A departing employee bulk-exported an HR dataset. Who must you consult before examining their HRIS audit trail?

## When the subject of the investigation is one of your own An external intruder poses no consent problem: nobody has a privacy interest in an adversary's session. A departing employee is the opposite case. Everything you want to examine, which records they viewed in the HR platform, which reports they exported, from which address, at what hour, is personal data about an identified person who has rights, a contract with you, and in many countries collective representation. The interview question is not whether you may investigate, it is who must agree first and what that does to your clock. ### The four gates **HR.** The HR business partner is both stakeholder and data owner. The HR platform's audit trail belongs to HR's system, so HR authorises the extract. HR also holds the context that reframes the alert entirely: the person resigned nine days ago, is serving notice, is joining a named competitor, or, equally likely, was told by their manager to pull that report for a legitimate handover. That last possibility is why you ask HR before you accuse anyone. Plenty of insider cases close as benign true positives, real activity, correctly detected, entirely authorised. **Privacy / the DPO.** Examining a named individual's activity is processing personal data, and it must have a documented basis, be necessary and be proportionate. The privacy office typically constrains the scope: this account, these event types, this date range, these named recipients of the output. A request to review everything the employee did for two years will be cut down, and correctly so, both because it is disproportionate and because a narrower scope is far easier to defend later. **Counsel.** Counsel sets the legal posture, decides whether the work is directed for legal advice, and answers the jurisdiction question. The employee's local employment and data protection law governs the examination. A global policy saying the company may monitor its systems does not by itself authorise what you want to do in every country the company operates in. **Employee representatives.** In several European jurisdictions, works councils hold co-determination rights over the introduction and use of technical systems capable of monitoring employee performance or behaviour; German law is the best-known example. In practice this is handled ahead of time through a standing works agreement covering security logging and the circumstances under which individual data may be examined. Where such an agreement exists, an incident is executed within it. Where it does not, you may be negotiating during the incident, and that is measured in days rather than hours. ### What this does to sequencing The hard part is that consultation runs on a slower clock than the risk. The response is to separate two decisions that people wrongly bundle: - **Preserving and constraining** does not require the same approvals as **analysing**. Placing a hold on the relevant records so retention does not consume them, and reducing what the account can still do, are protective steps that do not involve reading the subject's activity. - **Examining** is the step that carries the consultation requirement. That split lets you stop the situation getting worse while approvals move. It also means you must know your platform's retention: a SaaS HR system may hold detailed access events for a limited window, so an unpreserved trail can simply age out while you wait. ### What the trail can and cannot tell you A record-view or export event in an HR platform's audit trail proves that an account performed an action within the application at a time. It does not prove the person was at the keyboard, it does not tell you what the exported file contained beyond the object named, and it does not follow the file after export. A conclusion that data left the organisation needs corroboration from somewhere else, and the platform's own audit trail is frequently the only account you have, which is exactly why preserving it early matters. ### The likely outcome Cases like this often end declared as an incident, run under a counsel-directed engagement, and closed as an employment matter rather than a breach: the data stayed within the company's systems, or was recovered, or the export turns out to have been authorised. That is a legitimate ending, not a failure. What makes it defensible is that the examination was scoped, approved by the right parties and documented before it happened rather than justified afterwards.