For employers in Cardiff · digital evidence in exit cases
The laptop comes back tidy, and the tidying is the point. Windows and the sync clients keep notes of their own, and those outlast a clear-out. A rule quietly forwarding mail to a personal address. A USB stick attached at 22:40 on a Friday. Downloads emptied on the morning of the exit interview. We take the device out of circulation, image it to evidential standard, and give you an account in writing that HR and a solicitor can use.
Speak to us in confidence
0800 6890668
| What counts | What it asks of you | How we keep inside it |
|---|---|---|
| UK GDPR and the Data Protection Act 2018 | Ownership is not a lawful basis by itself. Pick one — legitimate interests, in most cases — then balance it and write it down before day one | We size the search to the suspicion in front of us, and go no wider |
| The ICO's October 2023 guidance on monitoring workers | Telling people is the default; a DPIA where the risk is high | We read your policies before we read the disk, and say outright if a DPIA is needed |
| Searching unannounced | Only defensible in exceptional cases — suspected crime, gross misconduct — and only once someone senior has signed it off | Nothing is imaged and nothing is read until we hold that on paper |
| What ACAS expects | A disciplinary outcome must stand on a fair and proportionate enquiry | What we find is ours to report, and it goes out exactly as we found it |
| Standing at tribunal | Evidence is worth what the method behind it is worth | A chain-of-custody log that shores the case up instead of giving the other side a way in |
It starts with a private conversation, and that costs nothing. Three things shape everything after it: what has happened, where it reaches — which machines, which accounts — and what the evidence needs to establish. Those answers set the scope. The scope sets the single written price, quoted before a device is touched.
Two weeks is where most evidence goes, and almost never on purpose. The laptop gets rebuilt for the next starter. The disk goes into the spares box. A manager decides to have a quick look. A write-blocked image, made early, gets in ahead of all three.
Work runs on the copy from that point, and the original goes nowhere. We track every removable drive and the hours it was connected, files pushed into personal cloud accounts or hung off webmail, what was deleted, and whether anything ran to scrub the disk. One timeline holds the lot.
The report is built for readers who are not technical — a solicitor, an HR panel, a tribunal. It measures the work against the ICO's 2023 monitoring guidance and against the fair investigation ACAS asks for. Should it end up with the police, nothing needs changing.
A report is only worth what someone else can check, so it never travels alone. Out go the exhibits, the source files, the continuity log, every hash value, and the notes made at the bench. An expert instructed against you can walk it again and reach the same place.
The one figure worth citing: Symantec, working with the Ponemon Institute, reported back in 2013 that about half of people who had lately changed jobs admitted to holding confidential material from the old one. Almost everything published since comes from a company with something to sell, and the numbers disagree with each other. What our own casework shows is flatter — an employer who arrives with a named suspicion, rather than a vague unease, usually finds the artefacts back it.
The employer in Bridgend arrived with a competitor's pitch deck and nothing else. What settled it was the timing: the last upload sat twenty days ahead of the resignation letter. Files pulled into a single folder, a personal cloud account signed into, then the transfer, in that order. Undertakings closed the matter.
Ownership settles very little. You still need a lawful basis, and your people must already know their devices can be checked — that is what an acceptable-use policy is for. If nobody was told, expect an argument. Searching without telling anyone is held back for suspected crime, and a director signs it off.
Rarely, and never as standing practice. The ICO's October 2023 guidance keeps it for exceptional cases — suspected crime being the example it gives — and still expects a tight scope, authority from the top, and a written record of why you decided the way you did.
Preservation, before anything else. Put the machine in a drawer, leave the mailbox and cloud accounts running instead of closing them, and wait for a forensic copy before anyone opens a folder. A well-meant look through the drive overwrites the timestamps that would have told you what went out.
Method matters as much as content. Damaging findings lose their bite the moment the route to them can be pulled apart. A screenshot carries weight only when there was a lawful basis behind it, the search stayed inside the suspicion that started it, and every step of handling was recorded.
While that recorder keeps writing, the clip you need is being covered over — and your deadline has not moved. Book it in. The first look is free, and it stays private.