Employers · digital evidence in employment matters
Windows and the cloud services people use at work keep records of their own, and those records outlast the tidying up: an account syncing to a private address, a drive attached late on a Friday, a machine handed back with its downloads folder unusually empty. The work starts by securing the device and copying it to an evidential standard, and ends in a written account HR and your solicitor can act on.
Go through it with an engineer
0800 6890668
| What's needed | What it requires of you | How the bench applies it |
|---|---|---|
| Data protection law: UK GDPR, DPA 2018 | Ownership of the device does not settle it: an examination needs a lawful basis, normally legitimate interests, balanced and written down | The scope is drawn to the suspicion itself, and never any wider |
| Monitoring workers: ICO guidance, October 2023 | Transparency is the default; where risk is high, a DPIA | We read your monitoring and acceptable-use policies first, and say when a DPIA is owed |
| Examining without notice | Justifiable only in exceptional circumstances — suspected crime, gross misconduct — and only on senior authority | Nothing is imaged or read until that authority exists on paper |
| What ACAS expects | A disciplinary step rests on an investigation that was fair and proportionate | We report independently: the findings go out as we found them |
| Treatment at tribunal | How the material was obtained bears on how much it is worth | A continuity record that adds to the case instead of opening a line of attack |
Every instruction opens in confidence. You set out the incident, the devices and accounts it touches, and what the evidence has to establish; that settles the scope, and the scope settles the single written quote you receive before any examination starts. The scoping conversation is free.
Three things destroy the evidence first: a machine reimaged for the next user, a disk put back into stock, a manager who has a quiet look. Imaging behind a hardware write blocker, within days, gets ahead of all three.
Everything after that is read from the image, never the original: USB devices and when they were attached, files synced to personal cloud storage or sent through webmail, deletions, and any sign a wiping tool ran. It is set out as one timeline.
Written for readers who are not examiners — an HR panel, a solicitor, a tribunal — it shows how the work met the ICO's 2023 guidance on monitoring and the fairness ACAS expects of an investigation. Thames Valley Police can take it up unaltered.
The point of handing over the lot — report, exhibits, source files, hash values, continuity log and the notes taken at the bench — is that a tribunal, or an expert instructed against you, can repeat the work and reach the same result.
The figure that holds up: in 2013 Symantec and the Ponemon Institute found about half of recently departed employees admitting they had kept confidential material from the job they had left. The percentages published since tend to come from vendors and disagree wildly. The bench offers something less quotable: where an employer arrives with a specific suspicion, the artefacts more often than not support it.
The uploads finished twenty days before the resignation letter arrived, which is what made the sequence so plain: documents pulled together in one place, a private cloud account signed in to, then the transfer itself. A Henley-on-Thames employer had only a rival's pitch deck to go on. It closed on undertakings.
Generally it is, provided two things are in place: a lawful basis for looking, and staff told in advance that their devices could be examined — which is what an acceptable-use policy exists to do. Covert examination is the exception, kept for suspected criminality and authorised at senior level.
Rarely, and never routinely. The ICO's October 2023 guidance confines it to exceptional circumstances — suspected criminality being the standard illustration — and then only with senior authorisation, a tightly drawn scope and a written record.
Preserve first, examine later. Put the machine somewhere secure, leave the mailbox and cloud accounts intact rather than closing them, and have a copy taken before anyone opens a folder. A well-meant browse overwrites the timestamps that show what was copied out.
Content and method are weighed together: what the material shows counts for less where the gathering is open to attack. Screenshots carry weight only if a lawful basis stood behind them, the scope stayed proportionate, and continuity was recorded throughout.
Loop recording is already writing over what you need, and the deadline will not move. Open a case today: the diagnosis costs nothing and stays confidential.