This blog focuses on the issue that most often employers fail to present admissible evidence in court in the offence related to employees. It gives some suggestion about what can be done about it
In an era where digital footprints drive business decisions, legal disputes involving employees are increasingly dependent on electronic evidence. Whether it’s a case of data theft, harassment, policy violation, or wrongful termination, the success of an employer’s defense or prosecution often hinges on the admissibility of digital evidence in court.
Yet, despite having volumes of logs, emails, device data, and CCTV footage, employers frequently fail to get this evidence admitted in court.
Why Does This Happen?
1. No Chain of Custody: Courts need to know that electronic evidence hasn’t been tampered with. If the organization cannot prove how the data was handled from the point of collection to its presentation in court, it’s likely to be rejected.
2. Lack of understanding of Section 63 Compliance (BSA, 2023): Under the Bhartiya Sakshya Adhiniyam, an electronic evidence must qualify certain criteria and should be accompanied by a certificate under Section 63(4)(c), attesting to their authenticity. This is most often missed by internal teams.
3. Informal Investigation Practices: Often, HR and IT collect evidence without formal documentation or legal oversight. This includes screenshots, forwarded emails, or verbal testimonies that don’t stand the test of judicial scrutiny.
4. Disconnected HR, IT, and Legal Functions: In many cases, HR leads disciplinary action, IT holds the data, and Legal is brought in too late. The lack of coordination leads to procedural lapses and legal blind spots.
5. Inadequate SOPs for Digital Exits and Employee Investigations: Critical evidence is often lost at the time of employee exit due to the absence of documented, repeatable SOPs that are forensically aware and legally sound.
The Role of ISO 27037 in Digital Evidence Collection
ISO/IEC 27037:2012 provides international guidelines for the identification, collection, acquisition, and preservation of digital evidence. Organizations that follow these principles are better positioned to produce admissible evidence. Key factors include:
-
Preservation of Original Evidence: Ensuring no modification to the original data during the collection process.
-
Use of Qualified Personnel: Only trained personnel should handle evidence to maintain credibility.
-
Documentation: Every action taken on the evidence must be properly logged.
-
Chain of Custody Management: Every handover of evidence should be logged with timestamps and responsible personnel.
-
Tool Validation: Tools used for data collection must be validated to ensure reliability and acceptance in court.
Following ISO 27037 not only helps in admissibility but builds internal processes that are defensible and repeatable.
For Existing and Exiting Employees: What Employers Must Do
For Existing Employees:
-
Maintain continuous logs of activity (email, access logs, CCTV, etc.) in compliance with privacy and legal norms.
-
Establish incident response and evidence retention protocols aligned with ISO 27037 and BSA 2023.
-
Conduct periodic digital behavior audits in sensitive departments (finance, legal, IT).
At the Time of Exit:
-
Implement forensic-grade exit checklists.
-
Take disk images of official laptops before formatting.
-
Archive and hash critical emails and files.
-
Record employee declaration about data deletion and return of IP.
-
Ensure proper chain of custody for all devices.
-
Document everything with timestamps and digital signatures.
Without these precautions, companies risk losing vital evidence that could make or break a legal case.
What Needs to Be Done
To ensure legal admissibility of employee-related evidence:
-
Create SOPs for digital investigations and employee exits that include checklists, documentation formats, and role clarity between HR, IT, and Legal.
-
Train HR and IT teams to handle digital evidence as per Bhartiya Sakshya Adhiniyam, 2023 and ISO 27037.
-
Implement digital chain of custody practices using simple templates and forensic tools.
-
Ensure Section 63(4)(c) certification is prepared whenever electronic evidences are involved.
-
Conduct audits to evaluate current gaps in evidence handling and SOP compliance.
How CorpoTech Legal Help you understand it better
At CorpoTech Legal , we specialize in aligning HR, IT, and Legal workflows with court-ready evidence practices. Led by a Cyber Lawyer Ajay Sharma with over 35+ years in HR leadership roles across global tech companies, clubbed with knowledge of Cyber law and Cyber Forensics, we:
-
Design court-admissible SOPs for digital exits and investigations
-
Provide ready-to-use compliance templates (exit forms, chain-of-custody logs, 63(4) formats)
-
Offer training to HR and IT teams on forensic handling
-
Conduct digital evidence audits
-
Align documentation practices with ISO 27037 standards
If your organization wants to be future-ready and litigation-proof in employee matters, we’re here to help.
Disclaimer: This article is for general informational purposes only and does not constitute legal advice. For advice specific to your situation, please consult a qualified legal professional.