Investigations & evidence · employee and leaver enquiries
The pattern repeats: files funnelled into a personal cloud account, a USB stick at odd hours, a laptop handed back suspiciously clean. Digital traces of all of it usually remain. We recover them the lawful way — device secured promptly, examined to an evidential standard, written up so HR and your solicitors can actually use it.
A quiet word, in confidence
0800 6890668
| What's needed | The practical effect | Our answer to it |
|---|---|---|
| UK GDPR / DPA 2018 | Examining even company-owned devices needs a lawful basis — usually legitimate interests, balanced and documented | Scope stays narrow: only the data the suspicion justifies |
| The ICO's monitoring guidance, October 2023 | Transparency by default, with a DPIA when the risk runs high | We check your policies first and say when an assessment is needed |
| Covert examination | Only exceptionally justifiable — where crime or gross misconduct is suspected — and then with senior authorisation | We won't start without that written sign-off in front of us |
| ACAS expectations | Disciplinary action must rest on a reasonable, balanced investigation | Our examination is independent — nobody edits our conclusions |
| How tribunals weigh it | Probative value is set against the manner of collection | Custody records that strengthen the evidence instead of undermining it |
Each new instruction starts with a confidential conversation — what has happened, which devices and accounts matter, and what the evidence needs to prove. You then receive a single written quote, fixed before any examination begins, and that opening scoping work costs nothing.
Laptop, desktop or loose drive — it goes behind a write blocker and gets imaged within days, before a reissue, a rebuild or an inquisitive colleague wrecks the artefacts.
The image gives up USB connection records, cloud sync and webmail traces, deletion patterns and any wiping tool that ran. We arrange them into one timeline: what left, when, and by which route.
You receive a clear written account, framed for HR and legal use, with the ICO's monitoring guidance of 2023 and the ACAS standard of a fair investigation kept in view throughout.
You receive everything: report, exhibits and the files behind them, plus the hashes, the continuity record and our working notes. If a tribunal or another expert wants to test it later, they can walk the whole trail step by step.
One figure with some weight behind it: the 2013 Symantec/Ponemon research found about half of recently departed employees admitted keeping confidential material from their old employer. Most newer percentages come from vendors and vary wildly. Bench experience is simpler: when an employer already suspects data walked, the artefacts generally agree.
The first clue was a competitor's pitch deck landing in front of a Barnstaple employer. From there, digital timelines told the story: a single folder gathering the files, a sign-in to a personal cloud account, the uploads made — every bit of it twenty days before any resignation letter went in. Undertakings closed it down quickly.
Generally yes — where a lawful basis exists and staff knew examination was a possibility, which is exactly what an acceptable-use policy is for. Covert examination is rare, reserved for suspected crime or gross misconduct and authorised at senior level.
Rarely. The ICO's October 2023 guidance allows covert monitoring only in exceptional circumstances — suspected crime being the classic case — with senior sign-off, a tight scope and a written record.
Put the device somewhere secure and leave it be, don't close or wipe their accounts, and have it imaged before anyone in the office has a look round. Even an innocent browse through the files tramples the traces that show data walked out.
Tribunals weigh how useful material is against how it was obtained. A lawful basis, a scope kept proportionate and a documented chain of custody are the difference between a folder of screenshots and evidence with real weight.
Recorders overwrite on a loop, evidence weakens, time limits pass. Open a case early — the first look is free and confidential.