Dawn Raids: What Competition Authorities Can Do — and What Your Team Must Do

Dawn raids are competition enforcement’s sharpest instrument, and the moment a company’s compliance program is genuinely tested. Everything depends on preparation made months earlier: a protocol people can follow while nervous, trained reception staff, pre-mandated counsel, and clarity about what may and may not be refused. This guide walks the raid from doorbell to aftermath across the EU, Türkiye and other regimes — part of the compliance pillar of our Competition & Antitrust hub.

What happens in the first hour?

The clock starts at reception. Trained front-desk staff take the inspectors to a designated room, request and photograph the authorisation decision and IDs, and trigger the alert list — legal, IT, the senior site manager, external counsel — while making clear the company will cooperate fully and counsel is on the way. Inspectors may begin immediately and need not wait for lawyers, but in practice most accept a short, reasonable delay if cooperation is visible.

Immediately in parallel: IT suspends automatic deletion policies and any auto-purge on mail and messaging systems (this is protective, not obstructive, and must be documented as such); the raid team assembles escorts so no inspector is ever unaccompanied; a scribe starts the log of every room entered, every document viewed or copied, every question asked and answered. Staff not involved are told, in writing, to continue working normally, not to discuss the inspection externally, and to route any inspector contact through the raid team. The most common early failure is silence at the top — an unmanaged workforce improvises, and improvisation is where obstruction happens.

What is the scope of the decision — and why does it matter?

The authorisation defines the subject matter and purpose of the inspection: the products, the suspected conduct, the period. Inspectors may search for material within that scope anywhere on the premises, but material clearly outside it may be challenged — and “fishing” beyond the decision is one of the few grounds on which inspections have been successfully annulled or evidence excluded. Reading the decision carefully in the first fifteen minutes is therefore both a legal act and an operational one: it tells your team what documents matter.

Practicalities: keep a copy of the decision available to every escort; log any request that appears out of scope and raise it politely with the lead inspector at the time, recording the exchange rather than refusing outright; and note that authorities routinely discover a second infringement in seized material — evidence outside the original scope can generally be used to open a new investigation, which is why leniency scoping for adjacent conduct becomes urgent the same week. Türkiye’s Board and the Commission both operate this way; assume everything imaged will eventually be read.

How do privilege and personal devices work?

Privilege is narrower than most executives assume. In EU proceedings, legal professional privilege covers communications with independent external lawyers qualified in the EEA for the purpose of the defence — in-house counsel advice is not privileged. National regimes differ: Türkiye recognises attorney-client privilege for external counsel with practical limits, the UK protects in-house legal advice, and US privilege is broader still. Multi-jurisdictional groups should assume the EU standard for anything that might land in a Commission file, and route sensitive competition analysis through external counsel accordingly.

Procedure matters: privileged documents encountered during a raid are placed in a sealed envelope and the dispute resolved later, not read on the spot — insist on that process, and log each item. Personal devices used for work (BYOD phones, personal email with business content) are within reach in most regimes, and messaging apps are the first target: inspectors routinely image phones and ask for chat exports. The compliance consequence is prospective — a BYOD policy that anticipates inspection, with clear rules on business use of personal messaging, is worth more than any argument made on the day.

How should staff answer questions?

Factually, narrowly and truthfully — or not at all where they lack knowledge. Inspectors may ask on-the-spot questions about facts and about documents found: where a file is kept, what an abbreviation means, who attended a meeting. Employees must answer such questions and must not give false or misleading answers (a separate offence), but they are not obliged to provide legal characterisations or to admit an infringement, and “I don’t know — the company will provide that in writing” is a legitimate, protective answer that counsel should encourage.

Practical discipline: one company representative present for every interview, a verbatim note taken, no speculation, no explanations of context beyond the question, no jokes. Corrections should be volunteered promptly and in writing where an answer proves inaccurate — inaccuracy left uncorrected becomes misleading information. After the raid, the company should review the log and file any necessary clarifications; that memo is also the first draft of its internal-investigation scope, and often the moment the leniency clock starts running in earnest, as our leniency guide sets out.

What happens after the inspectors leave?

The consequential week. Assemble the log and mirrored materials, run a privileged internal review of what was taken to establish exposure, and decide — fast — whether to apply for leniency in each affected jurisdiction, because a raid usually means the authority already has a first applicant somewhere and the remaining reductions are being claimed in order. Simultaneously assess parallel jurisdictions: raids are often coordinated internationally, and a filing in one regime without the others is an incomplete strategy.

Then handle the organisation: preserve everything (litigation hold formalised), manage communications (employees, customers, sometimes markets — listed companies face disclosure judgments), and avoid the two classic post-raid errors — precipitate disciplinary action that creates hostile witnesses, and reassuring public statements that later conflict with the file. Finally, treat the raid as data: whatever it found, the compliance program missed it, and the remediation record you build now will be read by the same authority when it sets the fine. Companies that emerge best treat the aftermath as the beginning of cooperation and reform, not as a siege.

What should the written protocol contain?

One page for reception, one for the raid team, one for IT, and a contact card. Reception: where to seat inspectors, whom to call, what to say (“we will cooperate; our counsel is being contacted now”), and not to discuss anything else. Raid team: escort rules, scribe templates, scope checking, privilege handling, mirroring requirements, interview attendance. IT: the deletion-suspension switch, imaging support, device inventory, and a rule that no remote wipe is executed for any device on site.

Add the contact card — external counsel (with out-of-hours numbers), the general counsel, the site lead — laminated at every reception desk in every country. The whole package should be short enough to read while adrenalised, and it should be tested annually. Multi-site groups must localise it: language, local counsel, local authority powers (Türkiye’s inspection rules and automatic obstruction fines differ from the Commission’s in detail that matters on the day).

How do simultaneous multi-country raids change the response?

They compress every decision. Coordinated inspections across a group’s sites in several jurisdictions — increasingly common through authority cooperation — mean the company must run parallel protocols with local counsel at each site while a central team assembles the picture in real time. The immediate priorities are consistency (the same instructions everywhere, so no site’s conduct becomes the outlier) and speed of assessment, because the leniency queue in every affected regime is being filled during the same hours.

Practical arrangements that pay for themselves: a pre-agreed panel of local counsel with out-of-hours coverage in every country where the group has meaningful operations, a single incident-command bridge line, and a template for the first internal communication so no site improvises its own message. Groups that improvise all three routinely lose a day — and a day is a plausible difference between immunity and a 30% reduction, as our leniency guide shows.

Frequently Asked Questions