Investigations & evidence · staff and leaver cases
A client database copied into private cloud storage, a memory stick plugged in the evening before notice, a scrubbed laptop handed over with a smile — the traces nearly always survive. Our job is to surface them lawfully: secured early, examined to a proper standard, and reported so HR and your legal advisers can act.
Speak to us in confidence
0800 6890668
| The requirement | What that means in practice | How we meet it |
|---|---|---|
| DPA 2018 / UK GDPR | You need a lawful basis to look at company kit — normally legitimate interests, weighed up and recorded | Kept to the suspicion; no more data than needed |
| ICO guidance on monitoring (October 2023) | Openness as standard; an impact assessment where risk is high | Your policies read first; we flag when a DPIA is due |
| Working covertly | Defensible only in rare cases — suspected criminality or gross misconduct — signed off at senior level | Before anything begins we want the authorisation named, in writing |
| The ACAS standard | A fair, even-handed enquiry ahead of any disciplinary step | An independent examiner; the conclusions stay ours, not HR's |
| Weight at tribunal | How material was gathered is balanced against what it proves | A documented chain of custody that adds weight rather than doubt |
Every instruction opens with a private discussion: the events so far, the devices and accounts involved, and the question the evidence has to settle. Before any examination is carried out you get one fixed quote in writing — and that first scoping stage is free.
Whatever came back — laptop, tower or bare drive — is imaged behind a write blocker within days, before a rebuild, a handover or a curious look destroys the artefacts.
From the image we pull back device connections, cloud and webmail traffic, deletions and any wiper that ran, then order them into a sequence: what went, when, and by what route.
A written account of what was found, pitched so HR and your solicitors can use it — built around the ICO's 2023 monitoring guidance and the ACAS test of a reasonable enquiry.
What comes back to you is the full set — the report, its exhibits, the underlying files — along with hashes, continuity logs and the notes we made as we worked. Should another expert or a tribunal later probe it, every step can be retraced.
The number worth quoting: one of the more substantial pieces of research — the 2013 Symantec/Ponemon survey — found roughly half of workers who had lately resigned or been let go admitted holding on to confidential company material. Later numbers come mostly from suppliers and scatter widely; from the bench the position is plainer: where an employer already suspects it, the artefacts usually line up.
It began when a Salisbury employer read a rival's pitch deck. The timeline filled in the rest: documents gathered into a single folder, a private cloud account logged into, uploads finished — twenty days ahead of the resignation letter. Undertakings settled the matter, and fast.
Usually yes, provided there's a lawful basis and, as a rule, staff have been told it may happen — that's the purpose of a workplace policy. Examining covertly is the exception, kept for suspected criminality or gross misconduct signed off at senior level.
Only in rare cases. Under the ICO's October 2023 guidance, covert monitoring can be justified in unusual situations such as suspected crime — signed off at senior level, narrowly scoped and written down.
Lock the device away untouched, keep their accounts intact, and get the machine imaged before any colleague starts poking about. A casual look through the files destroys the very traces that prove data left.
A tribunal balances relevance against the way material was gathered. Lawful basis, a proportionate scope and a recorded chain of custody are what lift a folder of screenshots into evidence that carries weight.
Loops write over themselves, traces fade, deadlines run out. Start a case early — scoping it costs nothing and stays confidential.