HR investigations in Google Workspace: a practical guide

HR investigations fail (or become legally vulnerable) for a number of reasons. One of the most common is poor evidence handling early in the process: searches that were too narrow, custodians that were missed, data that was exported before a hold was placed, or findings that cannot be traced back to specific messages.

A consistent, documented evidence process helps reviewers apply the same approach regardless of who conducts the investigation or how much time pressure exists. Legal questions remain for the organisation and its advisers.

A custodian is any person whose data is relevant to the matter. In a harassment investigation, the obvious custodians are the complainant and the subject of the complaint. But relevant evidence frequently involves others: witnesses the parties communicated with, managers who received reports, HR staff who were contacted informally.

Defining custodians explicitly before searching, and documenting why each was included, helps reduce missed context and records how the collection scope was chosen. It does not guarantee completeness.

A common mistake is to start with the most obvious custodian and expand later. The problem is that expansion decisions become harder to justify once the investigation has momentum. Starting with a clear custodian list and a rationale for each is the defensible approach.

Once custodians are defined, search criteria determine what is actually collected. In Google Vault, criteria include date ranges, keywords, and whether to include Gmail, Drive, or both.

Criteria decisions involve genuine judgement. A date range that is too narrow may miss relevant context. Keywords that are too broad generate volume that is impractical to review. The right balance depends on the specific allegation.

What matters most, from a defensibility standpoint, is that the criteria used are documented before the search is run. A written record of why particular dates, keywords, and custodians were chosen transforms a subjective judgement into a traceable decision. If the investigation is later reviewed, that record is what demonstrates the scope was reasonable.

Workplace investigations may involve looking for a pattern rather than a single event. Individual messages rarely provide the whole context. Reviewers may need to assess the sequence of communications and check each interpretation against the source evidence.

For this reason, timeline analysis is often more revealing than keyword matching alone. A message that appears benign in isolation may have very different significance when placed in the context of what came before and after it.

Drive can be equally relevant. Documents created during the relevant period (particularly those shared between specific individuals, or deleted shortly after the period in question) can form a significant part of the evidential picture.

In serious matters, HR and legal counsel may run parallel processes. The organisation and its advisers are responsible for privilege, access boundaries, and how those processes interact.

Specifically: evidence gathered for the HR investigation should be collected under consistent, documented criteria, not shaped by early legal risk assessments that might later appear to have influenced what was searched for. The investigation must be seen to have followed the evidence, not constructed a case.

The output of an HR investigation may need to be reviewed by people who weren't involved in running it, such as senior HR leadership or employment counsel.

That means structured review aids, not only a folder of exported emails. Each material finding should reference the evidence it is based on, explain why it was surfaced, and be traceable to the relevant collection and custodian. Material workflow actions should be recorded so the process can be reviewed.

Investigations that produce this level of documented output are substantially easier to defend, regardless of their conclusions.