Private Investigator for Employee Misconduct: What Can an Employer Investigate?

Suspected employee misconduct can place an employer in a difficult position. There may be unusual absences, unexplained stock losses, suspicious vehicle movements or concerns that confidential information is reaching a competitor, but suspicion alone is rarely a safe basis for disciplinary action.

In these circumstances, a private investigator for employee misconduct may help establish what has actually happened. Lawful public-place surveillance, targeted open-source research and carefully prepared observation reports can provide evidence that an employer cannot obtain through an ordinary internal enquiry.

However, an employer cannot simply instruct an investigator to “find something”. The allegation should be specific, the proposed investigation must be necessary and proportionate, and any personal information must be handled in accordance with data protection and employment law.

At SPS Investigations, we support employers across London and the Home Counties where there is a genuine concern but insufficient evidence to make an informed decision. Our role is to document relevant facts objectively, not to decide whether an employee is guilty or what disciplinary sanction should follow.

What employee misconduct can an employer investigate?

An employer can investigate conduct that may breach an employment contract, workplace policy, legal obligation or duty owed to the business. This can include dishonesty, misuse of company property, conflicts of interest, unauthorised secondary employment and serious breaches of confidentiality.

The investigation should begin with a clearly defined concern. For example, “we think this employee is dishonest” is too broad. A more appropriate starting point might be: “the employee has reported being unable to undertake physical work, but we have credible information that they are carrying out similar paid work elsewhere”.

A focused allegation allows the employer and investigator to decide what evidence is relevant, what methods may be justified and when the investigation should end.

Fraudulent sickness absence

Sickness absence creates significant operational costs for UK employers. The Office for National Statistics estimated that 148.8 million working days were lost because of sickness or injury in 2025, equivalent to an average of 4.4 days per worker. The overall sickness absence rate was 2.0%.^[1]

These figures demonstrate the scale of absence, but they do not suggest that most sickness claims are dishonest. The vast majority are likely to be genuine, and an employer should not investigate an employee simply because they have taken sick leave.

Concerns may become more substantial where there is credible information that an employee has fabricated an illness, exaggerated their incapacity or undertaken activities that appear directly inconsistent with what they have told the employer.

Even then, context is essential. An employee who is unable to perform a physically demanding role may still be capable of driving, shopping, exercising as part of their recovery or carrying out less strenuous work. Government guidance confirms that a person may qualify for Statutory Sick Pay in one job while remaining fit to perform a different type of job.^[2]

A properly scoped investigation should therefore examine a defined inconsistency rather than attempt to make a medical diagnosis. Where health information is relevant, the employer should also involve HR or occupational health and consider whether reasonable adjustments or disability discrimination issues may arise.

Working for another employer while signed off sick

Working elsewhere during sickness absence is not automatically misconduct. The position may depend on the employee’s health, the nature of each role, the terms of their employment contract, any exclusivity or notification requirements and whether they are receiving contractual sick pay.

There may be a legitimate concern where an employee claims they cannot undertake a particular activity for their employer but is observed performing substantially similar work for another organisation. Other relevant circumstances could include working for a competitor, failing to disclose a conflict of interest or using the original employer’s customers, equipment or confidential information.

A private investigation might establish whether the employee regularly attends another workplace, carries out deliveries, meets customers or performs work that appears relevant to the allegation. The resulting report should describe what was observed without claiming to determine the employee’s medical fitness.

Theft, stock losses and dishonest expenses

Employee theft can involve more than taking cash or physical stock. It may include fuel-card misuse, false mileage, fabricated expenses, diversion of deliveries, unauthorised discounts, removal of equipment or use of company materials for private work.

Internal records should normally be examined first. Till records, access logs, stock counts, invoices, fuel transactions, expense claims and authorised CCTV may narrow the relevant dates, locations or individuals. An external investigator may then be able to test a specific concern through observation or lawful research.

For example, an employer may have records showing repeated stock shortages after a particular employee’s shift. That may justify further enquiries, but it does not by itself prove that the employee took the stock. An investigation should look for evidence both supporting and contradicting the allegation.

Misuse of company vehicles

Employers may become concerned that a company car, van or commercial vehicle is being used for unauthorised private journeys, undeclared paid work, transporting unauthorised passengers or visiting locations unrelated to the employee’s duties.

Existing telematics, mileage records, fuel use, job sheets and delivery schedules may provide an initial audit trail. Where these records reveal a defined discrepancy, proportionate surveillance may help establish how the vehicle is actually being used.

The ICO states that workers and passengers should normally be informed about vehicle monitoring. Where private use is permitted, it will rarely be justifiable to continue monitoring that private use. More intrusive methods, including driver-facing cameras, audio recording or detailed behavioural analysis, require particularly strong justification and may require a data protection impact assessment.^[6]

Vehicle ownership does not remove an employee’s data protection rights. Employers should avoid assuming that owning a vehicle gives them unrestricted authority to monitor every journey made in it.

Unauthorised disclosure of confidential information

An employer may suspect that an employee is supplying customer information, pricing, tender documents, intellectual property or other confidential material to a competitor or outside party.

The starting point may include an examination of authorised business records, such as access logs, download histories, document permissions and unusual contact with external domains. Monitoring work emails or messages is legally sensitive, particularly where personal communications, health information or contact with a trade union representative could be captured.

The ICO says employers must have a clear purpose, consider less intrusive alternatives and inform workers through appropriate policies where email or message monitoring may take place. A data protection impact assessment should be completed where the monitoring presents a high risk to workers’ rights.^[6]

A private investigator may assist through lawful open-source research, corporate record checks or factual observation of meetings in public places. They cannot hack an account, intercept private communications or obtain protected customer data through deception. Knowingly or recklessly obtaining personal data without the controller’s consent can amount to an offence under section 170 of the Data Protection Act 2018, subject to the statutory defences.^[9]

Breaches of restrictive covenants and secondary employment rules

Employment contracts sometimes restrict an employee from competing with the business, soliciting customers, dealing with certain clients, disclosing confidential information or accepting secondary work without approval.

Whether a restrictive covenant is enforceable depends on its wording, the employer’s legitimate business interests and whether the restriction goes further than reasonably necessary. Employers should obtain legal advice before assuming that a suspected breach justifies disciplinary action or court proceedings.

An investigation may nevertheless help establish the underlying facts. Relevant evidence might include an employee attending a competitor’s premises, operating an undeclared business, meeting existing customers or publicly advertising services that conflict with their contractual duties.

When should an employer hire a private investigator?

A private investigator is most useful when an employer has a credible and specific concern but cannot fairly resolve it using internal records, interviews or routine management processes alone.

An investigator should not be used to replace the employer’s disciplinary procedure. Instead, external evidence may become one part of a wider fact-finding exercise that also considers documents, witness accounts, the employee’s explanation and evidence that supports their position.

External support may be appropriate where independence is important, where internal personnel would be readily recognised, where observations need to take place away from company premises or where the employer lacks the practical ability to document events accurately.

What can a private investigator lawfully do?

Targeted surveillance in public places

Depending on the circumstances, an investigator may observe an employee from a public place or another location they are lawfully entitled to use. This can include static surveillance at a relevant location or mobile observations of journeys and activities visible to members of the public.

The surveillance should be directed towards a defined question. An employer investigating alleged undeclared work, for example, may need to know whether the employee attends a particular business and performs work there during a specified period. It would not normally justify unrestricted monitoring of the employee’s entire private life.

Investigators should avoid filming through the windows of a home, entering private land without permission, recording in places where there is a strong expectation of privacy or continuing surveillance after the agreed objective has been achieved. Persistent or oppressive conduct can also create risks under the Protection from Harassment Act 1997.^[10]

Open-source research

Open-source research may include reviewing information that has been lawfully published through company websites, Companies House records, professional profiles, social media pages, online advertisements and other accessible sources.

Publicly available does not mean unrestricted. Personal information found online remains subject to data protection law, and an employer should consider whether the proposed use is fair, necessary and within the employee’s reasonable expectations.

Investigators should not create deceptive accounts to gain access to private profiles, circumvent security controls or breach a platform’s terms to obtain information. The ICO-approved industry code for investigative and litigation support services treats invisible social media monitoring as activity that may require a data protection impact assessment.^[8]

Factual observation reports

A professional report should provide a clear, chronological account of what the investigator personally observed. It may include dates, times, locations, relevant photographs, video references and an explanation of any gaps in observation.

The report should distinguish fact from inference. “The employee carried two boxes from the van into the premises” is an observation. “The employee was stealing company property” is a conclusion that may not be supported by that observation alone.

A balanced report should also record relevant events that do not support the original suspicion. The purpose is to provide reliable information, not to construct a case against an employee regardless of what actually happened.

Employment investigations must still be fair

Acas states that a workplace investigation should gather evidence from all sides, establish whether there is a case to answer and help the employer decide what should happen next. A decision based on an unreasonable investigation is likely to be unfair and may expose the employer to legal action.^[3]

The Acas Code of Practice requires employers to carry out necessary investigations without unreasonable delay, inform the employee of the basis of the allegation and give them an opportunity to respond before a disciplinary decision is made. Where practicable, different people should conduct the investigation and the disciplinary hearing.^[4]

An employment tribunal can increase or reduce a relevant award by up to 25% where an employer or employee has unreasonably failed to follow the Acas Code.^[4] This makes procedural fairness important even where the apparent evidence of misconduct seems strong.

The wider level of employment litigation also illustrates the importance of careful decision-making. The Ministry of Justice recorded approximately 50,000 single Employment Tribunal claim receipts during 2025/26, with an open caseload of around 64,000 single claims at the end of March 2026.^[11]

Data protection and covert employee monitoring

Surveillance footage, photographs, location information, online research and investigator reports may all contain personal information. The employer must identify an appropriate lawful basis, define the purpose of the investigation and collect no more information than is necessary.

Sickness investigations require additional care because information about an employee’s physical or mental health is special category data. In addition to an Article 6 lawful basis, the employer must identify an applicable Article 9 condition and meet any associated requirements under the Data Protection Act 2018.^[7]

Consent is not automatically the correct basis. The ICO warns that consent can be difficult to rely upon in an employment relationship because the imbalance of power may mean it is not freely given.^[7]

Covert monitoring is unlikely to be justified in ordinary circumstances. Current ICO guidance says it may be possible in exceptional cases involving suspected criminal activity or gross misconduct, but employers considering it should:

• Have credible grounds for the suspicion.
• Consider whether informing the employee would prejudice the investigation.
• Obtain appropriate senior management authorisation.
• Complete a data protection impact assessment.
• Target the monitoring at a specific allegation and limited timeframe.
• Restrict access to the resulting information.
• Stop the monitoring when the investigation is complete.
• Avoid private areas and communications the employee would reasonably expect to remain private.

The ICO also states that where a private investigator is used for covert worker monitoring, the employer should have a contract requiring the investigator to collect information in a way that satisfies the employer’s data protection obligations.^[5]

Outsourcing the fieldwork does not outsource the employer’s legal accountability. The respective roles of the employer and investigator as controller, joint controller or processor should be assessed and recorded before personal information is collected.

How to structure an employee misconduct investigation

A disciplined process reduces unnecessary intrusion and helps ensure that any evidence gathered is relevant to the decision the employer must make.

1. Define the allegation. Record exactly what conduct is suspected, when it may have occurred and which contractual term or policy may have been breached.
2. Review existing evidence. Examine relevant records, policies, authorised CCTV, expense documents, access logs, vehicle records and witness information before considering external surveillance.
3. Involve the right advisers. HR, an employment solicitor, a data protection officer or an insurer may need to approve or advise on the investigation.
4. Assess necessity and proportionality. Consider whether a less intrusive method could answer the same question and document why the selected approach is justified.
5. Set clear limits. Agree the relevant dates, locations, activities, reporting arrangements, retention period and circumstances in which the investigation must stop.
6. Preserve the evidence. Keep original footage and records securely, restrict access and maintain an accurate account of how the material was obtained.
7. Give the employee an opportunity to respond. Investigation evidence should normally be considered within a fair disciplinary process rather than treated as an automatic finding of guilt.

What can an investigator’s report prove?

An investigator’s report may establish where an employee went, what they were seen doing, which vehicle they used, who they appeared to meet and how long an activity continued. It can also confirm that anticipated conduct was not observed during the agreed period.

The report may not reveal why an employee acted in a particular way, what was said during a private conversation or whether their behaviour legally amounts to gross misconduct. Those questions may require the employee’s explanation, documentary evidence, medical or occupational health input and advice on the contract or relevant workplace policy.

Surveillance is also a snapshot rather than a complete account of somebody’s life. A short recording should not be taken out of context or presented as proof of something it does not show.

Common mistakes employers should avoid

Beginning with a predetermined conclusion: An investigation should test an allegation, not search selectively for material that justifies a decision already made.

Using disproportionate surveillance: A minor policy concern is unlikely to justify intrusive, prolonged or wide-ranging monitoring outside the workplace.

Assuming activity proves sickness fraud: The relevant question is usually whether the observed activity is materially inconsistent with the employee’s account or contractual duties, not whether they left their home while signed off.

Ignoring evidence that supports the employee: A fair investigation should consider exculpatory evidence and plausible alternative explanations.

Reusing information for an unrelated purpose: Material gathered to investigate one specific allegation should not automatically be retained or used to examine unrelated aspects of the employee’s private life.

Failing to plan disclosure: Evidence relied upon in a disciplinary process may need to be provided to the employee, subject to appropriate redactions and legal advice. Personal information may also fall within the scope of a subject access request.

How SPS Investigations can help employers

At SPS Investigations, we provide discreet corporate investigation services for employers across London and the Home Counties.

We begin by understanding the allegation, the evidence already available and the decision the employer needs to make. Where an investigation is appropriate, we can agree a targeted plan involving lawful public-place surveillance, open-source research and factual reporting.

We do not recommend unrestricted monitoring or speculative investigations. If an instruction appears disproportionate, lacks a legitimate purpose or would require unlawful access to private information, we will explain the concern and discuss whether a narrower approach is available.

Employers should coordinate our work with their HR team, employment solicitor, data protection officer or insurer where appropriate. This helps ensure that the evidence-gathering stage supports, rather than undermines, the subsequent employment process.

To discuss suspected employee misconduct in confidence, get in touch with us. We can assess the circumstances and provide an honest view of whether external investigation is likely to be useful and proportionate.

Frequently asked questions

Can an employer hire a private investigator to investigate an employee?

Yes. An employer can hire a private investigator where there is a legitimate purpose and the proposed methods are lawful, necessary and proportionate. The employer must also comply with employment law and data protection obligations.

Can an employer put an employee under surveillance while they are off sick?

Potentially, but covert surveillance should only be considered in exceptional circumstances involving a credible suspicion of serious misconduct or criminal activity. It should be targeted, time-limited and supported by a data protection impact assessment.

Does being seen outside while signed off sick prove misconduct?

No. An employee may be unable to perform their job while remaining capable of ordinary daily activities. The employer should consider whether the observed conduct is genuinely inconsistent with the employee’s stated incapacity or contractual obligations.

Can an employee work another job while receiving sick pay?

It may be possible for an employee to be unfit for one role but fit for another. Whether there is misconduct depends on factors including the employment contract, the nature of each job, the employee’s health, any conflict of interest and the sick pay arrangements.

Can an employer use an employee’s social media posts as evidence?

Publicly accessible posts may sometimes be relevant, but they remain personal information. Employers should consider the context, authenticity, reasonable expectations of privacy and whether using the material is necessary and fair.

Can private investigator evidence be used in a disciplinary hearing?

Yes. A factual report, photographs or video may form part of the evidence considered during a disciplinary process. The employee should normally be told the allegation, given relevant evidence and allowed a reasonable opportunity to respond before a decision is made.

Does an employer have to tell an employee they are being monitored?

Workers should normally be informed about monitoring through privacy information and workplace policies. Covert monitoring without prior notice is only likely to be justifiable in exceptional circumstances where notification would prejudice the prevention or detection of suspected criminal activity or gross misconduct.

Can an employer track a company vehicle used by an employee?

Vehicle monitoring may be lawful where there is a clear business purpose and workers have been properly informed. Monitoring private use, passengers or detailed driver behaviour is more intrusive and requires stronger justification. A data protection impact assessment may be required.

Should an employee be suspended during an investigation?

Suspension is not automatic and should not be treated as a disciplinary sanction. The employer should consider whether it is genuinely necessary, whether less restrictive alternatives are available and keep any suspension as brief as possible and under review.

Last updated: 28th July 2026. This article focuses primarily on employment investigations under English law. It provides general information and is not a substitute for advice from an employment solicitor, HR professional or data protection adviser.