An insider has taken your confidential information: what the first hours decide
Something that should have stayed inside the business has not, and the only plausible explanation is a person you employ or recently employed. The instinct is to establish who and then put it to them. Acted on quickly, that instinct is how these matters are commonly lost.
Two clocks start running the moment a business notices. The first is evidential: the ordinary record of what was reached, copied or sent is not kept indefinitely, and it is thinned by routine administration rather than by anybody hiding anything. The second is commercial: information decays at its own rate, and part of what has gone may already be worth less than the cost of recovering it. Owners tend to see only the first clock, and usually only after it has run down.
There is a third complication, which is that a single set of facts is normally two legal problems at once. Confidential business material and personal data about identifiable people are governed by different rules and answer to different people. A business that treats the incident as one problem tends to handle both badly.
What follows is why the sequence matters, and where the judgement sits that cannot be made from the inside.
The first hours decide the scope of the problem
The question every business asks first is who did it. The question that has to be answered first is what: what was reachable by whom, what actually moved, and where it went. A name settled on early tends to be the name of whoever was already least popular.
What makes those hours load bearing is that the record is perishable by design. System logs are retained for a period and then cycle. A leaver’s mailbox is closed because the seat is chargeable and nobody wants to pay for an empty desk. Their laptop goes back into the pool, is rebuilt and is handed to the next joiner. None of that is anyone covering their tracks. It is a competent internal function doing exactly what it is supposed to do, on a schedule set long before the problem appeared.
So the safe instruction is the narrow one: stop the routine destruction, and leave the devices and accounts alone rather than looking through them. An examination carried out by a well meaning manager changes the thing being examined, and that will be explained at length, later, by somebody being paid to explain it. Preserving material and examining it are not the same activity, and only the first can safely be done in house.
Why the conversation you want to have should wait
Confronting the person feels like taking control and is in fact the moment control is given away. Once someone understands they are suspected, the accounts they still hold get tidied, the personal storage is emptied, and an account of events is composed. Material that would have settled the position quickly becomes something argued over at length, at a cost bearing no relation to what was taken.
Accusation also carries its own exposure, in both directions. If the suspicion is wrong, the business has created an employment dispute, a possible defamation problem, and a workforce that has watched it happen and drawn conclusions. If the suspicion is right but the process is premature, the individual is handed a procedural complaint to run in place of the facts, and the argument shifts from what they took to how they were treated. Employers do not reliably win that second argument, and it is not the argument they wanted to have.
There is a further reason for restraint. Where matters are genuinely urgent there may be options worth assessing, and whether any of them is available or proportionate in a particular case is a question for somebody who has looked at it properly. Telling the person first can spend an option before anyone has established that it existed.
Proving what left, and when
Most businesses reach moral certainty quickly. Converting that certainty into something a court, an insurer, a buyer or the person’s new employer will act on is a separate exercise, and it is the part that is consistently underestimated.
It is worth naming the audiences that certainty has to satisfy, because they are seldom the ones the business has in mind. An insurer deciding whether the policy responds, a buyer or a funder conducting diligence, the individual’s new employer deciding whether to keep them, and eventually a court in England and Wales all apply their own tests. None of those tests is met by an account of events composed after the event by people who already know how it ends. Each of them wants material that existed at the time and has not been handled since.
In England and Wales, employees owe duties of good faith and confidence during their employment, and written terms can carry part of that obligation beyond the end of it. Whether the terms in your own contracts do what you have always assumed they do is a separate question, and the week of the incident is a poor time to be asking it for the first time.
The same incident, two sets of obligations
If any part of what left identifies living people, and customer records, staff files, applicant details and contact databases all do, then there is a personal data problem sitting inside the confidential information problem. The two behave very differently, and the difference is not technical.
Confidential business information is yours to enforce or to let go. You may decide, on commercial grounds, that a stolen pricing model is not worth pursuing, and nobody is entitled to argue with you. Personal data is not yours in that sense. Under United Kingdom data protection law the obligations run outwards, to the people the data is about and to the Information Commissioner’s Office, and they are not suspended while the business works out whether it wants a fight. The window for considering notification runs from the point the organisation becomes aware, and what counts as awareness is a question in itself.
The two obligations pull in opposite directions. The confidential information strategy wants quiet. The data protection position may require candour, promptly, potentially to a large number of people who will then tell others. Reconciling those is a real decision with consequences on both sides, and it is taken once. Taken wrongly, it costs twice over: either the person is tipped off by a notification nobody sequenced, or a regulator later asks why a business that knew said nothing.
What enforcing it puts on the record
This is the question owners least want put to them, and it is the one that most often decides whether the money was well spent. Enforcement is not a private act. Litigation in England and Wales is conducted in public as a general rule, so a claim about confidential material obliges the business to describe that material, in documents other people may be entitled to see, to a court that will want to know precisely what it says was secret.
Courts have ways of limiting how sensitive material is handled. The protection is partial, it is not automatic, and it has to be asked for. A business can find that the process of protecting the information has placed more of it in front of more people than the incident itself ever did, and that is not a risk anyone weighs while they are still angry about the incident.
There is a further consequence that arrives afterwards. Proceedings become a durable public event attached to the name of the business, findable by customers, funders and candidates long after the individual has been forgotten, and describing an episode the business would rather not have introduced to anybody. Deciding to enforce is therefore also a decision about how much you are prepared to say out loud.
When not to act
Plenty of these situations deserve containment and nothing more, and saying so plainly is more useful than encouraging a fight. Where what left is thin, dated or reconstructible from public sources, where the suspicion rests on nothing sturdier than a coincidence of timing, or where the person has gone somewhere with no use for the material, a formal process buys very little. It is slow, it is expensive, and the first thing it consumes is the goodwill of everyone still working there.
Two things remain worth doing in those cases, and neither is litigation. Halt the routine destruction of the record while that is still cheap, because a decision not to act today is easier to revisit if the position has not been erased in the meantime. Then repair what allowed it: the leaver process, access that outlived the role it was granted for, confidentiality terms nobody has read since they were drafted. What makes an insider matter hard to run is frequently not the leak but the discovery that the business cannot say with confidence who could reach what.
The one course with nothing to recommend it is the half investigation: enough internal enquiry to alert everybody, not enough to establish anything. It produces rumour, warns the person concerned, damages the record, and leaves the business exactly where it started with fewer options and a nervous team.
Asking somebody internally to quietly have a look through the laptop or the mailbox out of hours. It feels discreet and costs nothing. It alters the only record that was irreplaceable, gives the other side something to attack instead of something to answer, and it is usually done in the same period the device would otherwise have been preserved.
This guide is general information about how these matters usually run. It is not advice, and nothing becomes advice until terms are agreed in writing. Brandleys Legal Ltd delivers reserved legal activities alongside regulated partners.