cooperation between companies and authorities, there are also no uniform parameters that objectively define the limits of legality and proportionality in accessing corporate data, which also contributes to legal uncertainty. Given this context, the general objective of the present study was to analyze the extent to which evidence obtained within the scope of corporate investigations, especially those arising from the monitoring and seizure of electronic equipment provided by companies to their employees and collaborators, can be considered valid and used in criminal proceedings.

2. Material and Methods

The present study was characterized as an exploratory and descriptive research, developed in two complementary stages. The first stage consisted of a bibliometric analysis of the international literature, while the second involved the application and analysis of questionnaires. This combined approach allowed for the integration of the theoretical mapping of the field with the empirical observation of organizational practices, according to the methodological guidelines of Cervo and Bervian (2002) and Severino (2017).

Stage 1, concerning the bibliometric analysis, began with the selection of databases that guaranteed the relevance and reliability of the information. Web of Science – Clarivate Analytics, accessible via the CAPES Periodicals Portal, was chosen due to its broad multidisciplinary coverage, indexing of high-impact journals, and robust data export features, following the guidelines of Marconi and Lakatos (2017).

The search in the Web of Science Core Collection was performed on February 1, 2026, using the search expression in the Topic (TS) field: [(TS=”criminal process”) OR (TS=”Corporate Investigation”) OR (TS=”Data protection”)] AND TS=(compliance). The query covered the period from 1900 to 2026, with no language restriction, resulting in 1,726 initial records.

Subsequently, a document type filter “Article” was applied on the Web of Science platform itself, which reduced the corpus to 988 records. These articles were then exported in .txt format for processing. For data treatment and mapping, the VOSviewer software was used, recognized for its capacity for graphical visualization and clustering (Cobo et al., 2011).

In VOSviewer, for the keyword co-occurrence analysis, the “full counting” method was used with a minimum threshold of ten occurrences. For co-citation analysis, a minimum threshold of 25 co-citations was established, displaying the 20 most frequent authors or entities, allowing for the construction of bibliometric networks.

Stage 2 of the research consisted of collecting empirical data through a structured questionnaire. The instrument was composed of 18 entries, two of which were identification questions and 16 were substantive questions. The substantive questions were distributed into four thematic blocks: Compliance Policies (3), Monitoring and Corporate Devices (4), Data Protection (5), and Digital Evidence and Criminal Procedure (4).

Of the 16 substantive questions, ten were dichotomous (Yes/No), one was multiple-choice, and five were open-ended. The questionnaire was made available in digital format, with versions in Portuguese for participants in Brazil and in English for participants in the Netherlands, aiming for cultural and linguistic adequacy.

The questionnaire application occurred through the Google Forms platform, from February 2, 2026, to March 27, 2026. Participants were professionals from the corporate compliance and legal areas, with knowledge and responsibility for whistleblowing programs and investigations in their organizations.

The sample was non-probabilistic by convenience, composed of ten respondents in each country. In Brazil, participants were recruited via a WhatsApp group of professionals linked to the MBA in Compliance and ESG at USP/ESALQ. In the Netherlands, the questionnaire was shared with compliance professionals from companies in international networking groups.

Before the application, the questionnaire was reviewed by a Compliance professional to verify the clarity of the questions, adherence to the research objectives, and consistency between the Portuguese and English versions. The data collected through the questionnaires were subjected to a comparative analysis between the practices observed in Brazil and the Netherlands.

To ensure the ethical compliance of the research, the Ethical Guidance Form (EGF) was completed. Respondent participation was voluntary, with guaranteed anonymity and confidentiality. The instrument contained a confidentiality notice, as reproduced in Appendix A, without the need for a separate informed consent form.

The treatment of the collected data observed the principles of the General Law for the Protection of Personal Data (LGPD) and the General Data Protection Regulation (GDPR). The legal basis for the treatment was the exclusively academic purpose, with data minimization and secure storage for twelve months, after which disposal occurred. Security measures such as encryption and access control were implemented, and a channel for clarification of doubts was made available.

3. Results and Discussion

This section presents and discusses the results obtained through the bibliometric analysis of international literature and the application of questionnaires to compliance and corporate legal professionals in Brazil and the Netherlands. The findings reveal a complex intersection between the validity of digital evidence, regulatory compliance, and organizational practices, highlighting the importance of information formalization and governance. The discussion articulates the empirical data with the theoretical framework, seeking to understand to what extent digital evidence from corporate investigations can be considered valid and utilized in criminal proceedings, in line with the study’s general objective.

Step 1 – Bibliometric analysis results

The results of the keyword co-occurrence analysis, obtained using VOSviewer and considering a minimum threshold of ten occurrences, outlined a thematic structure centered on privacy, data protection, and regulatory compliance. Terms such as “data protection”, with 219 occurrences and a total strength of 341, “privacy”, with 163 occurrences and a strength of 336, and “GDPR”, with 184 occurrences and a strength of 315, emerged as the core of the network, indicating the predominance of these themes in the international scientific debate on corporate investigations and digital evidence. These terms concentrate the largest volume of associations and structure the research network.

From this central core, the analysis identified distinct but interconnected research fronts. One front addresses governance and accountability, encompassing terms such as “compliance”, “accountability”, “consent”, and “personal data”. Another focuses on technical safeguards, highlighting “security”, “data security”, and “cloud computing”. A third subdomain, of a legal-technological nature, connects “law” and “regulation” to emerging technologies like “blockchain”, “internet of things”, and “smart contracts”, evidencing the concern in reconciling the traceability and immutability of these technologies with data protection requirements, as illustrated by the “blockchain-GDPR” relationship with 24 occurrences. The distribution of these keywords can be visualized in the Keyword Co-occurrence Analysis

.

The discussion derived from this bibliometric analysis reveals that scientific literature tends to frame corporate investigations and the acquisition of digital evidence not as a strictly evidentiary problem, but as a matter of regulatory compliance and information lifecycle governance. The prevalence of the “privacy” – “data protection” – GDPR axis suggests that the validity and utilization of data obtained from the monitoring and seizure of corporate electronic devices depend, conceptually and normatively, on the legitimacy of the processing of such data, which must observe adequate legal bases, transparency, specific purpose, minimization, and robust “accountability” mechanisms.

The articulation of terms related to information security, such as “security”, “data security”, and “cloud computing”, reinforces that, beyond material compliance, the robustness of technical safeguards is fundamental. Integrity, confidentiality, and access control constitute an essential requirement for the reliability and future admissibility of digital evidence, bringing the discussion closer to typical procedural criteria, such as the chain of custody. This perspective is crucial to ensure that digital evidence maintains its probative value from collection to its presentation in court, as pointed out by Guttman et al. (2022) and Council of Europe (2022).

The legal-technological subdomain, in turn, highlights tensions between technologies that expand traceability, such as “blockchain” and “Internet of Things” (IoT), and data protection principles. In highly digitized corporate environments, logs, metadata, and operational records can simultaneously reinforce investigative capacity and increase the risks of excessive or disproportionate processing. The emergence of “large language models” and “federated learning”, with an average year of 2024, suggests a research frontier that shifts attention to challenges related to automated inferences, decision-making opacity, and distributed processing, increasing the need for technical and organizational governance to sustain the lawfulness of data collection and the reliability of data processing that may become evidence (Wachter et al., 2017).

Co-citation analysis, with a minimum threshold of 25 co-citations and a maximum selection of 20 items, revealed an intellectual foundation anchored in institutional and doctrinal references of data protection within the European context. The entity “European Commission” occupied a central position, with 194 co-citations and a total articulation strength of 478, establishing robust connections with the “European Parliament” (77), the “European Data Protection Board” [EDPB] (59), and the “Organisation for Economic Co-operation and Development” [OECD] (35). This strong Europeanization of the most cited items underscores the centrality of the European framework and reinforces the relevance of the comparison with the Netherlands, as illustrated in the Co-citation analysis

.

The clusters formed in the co-citation analysis indicated three complementary matrices. An institutional and public policy core included the “Commission Nationale de L’informatique et des Libertés” [CNIL] (2018) and the EDPB. A legal-dogmatic block was composed of authors such as De Hert and Gutwirth (2006), Solove (2008), Schwartz (2011), Kuner (2013), and Wright and De Hert (2012). Finally, an algorithmic governance block highlighted Wachter et al. (2017), Floridi (2023), Hildebrandt (2015), Malgieri (2019), and Veale and Zuiderveen Borgesius (2021). The internal ties of these clusters, such as CNIL-EDPB (40) and Malgieri-Wachter (40), demonstrated great cohesion, while connections like De Hert-Kuner (26) and EDPB-Information Commissioner’s Office [ICO] (2011) (25) revealed a circuit of reciprocal legitimation between doctrine, control authorities, and normative formulation.

These results indicate that academic debate frames the acquisition and use of digital evidence in corporate investigations fundamentally from the perspective of data protection and regulatory compliance, rather than through classic procedural categories. Thus, the admissibility and valuation of evidence are understood as derived from the lawfulness of processing throughout the entire data lifecycle, including purpose, minimization, transparency, governance, and accountability. In practice, this brings procedural requirements – integrity, traceability, reliability, documentation – closer to the internal governance of organizations.

The presence of the artificial intelligence (AI) bloc, densely connected to the European institutional axis, reinforces that the current frontier of the field involves concerns related to automation, algorithmic inference, and the lack of transparency in automated decision-making processes. These factors can strain the legitimacy of evidence when automated models or classifications are employed in internal investigations, requiring greater rigor in demonstrating criteria, parameters, and limits to avoid weakening the credibility of the proof (Floridi, 2023; UNESCO, 2021).

The complementary analysis of the abstracts of the bibliometric articles found that the informational “validity” of the data produced in organizational environments is constituted before the criminal proceedings, at the moment of its collection and processing. The literature states that compliance with data protection regimes acts as a criterion for material lawfulness, centered on an adequate legal basis, defined purpose, minimization, and proportionality. This is not a mere checklist, but a test of necessity and adequacy that seeks to avoid unduly broad collection practices, linking to “enforcement” mechanisms and institutional arrangements (Quelle, 2017; Yeung and Bygrave, 2022).

Modern regimes emphasize the risk-safeguards axis, shifting the focus to ex ante prevention and accountability through impact assessments and proportional measures (Gellert, 2018; van den Broek and van Veenstra, 2018). The more intrusive the organizational practice, the greater the burden to demonstrate necessity, proportionality, and safeguards, under penalty of compromising the admissibility of evidence. In labor relations, the use of consent as a legal basis requires caution, especially due to the existing asymmetry between employer and employee (Article 29 Data Protection Working Party, 2018).

In organizational contexts, legitimacy also depends on robust institutional and technical architectures. The European cybersecurity framework reinforces that organizations must demonstrate effective control over risks and flows, approaching the procedural criteria of reliability (Markopoulou et al., 2019). The integrity and traceability of digital evidence depend on documented procedures for collection, preservation, storage, analysis, and transfer. The chain of custody must record who obtained and handled the evidence, when the collection and transfers occurred, and the purpose of each movement, allowing for verification of its authenticity and integrity (Council of Europe, 2022; Guttman et al., 2022).

The summaries also highlight the need for contestability: for the evidence to be valid, it must be intelligible and verifiable. In automated decision-making systems, transparency, intelligibility, and the possibility of contestation constitute relevant safeguards. Affected individuals must receive meaningful information about the logic used, as well as about the importance and foreseen consequences of automated processing (Binns and Veale, 2021; Wachter et al., 2017). Another relevant dimension concerns transnational flows, where the location of data in different jurisdictions can generate conflicts between data protection rules, authorities’ access powers, and international transfer requirements (Abraha, 2021; Casino et al., 2022; Kuner, 2013).

In summary, the bibliometric results showed that the validity and procedural effectiveness of evidence derived from corporate investigations depend on four interconnected dimensions: the material lawfulness of the means employed; the integrity and traceability of the evidence; the transparency and the possibility of challenge by the parties; and the regularity of informational flows, especially in transnational contexts. The specialized literature addresses these dimensions predominantly from the perspective of personal data protection and information governance. The present study, however, advanced by translating these analytical axes into the legal-procedural vocabulary, confronting them with concrete practices observed in the organizational context of Brazilian and Dutch companies.

Step 2 – Questionnaire results

The comparative analysis of the questionnaires applied in Brazil and the Netherlands showed relevant structural and procedural differences regarding the maturity of compliance areas, the formalization of investigative practices, and the use of digital evidence in corporate investigations. The sample consisted of ten respondents in each country, and not all questions were answered by all participants, which led to the calculation of percentages based on the number of valid responses for each item, as detailed in Table 1.

Structurally, a significant asymmetry was observed regarding the size of the participating organizations. The Dutch companies that responded to the questionnaire are mostly large, with thousands of employees and billions in revenue, while in Brazil, a smaller organizational profile predominates, with around 450 employees, although with the participation of multinationals. This structural difference is relevant, as larger companies tend to have more consolidated governance, internal audit, and compliance departments, which favors greater formalization of policies, standardization of procedures, and documentation of investigative activities.

This asymmetry is directly reflected in the reported internal practices. Regarding the formalization of corporate investigations, 90% of Dutch companies (9 out of 10 respondents) stated they have specific policies for this purpose, in contrast to 50% in Brazil (5 out of 10). The difference also manifests in employee training: 50% of Dutch companies (5 out of 10) offer periodic training on digital investigations and evidence, while in Brazil this percentage is 20% (2 out of 10), suggesting greater institutionalization of these practices among the participating Dutch organizations.

Regarding the monitoring of corporate devices, 88.9% of companies in the Netherlands (8 out of 9 valid respondents) reported performing some type of monitoring, compared to 70% in Brazil (7 out of 10). It was also observed that 80% of Dutch companies (8 out of 10) have specific internal policies that regulate the monitoring of these devices, while in Brazil this percentage is 70% (7 out of 10). This data indicates that, although monitoring is relatively widespread in both countries, it is more frequently accompanied by internal regulations among the participating Dutch organizations, providing greater predictability and procedural compliance.

Regarding the collection of corporate smartphones for investigative purposes, the percentages are equivalent: 50% of companies in both countries (5 out of 10) stated they adopt this practice. However, relevant differences emerged regarding the legal basis for data processing. Although all respondents reported that their organizations had a data protection policy declared as aligned with LGPD or GDPR, the qualitative analysis of the responses revealed important distinctions in the practical internalization of regulatory principles.

Among the Dutch organizations participating in the sample, a higher frequency of responses was observed mentioning principles such as proportionality, purpose, and data minimization in conducting investigations. Among the Brazilian organizations participating, the responses presented less detail on these criteria. These results should be interpreted with caution, considering the reduced number of respondents and the size differences between the organizations included in the research, which may influence the depth of formalization and understanding of data protection principles.

Regarding judicial utilization, despite similar levels of smartphone data collection (50% in both countries), the effective use of this evidence in court was more frequent in the Netherlands (75%, corresponding to 6 out of 8 valid responses) than in Brazil (60%, equivalent to 6 out of 10). This result suggests that, among the responding organizations in the sample, factors related to the formalization of procedures, documentation of investigative activities, and preservation of the chain of custody may influence the judicial utilization of this information more than the technology used for its collection. Table 1 summarizes the maturity of investigative practices in the two countries.

Table 1. Brazil vs. Netherlands: maturity of investigative practices

The results suggested, in the analyzed sample, that maturity in the use of digital evidence was more associated with the formalization and documentation of investigative practices than with the technology employed. The participating Dutch organizations presented a higher frequency of formalized policies, periodic training, and governance mechanisms related to the handling of digital evidence. These factors may contribute to a more favorable environment for the evidentiary use of this evidence. However, the results do not allow for generalizations about the Dutch context as a whole, especially due to the sample size and structural differences between the participating organizations.

In contrast, the results observed among the participating Brazilian organizations suggest opportunities for strengthening procedural aspects related to the formalization, documentation, and governance of corporate investigations. The comparison should be interpreted in light of different regulatory and institutional contexts. In Brazil, the General Data Protection Law (LGPD), enacted in 2018, established a comprehensive regulatory framework for the processing of personal data, but its implementation and institutional consolidation are still relatively recent (Brazil, 2018).

In the Netherlands, in turn, organizations are subject to the European Union’s General Data Protection Regulation (GDPR), adopted in 2016 and applied in a coordinated manner by national data protection authorities, under the supervision and guidance of the European Data Protection Board (EDPB) (European Parliament and Council of the European Union, 2016). This more consolidated regulatory environment may represent one of the factors influencing the formalization of internal policies, the documentation of corporate investigations, and the practical incorporation of data protection principles observed in the organizations participating in the sample.

However, other variables, such as organizational size, industry sector, and the maturity level of compliance programs, may also have influenced the results found. Thus, the differences observed in this study should be interpreted as characteristics of the organizations participating in the research, and not as a representation of the Brazilian or Dutch business context in its entirety. The reduced sample size and the exploratory nature of the study are limitations that prevent broader generalizations, but they provide valuable insights for future research and practice.

In summary, the articulation between bibliometric analysis and the empirical evidence from questionnaires suggests that data protection does not constitute an end in itself, but an instrumental element for the construction of valid, reliable, and contestable evidence in criminal proceedings. The admissibility and procedural use of digital evidence from corporate investigations were more associated with the formalization, documentation, and legal legitimation of investigative practices than with the technology employed, especially in transnational contexts such as the comparison between Brazil and the Netherlands, directly responding to the general objective of the study.

4. Conclusion

This study analyzed the extent to which evidence obtained in corporate investigations, arising from the monitoring and seizure of electronic devices provided by companies, such as smartphones, can be considered valid and used in criminal proceedings. Through bibliometric analysis, it was found that the international debate on digital evidence has focused on data protection, informational governance, and chain of custody, indicating that evidentiary validity is intrinsically linked to the legitimacy of data processing and the robustness of technical safeguards. Complementarily, the application of questionnaires to professionals in Brazil and the Netherlands revealed differences in the maturity of investigative practices, the formalization of policies, and team training. It was observed that the admissibility and judicial use of digital evidence were more associated with the formalization, documentation, and legal legitimation of organizations’ investigative practices than with the technology employed. The main contribution of this work lies in the articulation of these analytical axes of data protection with the legal-procedural vocabulary, confronting them with concrete practices in transnational organizational contexts.

It was identified that data protection functions as an instrumental element for the construction of valid, reliable, and contestable evidence in criminal proceedings. However, the study presented limitations, such as its exploratory nature, the reduced sample size, and reliance on self-reported answers, which prevent broad generalizations. From a practical and managerial standpoint, the findings offer subsidies for compliance, corporate legal, and internal investigations areas, recommending that organizations formalize investigation and monitoring policies, define criteria for necessity, proportionality, and minimization, document decisions and chain of custody steps, periodically train teams, and establish specific controls for transnational sharing and the use of automated tools. For future studies, it is suggested to expand the empirical base, include other sectors or jurisdictions, and deepen the impact of automated tools and artificial intelligence on the production, preservation, and valuation of digital evidence.

Bibliographic References

Brasil. 1988. Constituição da República Federativa do Brasil. Diário Oficial da União, Brasília, DF, Brasil, 5 out. 1988. Seção 1, p. 1-167.

Brasil. 2018. Lei nº 13.709, de 14 de agosto de 2018. Dispõe sobre a proteção de dados pessoais e altera a Lei nº 12.965, de 23 de abril de 2014 (Marco Civil da Internet). Diário Oficial da União, Brasília, DF, Brasil, 15 ago. 2018. Seção 1, p. 5

Castells, M. 2016. A Sociedade em Rede. Paz e Terra, São Paulo, SP, Brasil.

Faraco, A.D.; Forsman, G.C.C. 2021. Investigações internas: melhores práticas internacionais e a experiência brasileira. Revista do IBRAC 26(2): 300-315.

Organisation for Economic Co-operation and Development [OECD]. 2013. The OECD Privacy Framework. OECD Publishing, Paris, France. Disponível em: <https://web-archive.oecd.org/2013-09-05/247484-oecd_privacy_framework.pdf>. Acesso em: 10 mar. 2026.

Article originating from the Final Course Work of the Specialization in Compliance and ESG of the MBA USP/Esalq

To learn more about the course, click here and access the MBX Academy platform