Investigating workplace misconduct is no longer as simple as reviewing a few emails and speaking to a handful of witnesses.
In a hybrid working environment, evidence is often spread across multiple platforms. A complaint that starts with a Teams message may quickly lead an investigator into WhatsApp groups, Zoom chats, documents on cloud-based systems, and screenshots circulating between colleagues.
Say an employee raises concerns about bullying. The alleged conduct took place partly in a Teams chat, but conversations then continued in a WhatsApp group involving several team members. Some messages have been deleted, screenshots have been shared outside the group, and key communications may sit on personal phones rather than company systems. What looked like a straightforward grievance can quickly become much more complicated.
The difficulty lies in working out what evidence is relevant, where it is held, how it can lawfully be obtained, and how much weight should attach to it. ACAS guidance emphasises the importance of conducting investigations fairly, reasonably, and without unreasonable delay.
Investigators should consider digital evidence from the outset, including where relevant material is likely to be stored and whether steps are needed to preserve it. Digital evidence can disappear quickly through routine deletion, retention settings, or deliberate tampering.
Personal devices often create the greatest difficulties. Many organisations operate hybrid or bring your own device (BYOD) arrangements and do not provide employees with work phones or laptops. However, employers cannot simply demand unrestricted access to an employee’s personal device, even where work-related messages may be stored on it.
Instead, investigators need to step back and ask practical questions. Whose messages are they? What is their connection to work? How should the information be obtained? How much of the material is genuinely relevant? Is there a less intrusive way of obtaining the evidence?
Those questions matter from both a fairness perspective and a legal one. The Information Commissioner’s Office (ICO) emphasises that monitoring workers’ communications should be necessary and proportionate. Employers should also be mindful of employees’ right to respect for private and family life under Article 8 of the European Convention on Human Rights.
Clear workplace policies can make a difference. Acceptable use, monitoring, BYOD, and data retention policies should reflect how employees actually communicate in practice, rather than how an organisation assumes they communicate. Employees should understand when work-related communications may be accessed and how information will be handled.
Even where evidence has been obtained, assessing it is not always straightforward. A screenshot may show only part of a conversation, and investigators may not always know whether messages have been deleted or altered. A message that appears inappropriate when read in isolation may look very different when viewed alongside the wider exchange. Investigators should be cautious about reaching conclusions from individual messages without considering the wider exchange, who was involved, and the purpose of the communication.
Employers should also remember that an internal investigation may not end there. Evidence gathered during a grievance, disciplinary process, or misconduct investigation may later become relevant in Employment Tribunal proceedings. By that stage, it may be too late to recover deleted information. At the same time, digital evidence often contains sensitive information about employees and witnesses, meaning privacy and data protection considerations remain important.
This is likely to be even more important over the coming year. From October 2026, the time limit for most Employment Tribunal claims will increase from three months to six months. New obligations relating to sexual harassment and third-party harassment will also bring employers’ responses to workplace concerns under closer scrutiny.
For HR teams, that means records of what was reported, what evidence was considered, and what steps were taken may need to be retained longer and be able to stand up to scrutiny further down the line.
The growing use of generative AI presents another challenge. Employers may increasingly receive AI-assisted grievances, complaints, and witness statements, while investigators may use the same technology to review large volumes of material. But identifying keywords or patterns is not the same as establishing what happened. Context, credibility and reliability still require human judgement.
The volume of digital evidence available to employers has never been greater. But more evidence does not necessarily make investigations easier. Employers with clear policies, robust processes for preserving and reviewing evidence, and a documented decision-making process will be far better placed if workplace concerns develop into formal disputes.
This article was first published by People Management.
