Evidence & investigations · workplace investigations
Client lists in a personal Dropbox, a USB stick the night before resignation, a wiped laptop handed back with a smile — the traces are almost always there. The job is finding them lawfully: preserved early, examined properly, and reported so HR and legal can actually act.
Talk it through, in confidence
01273 964902
| The rule | What it requires | How we work to it |
|---|---|---|
| UK GDPR / DPA 2018 | A lawful basis for examining work devices — usually legitimate interests, assessed and documented | Scoped to the suspicion; minimum necessary data |
| ICO monitoring guidance (October 2023) | Transparency by default; impact assessments for high-risk monitoring | Policies checked first; DPIA flagged where needed |
| Covert examination | Justifiable only exceptionally — suspected crime or gross misconduct — with senior authorisation | We ask who authorised it, in writing, before we start |
| ACAS expectations | A reasonable, impartial investigation before disciplinary action | Independent examiner; conclusions ours, not HR's |
| Tribunal admissibility | Relevance weighed against how evidence was obtained | Chain of custody that strengthens weight, not doubt |
Every instruction starts with a confidential conversation: what happened, which devices and accounts exist, and what question the evidence needs to answer. You get a fixed written quote before any examination begins — and the initial scoping costs nothing.
The laptop, desktop or drive is write-block imaged the week it comes back — before reallocation, reimaging or 'just checking' destroys the artefacts.
USB connections, cloud and webmail activity, deletions and wiping tools are recovered from the image and assembled into a timeline of what left, when, and how.
A findings report your HR and legal advisers can act on — written to the ICO's 2023 monitoring expectations and the ACAS standard of a reasonable investigation.
You receive the findings — report, exhibits and supporting files — with hashes, continuity records and our contemporaneous notes preserved. If the work is ever tested by another expert or a tribunal, the trail is there to be followed.
The honest statistic: one of the larger studies in this area — a 2013 Symantec/Ponemon survey — found around half of employees who had recently left or lost a job admitted keeping confidential company data. The figures since are mostly vendor surveys and vary wildly; the bench-level truth is simpler: when an employer suspects it, the artefacts usually agree.
A Worthing employer's suspicion started at a rival's pitch deck. The timeline said the rest: files staged into one folder, a personal cloud account signed in, uploads completed — twenty days before the resignation letter. The matter resolved on undertakings, quickly.
Generally yes, with a lawful basis and — normally — transparency about the possibility, which is what workplace policies are for. Covert examination is the exception, reserved for suspected crime or gross misconduct with senior authorisation.
Only exceptionally. The ICO's October 2023 guidance treats covert monitoring as justifiable in rare circumstances such as suspected criminality — senior-authorised, tightly scoped and documented.
Secure the device unaltered, preserve their accounts, and have the machine imaged before anyone in-house explores it. The artefacts that prove exfiltration are exactly what casual browsing destroys.
Tribunals weigh relevance against how evidence was obtained. Lawful basis, proportionate scope and a documented chain of custody are what turn a folder of screenshots into evidence with weight.
Loops overwrite, artefacts age, deadlines pass. Open a case first — the scoping conversation is free and confidential either way.