DOLE rules, case-law principles, and best-practice playbooks (Philippine private sector)

Short answer: Yes, preventive suspension (PS) can be extended with pay beyond 30 calendar days if the investigation isn’t finished, and yes, a separate PS may be issued for a distinct and independently serious new violation—but employers must avoid using serial PS orders to circumvent the 30-day cap. Each PS must have its own lawful basis, satisfy due-process requirements, and be limited to situations where the employee’s continued presence poses a serious and imminent threat to life, property, or the integrity of the investigation.

1) What preventive suspension is—and isn’t

Purpose: A temporary measure to immediately remove an employee from the workplace while an investigation is conducted, where presence poses a serious and imminent threat to co-workers, company property, operations, or the integrity of evidence.
Not a penalty: PS is not a disciplinary sanction. Any penalty (e.g., suspension without pay as punishment, demotion, dismissal) may be imposed only after due process and a finding of just cause.
30-day cap: By default, PS may run up to 30 calendar days (count weekends/holidays). If the inquiry needs more time, the extension period must be paid (wages and benefits).
Status and pay:
- Initial ≤30 days: generally no work, no pay (unless company policy/CBA says otherwise).
- Beyond 30 days: the extension must be with pay and continuity of benefits.
After PS: Employer should either (a) return the employee to work, or (b) issue a penalty (if warranted) after observing due process.

2) Legal bases and governing standards

Labor Code (PD 442) & Implementing Rules: Preventive suspension is recognized as a provisional measure subject to the 30-day rule and the “serious and imminent threat” test.
DOLE rules on termination and due process: Require notice and opportunity to be heard; PS is allowed only when strictly necessary to protect life, property, or the investigation.
Jurisprudence (guiding principles):
- PS is a management prerogative but is strictly regulated; it cannot be used as a substitute for dismissal or as a penalty by itself.
- Extensions must be paid and justified by continuing necessity.
- Indefinite or serial PS used to skirt the 30-day limit can amount to constructive dismissal or illegal suspension.
- The “serious and imminent threat” threshold is fact-sensitive; the employer must be ready to show concrete risks (tampering with records, intimidating witnesses, safety threats, etc.).

Note: This article focuses on private-sector employment. Public sector (CSC) rules differ.

3) The core question: extending PS when a new violation arises

A) If the investigation of the first case isn’t done by Day 30

You may extend the PS with pay, stating why more time is required (e.g., forensic audit pending, key witnesses unavailable).
The extension letter should indicate the paid nature of the extension, the specific additional steps needed, and an expected completion window.

B) If a new, distinct violation is discovered (or occurs) during an ongoing PS

You may issue a separate PS only if:
1. The new violation is factually distinct from the first, and
2. The employee’s presence would independently pose a serious and imminent threat (e.g., the new case involves data wipes or witness intimidation).
Do not “restart the 30-day clock” on the same facts by re-labeling memos. DOLE and the courts look at substance over labels.
Overlap and pay rules:
- While Case 1 PS is on paid extension (beyond Day 30), and a new Case 2 PS is imposed, be conservative: keep the employee in paid status for any period that would otherwise exceed the first 30 days.
- If Case 2 is truly separate and serious, its own 30-day window may run—but be prepared to defend that it’s not a device to avoid pay on Day 31+. Document the independent threat posed by Case 2.

C) If the “new violation” predates PS but was only discovered later

You may incorporate it into the ongoing investigation and, if more time is needed beyond Day 30, keep the status as a paid extension—unless the newly discovered act independently justifies a fresh PS (e.g., a new, credible threat surfaced). Again, document why a separate PS is necessary.

D) If a new violation occurs after return-to-work

You may impose another PS for the new case, so long as the serious and imminent threat test is satisfied and due process is followed anew.

4) Due process, paperwork, and timelines

Minimum due-process steps (administrative cases)

Notice to Explain (NTE) / Charge Memo
- Describe the act(s), when/where, policies breached, and evidence available.
- Give reasonable time to answer (commonly 5 calendar days, or as CBA/policy states).
(Optional but recommended) Administrative conference
- Allow the employee to appear with a representative, answer questions, and present evidence.
Resolution
- Weigh evidence; issue a final notice (dismissal, penalty, or closure with reinstatement).
PS notices (if applicable)
- PS Order: State (a) the serious and imminent threat, (b) start date and duration (≤30 days), (c) paid/unpaid status, and (d) contact and cooperation expectations.
- Extension Notice: If needed beyond 30 days, state paid status, reasons, estimated end, and updates on investigative milestones.

Service of notices

Personal service with acknowledgment, plus registered mail and company email (and messenger apps per policy) if refused. Keep proof of service.

5) Pitfalls and how to avoid them

Serial unpaid PS: Issuing back-to-back 30-day unpaid PS orders on the same incident is a red flag. Treat time beyond Day 30 as paid if the same case is still pending.
Vague “threat”: You need specifics—e.g., access to the financial system used in the alleged fraud, proximity to complainant who reported harassment, or role in a chain of custody.
Open-ended PS: Give target completion dates; provide written status updates on paid extensions.
Mixing PS with penalty: Don’t call PS a “disciplinary suspension.” If you later impose a penalty suspension, don’t credit PS days unless your policy says so. PS is not a penalty served.
No pay on extended PS: Any extension beyond 30 days must be with pay.
Constructive dismissal risk: Long, indefinite paid PS with no movement can still be risky. Keep the investigation active and proportionate.

6) Handling multiple, overlapping investigations

When several cases are live at once:

Run a master investigation plan: issues, witnesses, evidence lists, and segregate access (e.g., IT locks, evidence rooms).
Access controls can sometimes eliminate the threat (e.g., revoke system rights), obviating PS. Use the least restrictive measure that adequately mitigates risk.
If PS is still necessary, explain why access controls aren’t enough (e.g., witness intimidation risk).
Document independence of each case if you issue a separate PS for a new violation.

7) Payroll & benefits during PS

Initial ≤30 days: typically unpaid (unless policy/CBA provides pay).
Beyond 30 days: extension is with pay—basic wage plus benefits continuity (leave accruals per policy, HMO, government contributions).
Overtime/allowances: If normally tied to hours worked, they usually don’t accrue during PS; clarify in policy.
Back pay exposure: If DOLE finds the PS illegal (e.g., no valid threat, over 30 days unpaid, or indefinite), the employer may owe back wages and, depending on bad faith, damages and attorney’s fees.

8) Practical decision tests (quick checks)

Necessity Test: Can access revocation, reassignment, or hybrid work eliminate the risk? If yes, PS may be excessive.
Proportionality Test: Is PS no longer than necessary to complete reasonable investigative steps?
Independence Test (for a new PS): Is the new violation separate from the earlier one and does it independently justify PS?
30-Day Rule: Have you flagged Day 30 and prepared a paid extension letter (if needed)?
Paper Trail: Do you have time-stamped memos, minutes of admin conferences, and evidence logs?

9) Templates (plain-language starters)

A. Preventive Suspension Order (initial, ≤30 days) Subject: Preventive Suspension – [Employee Name] Effective: [Start Date] to [End Date, max 30 calendar days] Basis: Your continued presence poses a serious and imminent threat to [life/property/investigation], specifically: [facts]. Status: This is a preventive measure, not a penalty. During this period, you are directed to refrain from entering company premises and contacting witnesses except through HR. You must remain reachable for the investigation. Due Process: You will receive/You have received a Notice to Explain dated [date], to which you may respond within [x] days. An administrative conference is set on [date/time]. Acknowledgment: [signature block]; Service via [methods].

B. Paid Extension Notice (beyond Day 30) Subject: PAID Extension of Preventive Suspension – [Employee Name] Effective: [Day 31 Date] to [New End Date] Reason: The investigation requires additional time due to [pending audit/forensic results/witness availability], which cannot be expedited without risking evidence integrity. Pay & Benefits: You will remain on payroll with benefits during this extension. Timeline: We expect to conclude the investigation by [date] and will update you on [milestone dates]. Obligations: Continue to be reachable and comply with directives.

C. New/Separate PS (for a newly discovered independent violation) Subject: Preventive Suspension – New Case [Case Ref. No.] Effective: [Start to End, up to 30 days] Basis: Separate from Case No. [first case], you are charged with [new act]. Your presence poses an independent serious and imminent threat because [specific risks]. This PS does not alter your pay status under any paid extension for Case No. [first case] covering [dates].

10) FAQs

Q1: Can we “reset” the 30-day count by issuing another PS on the same case? No. That’s a circumvention. If the same case is ongoing after Day 30, keep the employee on a paid extension while you finish.

Q2: Can we issue PS for poor performance or minor tardiness? Generally no. PS is reserved for threats to safety, property, or evidence integrity, not routine infractions.

Q3: How long can paid extensions last? No fixed statutory maximum, but reasonableness is key. Protracted paid PS without clear progress may still be attacked as oppressive. Use milestones and show active steps.

Q4: If the employee works remotely, is PS still justified? Maybe not—if access restrictions (system lockouts, data segregation) remove the risk. Document why those measures aren’t enough if you still impose PS.

Q5: What if the employee refuses to receive memos? Proceed with registered mail, company email, and other policy-allowed channels. Keep proofs of service and delivery attempts.

11) Employer policy checklist (build or update your handbook)

Define PS, including the serious and imminent threat standard.
State the 30-day limit and paid extension rule in plain language.
Provide timelines for NTE (e.g., 5 days to explain), conference settings, and decision windows.
Clarify pay & benefits treatment for (a) initial PS and (b) paid extensions.
Add access-control alternatives to PS (least-restrictive approach).
Set evidence handling (chain of custody, IT forensics) and non-retaliation safeguards.
Outline procedures for overlapping cases and criteria for separate PS.
Include documentation templates and service-of-notice protocols.
Incorporate data privacy and anti-harassment protections.

12) Bottom line

You can extend PS—but with pay beyond 30 days, and only as long as necessary.
You can issue a new PS for a new, independently serious violation—not to reset the clock on the old one.
The safest path is tight documentation, clear necessity, measured timelines, and paid status once Day 30 passes on any continuing investigation.

Disclaimer: This article provides general information on Philippine labor rules and is not a substitute for legal advice. For high-risk or overlapping cases, consult counsel to align your procedures with your CBA/policies and current jurisprudence.