Employers · digital evidence in conduct and leaver cases
A leaver hands back a laptop and it looks clean. Underneath, Windows and the sync clients have been keeping their own notes, and those notes survive the clear-out — a mailbox forwarding to a private address, a drive plugged in at half past ten on a Friday night, a downloads folder emptied the morning of the exit interview. We secure the device, copy it to an evidential standard, and give you a written account your HR team and solicitor can work from.
Call us, in confidence
0800 6890668
| What applies | What it demands of you | How we work within it |
|---|---|---|
| Data protection: UK GDPR and the DPA 2018 | Owning the laptop is not a lawful basis in itself. You need one — usually legitimate interests — weighed and recorded before you start | We cut the scope to the suspicion you actually have, and no further |
| ICO guidance on monitoring workers, October 2023 | Openness is the default, and a DPIA where risk is high | Your policies are the first thing we read, and we say plainly whether a DPIA is due |
| Looking without notice | Defensible only where the circumstances are exceptional — suspected crime, gross misconduct — and only with senior sign-off | No image is taken, and nothing is read, until that sign-off is on paper |
| The ACAS standard | Disciplinary action has to rest on a fair, proportionate investigation | Our findings are our own, and they leave here exactly as we found them |
| Weight at tribunal | What the evidence is worth depends on how it was collected | A custody record that strengthens the case rather than handing over an opening |
Nothing begins until we have talked it through privately. Tell us what happened, which devices and accounts it reaches, and what the evidence has to prove; those three answers fix the scope, and the scope fixes the one written price you receive before anyone examines a device. That conversation is free.
Most evidence dies in the first fortnight, and rarely from malice. The laptop is wiped for the next starter, the disk goes back in the spares cupboard, or a manager has a look for themselves. A write-blocked image, taken in days, beats all three.
From then on the copy is examined and the original sits untouched. We account for removable drives and when they were plugged in, files pushed to personal cloud storage or attached to webmail, what was deleted, and whether a wiping tool ran. It all lands on one timeline.
Written to be read by non-specialists — the HR panel, the solicitor, the tribunal. It sets the work against what the ICO asked for in its 2023 monitoring guidance, and against the fairness ACAS expects of an investigation. If it reaches the police, it goes as it stands.
Everything goes across: the report, the exhibits, the source files, hash values, the continuity log and the notes written at the bench. An opposing expert, or the tribunal itself, can repeat every step and end up with the same answer.
The one number worth quoting: a 2013 study by Symantec and the Ponemon Institute had roughly half of people who had recently left a job admitting they still held confidential material from it. Most figures published since come from firms selling something, and none of them agree. Our own casework says something duller — when an employer arrives with a specific suspicion rather than a general worry, the artefacts usually bear it out.
Twenty days separated the last upload from the resignation letter, and that gap is what made the order of things obvious: files gathered into one folder, a personal cloud account logged into, then the transfer. All the Worcester employer had was a competitor's pitch deck. Undertakings closed it.
Owning the hardware is not the answer on its own. You need a lawful basis for the examination, and staff must have been warned beforehand that their devices might be looked at — that warning is the job of an acceptable-use policy. Going in unannounced is reserved for suspected crime, signed off by a director.
Almost never, and certainly not as a habit. The ICO's guidance of October 2023 holds it back for exceptional circumstances, with suspected crime as the usual example, and even then it wants senior sign-off, a narrow scope and a note on file explaining the decision.
Nothing gets examined until it has been preserved. Lock the machine away, keep the mailbox and cloud accounts open rather than shutting them down, and let a forensic copy be made before a single folder is clicked. One helpful look around rewrites the very timestamps that would have shown what left.
It looks at how you got it as much as what it says. Strong material loses its force if the method behind it can be picked apart. A screenshot counts for something only where there was a lawful basis, the search stayed within its suspicion, and the handling was logged from start to finish.
Every hour the recorder runs, more of what you need is gone, and the deadline stays where it is. Book it in now: the diagnosis is free and stays confidential.