HR investigations in Google Workspace: a practical guide

HR investigations fail — or become legally vulnerable — for a number of reasons. One of the most common is poor evidence handling early in the process: searches that were too narrow, custodians that were missed, data that was exported before a hold was placed, or findings that cannot be traced back to specific messages.

Getting the evidence process right doesn\'t require legal expertise. It requires a consistent, documented approach — one that is applied the same way regardless of who is conducting the investigation or how much time pressure exists.

A custodian is any person whose data is relevant to the matter. In a harassment investigation, the obvious custodians are the complainant and the subject of the complaint. But relevant evidence frequently involves others: witnesses the parties communicated with, managers who received reports, HR staff who were contacted informally.

Defining custodians explicitly before searching — and documenting why each was included — does two things. It ensures you don\'t miss important context. And it creates a record that demonstrates the investigation was conducted thoroughly, not selectively.

A common mistake is to start with the most obvious custodian and expand later. The problem is that expansion decisions become harder to justify once the investigation has momentum. Starting with a clear custodian list and a rationale for each is the defensible approach.

Once custodians are defined, search criteria determine what is actually collected. In Google Vault, criteria include date ranges, keywords, and whether to include Gmail, Drive, or both.

Criteria decisions involve genuine judgement. A date range that is too narrow may miss relevant context. Keywords that are too broad generate volume that is impractical to review. The right balance depends on the specific allegation.

What matters most — from a defensibility standpoint — is that the criteria used are documented before the search is run. A written record of why particular dates, keywords, and custodians were chosen transforms a subjective judgement into a traceable decision. If the investigation is later reviewed, that record is what demonstrates the scope was reasonable.

Harassment and misconduct investigations typically involve looking for a pattern rather than a single event. Individual messages rarely tell the full story. What matters is the sequence: how communications escalated, what was said after a complaint was made, whether the subject\'s behaviour changed following a reported incident.

For this reason, timeline analysis is often more revealing than keyword matching alone. A message that appears benign in isolation may have very different significance when placed in the context of what came before and after it.

Drive can be equally relevant. Documents created during the relevant period — particularly those shared between specific individuals, or deleted shortly after the period in question — can form a significant part of the evidential picture.

In serious matters, HR and legal counsel will typically run parallel processes: HR managing the internal investigation, legal assessing exposure and advising on privilege. It is important that these tracks don\'t accidentally contaminate each other.

Specifically: evidence gathered for the HR investigation should be collected under consistent, documented criteria — not shaped by early legal risk assessments that might later appear to have influenced what was searched for. The investigation must be seen to have followed the evidence, not constructed a case.

The output of an HR investigation needs to be usable by people who weren\'t involved in running it: senior HR leadership, employment counsel, potentially an employment tribunal.

That means structured findings, not a folder of exported emails. Each finding should reference the specific evidence it is based on, explain why it is considered relevant or significant, and be traceable to a specific search and custodian. The full audit trail — from initial scope to final finding — should be attached.

Investigations that produce this level of documented output are substantially easier to defend, regardless of their conclusions.