In-house legal departments

In-house counsel sit between the business, the IT team and outside counsel. When something goes wrong, they need technical answers that are accurate, documented and safe to rely on, often from an IT department whose day job is keeping systems running rather than preserving evidence.

Law firms have their own technology problems; in-house teams have different ones. The data lives across the whole enterprise, the custodians are colleagues, HR and the business are often involved, and the legal department may be both the client and the internal regulator. We work as an independent technical resource that reports to counsel.

• Preserving mailboxes, OneDrive, Teams chats and devices when a dispute or regulatory inquiry is reasonably anticipated
• Collecting from departing employees before laptops are reimaged and accounts deleted
• Investigating misconduct, data leakage or suspected fraud with HR
• Directing technical work in a cyber incident through counsel
• Assessing the security of law firms, eDiscovery vendors and other outside providers holding company data
• Expert reports and expert-witness work when a matter proceeds

The Sedona Canada Principles Addressing Electronic Discovery (Third Edition, 2022) treat preservation as an obligation that arises once litigation is reasonably anticipated, and stress that the effort should be proportionate. For most companies, the practical question is how to make a hold notice real inside Microsoft 365 or Google Workspace.

In Microsoft Purview, eDiscovery holds can preserve content in mailboxes, OneDrive accounts, SharePoint sites and Teams, either in full or filtered by query. Holds must be paired with process: account-deletion workflows that check for holds, retention policies that do not quietly delete relevant material, and a record of what was placed on hold and when.

1. 01

   Identify custodians and data sources

   People, shared mailboxes, Teams channels, line-of-business systems and devices.

2. 02

   Apply technical holds

   Purview or Vault holds scoped to the custodians and, where appropriate, date ranges.

3. 03

   Stop the automated deletion

   Pause device reimaging, account deletion and auto-expiry for those custodians.

4. 04

   Document

   A dated hold record that counsel can rely on if preservation is challenged.

Workplace investigations involve privacy obligations as well as evidence. The Office of the Privacy Commissioner of Canada's guidance on privacy in the workplace emphasizes collecting only what is reasonable for a legitimate purpose and being open with employees about monitoring. In practice, that means scoping searches tightly, using company-owned systems, and avoiding personal devices and accounts unless there is consent or a court order.

We collect and examine company systems under counsel's direction, keep chain-of-custody records, and report findings in a form HR and counsel can act on: what happened, when, the evidence for it, and what could not be determined.

When a cyber incident hits, the legal department usually becomes the coordination point for insurers, regulators, notifications and outside counsel. Many organizations structure the investigation so that the forensic firm is retained by, and reports to, counsel. Whether privilege attaches depends on the facts and the jurisdiction, and it is counsel's call, not ours.

What we can do is make that structure easier to maintain: a separate engagement for investigative work, communications routed through counsel, factual working notes kept separate from conclusions, and a final report scoped to what counsel asked.

When a matter turns on electronic evidence, see eDiscovery and defensible collection. If a payment or mailbox has been compromised, see business email compromise response.

Outside law firms, eDiscovery platforms, court reporters and consultants all hold sensitive company data. A short, targeted vendor review covering multi-factor authentication, encryption, breach notice commitments, subprocessors and data location tells you more than a long questionnaire answered with 'yes' throughout. See our vendor security questionnaire guide for the questions that matter.

• Engaged by the legal department or outside counsel, with scope set in writing
• Independent of your day-to-day IT provider, working alongside them
• Plain-language findings, with technical detail in appendices
• Expert-witness work offered when a matter proceeds
• 24/7 incident line: (289) 582-9930
• Offices in Vaughan (head office), Toronto and Vancouver; $2M cyber liability insurance