The moment a complaint lands on your desk, a clock starts ticking that most employers do not even realize exists. Before the first interview is scheduled, before an investigator is retained, before anyone begins the formal process of determining what happened, there is a critical window during which evidence can be preserved or lost forever. This lesson addresses what happens in that window and why the decisions made in the first hours and days after a complaint or incident can determine whether an investigation succeeds or fails, and whether an employer can defend its subsequent actions if they are ever challenged.
Evidence preservation is not merely a technical or administrative concern. It sits at the intersection of fairness, legal compliance, and organizational risk management. When an employer receives a complaint of harassment, discovers potential misconduct, or learns of a workplace safety incident, the physical and digital records that exist at that moment represent the raw material from which truth will eventually be reconstructed. Text messages, emails, surveillance footage, access logs, witness recollections, and physical documents all begin degrading immediately. Some of this degradation is natural, as memories fade and details blur. Some of it is systematic, as automated retention policies delete old emails or security cameras overwrite footage on rolling cycles. And some of it, troublingly, is intentional, as individuals who fear the consequences of an investigation take steps to destroy evidence that might implicate them.
Canadian employment law, across all jurisdictions, imposes an implicit duty on employers to conduct workplace investigations in a manner that is fair, thorough, and procedurally sound. While no single statute explicitly mandates evidence preservation in the workplace investigation context, the obligation emerges from multiple sources. Human rights legislation across the provinces and at the federal level, including the Canadian Human Rights Act, the British Columbia Human Rights Code, the Alberta Human Rights Act, the Saskatchewan Human Rights Code, the Ontario Human Rights Code, and the Quebec Charter of Human Rights and Freedoms, all require employers to investigate complaints of discrimination and harassment. The duty to investigate that arises under these statutes necessarily implies a duty to preserve the evidence that makes investigation possible. An employer cannot fulfill its obligation to conduct a meaningful investigation if it has allowed relevant evidence to be destroyed.
Occupational health and safety legislation similarly creates preservation obligations, though often more explicitly. The Canada Labour Code, which governs federally regulated employers, requires investigation of workplace hazards and incidents. Provincial OHS statutes in British Columbia, Alberta, Saskatchewan, Ontario, and Quebec all contain investigation requirements following workplace accidents, injuries, or dangerous occurrences. These investigations typically must be documented, and the documentation must be retained for specified periods. Workers compensation boards across the country may also require preservation of incident-related records as part of claims adjudication processes. The intersection of OHS and workers compensation regimes means that employers who fail to preserve evidence of workplace incidents may face consequences from multiple regulatory bodies.
Beyond statutory obligations, the common law imposes duties that reinforce evidence preservation. In British Columbia, Alberta, Saskatchewan, and Ontario, employers who terminate employees have the burden of proving just cause if the dismissal is challenged. In Quebec, the Civil Code of Quebec and the Act respecting labour standards create analogous requirements, though within a civil law framework that differs in some respects from the common law provinces. Regardless of jurisdiction, an employer that terminates an employee for misconduct discovered through investigation will need to prove that the misconduct occurred. This means preserving the evidence that supports the termination decision. An employer that destroys or fails to preserve such evidence may find itself unable to defend a wrongful dismissal claim, even if the misconduct actually occurred.
The practical reality is that evidence preservation requires action, not merely intention. Most organizations have some combination of electronic systems, physical records, and human memory that collectively contain the information relevant to any given investigation. Each of these categories presents distinct preservation challenges. Electronic evidence is often the most voluminous and the most vulnerable. Email servers, messaging platforms, cloud storage systems, employee devices, and network logs all may contain relevant information, and all may be subject to automated deletion policies that operate without human intervention. The standard retention period for emails in many organizations is thirty to ninety days, meaning that evidence of misconduct that occurred two months ago may already be at risk of automated deletion by the time a complaint is received.
Physical evidence presents different challenges. In a harassment investigation, physical evidence might include handwritten notes, printed photographs, physical gifts, or objects in the workplace that corroborate an allegation. In a safety incident, physical evidence might include the equipment involved, the protective gear that was or was not worn, or the environmental conditions that existed at the time. Physical evidence can be lost, moved, cleaned, repaired, or discarded in the normal course of business operations. A piece of equipment that malfunctioned and caused an injury might be sent for repair or replacement before anyone recognizes it as evidence. A workspace where an incident occurred might be cleaned or reorganized before photographs are taken.
Human memory is perhaps the most fragile form of evidence. Witnesses to an incident begin forgetting details immediately. Research on memory consistently shows that recall degrades rapidly in the first twenty-four to seventy-two hours after an event, and that memories become increasingly susceptible to contamination through conversations with others, exposure to media coverage, or repeated questioning. The longer the delay before witnesses are interviewed, the less reliable their accounts become. Moreover, witnesses talk to each other. In any workplace, news of an incident or complaint spreads quickly, and witnesses may consciously or unconsciously align their recollections with what they have heard from colleagues.
The legal consequences of failing to preserve evidence can be severe. In litigation, the spoliation of evidence, meaning the destruction or alteration of evidence that a party knows or should know may be relevant to anticipated or ongoing proceedings, can result in adverse inferences. This means that a court or tribunal may infer that the destroyed evidence would have been unfavorable to the party that destroyed it. In the employment context, this could mean that an employer that deleted emails or overwrote surveillance footage may have its version of events disbelieved, not because of what the evidence showed, but because of the inference arising from its destruction. Human rights tribunals and labour arbitrators have similarly drawn adverse inferences against parties that failed to preserve relevant evidence.
Even outside formal proceedings, evidence preservation affects an employer's ability to make and defend workplace decisions. An employer that terminates an employee for theft but cannot produce the surveillance footage showing the theft may find that subsequent decision-makers, whether internal appeals bodies, union grievance arbitrators, or human rights adjudicators, question whether the theft actually occurred. An employer that receives a harassment complaint but fails to preserve the respondent's text messages may find that the investigation reaches an inconclusive result that satisfies no one and exposes the organization to ongoing risk.
Consider the following scenario. A medium-sized technology company with offices in Calgary receives a complaint from a software developer alleging that her team lead has been sending her inappropriate messages through the company's internal messaging platform and through personal text messages. The complainant provides screenshots of some of the messages but indicates that there are many more that she did not capture. She reports the conduct to her HR business partner on a Friday afternoon, indicating that the messages have been ongoing for approximately three months. The HR business partner is relatively new to the role and uncertain about next steps. She thanks the complainant for coming forward, assures her that the matter will be addressed, and indicates that she will follow up early the following week. The HR business partner then leaves for the weekend, intending to consult with senior HR leadership on Monday morning.
Over the weekend, several things happen. The team lead, who has heard through the grapevine that the complainant met with HR, becomes concerned about his position. On Saturday evening, he accesses the company's messaging platform from home and deletes his entire conversation history with the complainant. He also deletes his personal text messages with her and performs a factory reset on his personal phone. The company's messaging platform has a thirty-day retention policy for deleted messages, but the retention applies only to server-side storage, and the team lead's deletions remove the messages from his local client before the server-side backup captures them. By Monday morning, when the HR business partner arrives at work and begins consulting with colleagues, a significant portion of the electronic evidence has been destroyed.
Meanwhile, the complainant spends the weekend anxiously waiting for follow-up. She talks to two close colleagues about the situation, sharing details of the messages and her emotional response to them. These colleagues, who may become witnesses, now have contaminated recollections that blend what the complainant told them with what they may or may not have observed themselves. The complainant also talks to her partner and her sister, processing the situation emotionally but also creating a narrative that she will carry into subsequent interviews. By the time formal interviews begin the following Wednesday, nearly five days after the initial complaint, memories have shifted, evidence has been destroyed, and the investigation faces significant obstacles that did not exist on Friday afternoon.
This scenario illustrates several critical failures, all of which occurred before the investigation formally began. The most consequential failure was the absence of immediate evidence preservation steps. The moment the HR business partner received the complaint, she should have taken action to preserve electronic evidence. This might have included contacting IT to place a litigation hold on the relevant messaging accounts, ensuring that automated deletion would be suspended and that any manual deletion attempts would be logged. It might have included instructing the complainant to avoid deleting any messages on her own devices and to provide any additional documentation she possessed. It might have included documenting the complainant's initial account in writing, capturing details while they were fresh. None of these steps would have prevented the investigation from proceeding carefully and thoughtfully. All of them could have been taken within hours of receiving the complaint.
The delay over the weekend also allowed the respondent to take destructive action. While an employer cannot prevent a determined individual from destroying evidence entirely, an employer can take steps to limit the opportunity for such destruction and to document that it occurred. If the company had placed a litigation hold on the respondent's messaging account on Friday afternoon, any deletion attempts would have been logged, and the deletions themselves might have been prevented depending on the technical configuration. The respondent's weekend deletion spree might then have been evidence of consciousness of guilt rather than a successful destruction of the underlying evidence. Instead, the evidence is simply gone, and the investigation must proceed without it.
The implications of this scenario extend beyond the immediate investigation. If the complainant files a human rights complaint with the Alberta Human Rights Commission, the employer may face questions about why it did not preserve evidence. If the investigation concludes that the allegations cannot be substantiated due to insufficient evidence, the complainant may reasonably question whether a different outcome would have resulted from better preservation. If the employer terminates the team lead based on whatever evidence does exist, and the team lead challenges the dismissal, the employer may struggle to prove the conduct that justified the termination. Each of these scenarios flows from the failure to act in the first hours after the complaint was received.
Effective evidence preservation requires organizations to develop and implement clear protocols before complaints arise. These protocols should address several key elements. First, organizations should identify who has authority to initiate a litigation hold or evidence preservation request, and ensure that individuals who receive complaints understand that they must escalate immediately to someone with that authority. In many organizations, this means HR leadership or legal counsel, but the specific designation matters less than ensuring that someone is available and empowered to act quickly. Second, organizations should establish relationships with IT that allow for rapid implementation of preservation measures. This means understanding the organization's systems well enough to know what evidence exists, where it is stored, how long it is retained, and how it can be preserved. Third, organizations should develop template preservation notices that can be issued quickly to custodians of potentially relevant information, instructing them to suspend any destruction or alteration of specified categories of records.
Beyond systems and protocols, evidence preservation requires a mindset shift. Many HR professionals approach complaints with appropriate caution, recognizing that allegations must be investigated before conclusions are drawn. This caution is important and appropriate. However, the caution should not extend to evidence preservation, which can and should occur immediately. Preserving evidence does not prejudge the outcome of an investigation. It simply ensures that the investigation has access to the best available information. An HR professional who receives a complaint on Friday afternoon should not wait until Monday to begin preservation simply because the investigation itself will not begin until Monday. The preservation window is measured in hours, not days, and every hour of delay creates additional risk.
Organizations should also consider the role of witnesses in their preservation protocols. While witness memories cannot be placed in a vault like electronic records, organizations can take steps to reduce memory degradation and contamination. This includes conducting preliminary witness interviews as quickly as possible, even if formal investigation interviews will occur later. A brief conversation to document what a witness observed, conducted within hours of an incident, may capture details that would otherwise be lost. Organizations should also consider instructing potential witnesses not to discuss the matter with each other, recognizing that such instructions are difficult to enforce but may nonetheless reduce some contamination.
The physical environment also warrants attention. In safety incidents, the scene should be documented photographically before any cleanup or repair occurs. In cases involving physical evidence such as handwritten notes, printed materials, or objects, those items should be collected and secured. Organizations should designate a secure location for evidence storage and establish chain of custody procedures that document who handled evidence and when. These procedures may seem excessive for routine workplace matters, but they become essential when matters escalate to formal proceedings.
As of the date of authorship, Canadian privacy legislation including the Personal Information Protection and Electronic Documents Act at the federal level and provincial equivalents in British Columbia, Alberta, and Quebec does not generally prohibit the preservation of employee communications for investigation purposes, provided the employer has appropriate policies in place regarding monitoring and access. However, employers should be aware of privacy considerations and should ensure that preservation measures are proportionate to the circumstances. Preserving an entire email server indefinitely would raise privacy concerns that preserving specific custodians' accounts for a defined period would not.
The intersection of evidence preservation with respondent rights also deserves attention. In unionized environments, collective agreements may contain provisions regarding investigation procedures, access to evidence, and employee privacy. Employers should review applicable collective agreements before implementing preservation measures and should be prepared to disclose preserved evidence to union representatives or respondents as the investigation proceeds. In non-unionized environments, respondents retain rights to procedural fairness, which includes the right to know and respond to allegations. Preserved evidence that is never shared with a respondent may be of limited use in subsequent proceedings if the respondent can argue that they were denied a fair opportunity to respond.
Evidence preservation is not the entirety of a fair investigation process, but it is the foundation on which that process rests. An investigation that begins with comprehensive evidence preservation has the best possible chance of reaching an accurate and defensible conclusion. An investigation that begins after evidence has been lost, destroyed, or contaminated faces obstacles that may be insurmountable. The decisions made in the first hours after a complaint or incident are among the most consequential in the entire investigation process. Organizations that recognize this and prepare accordingly will find themselves better positioned to fulfill their legal obligations, to reach accurate conclusions, and to defend their actions if those conclusions are ever challenged. The time to develop evidence preservation protocols is before they are needed. The time to implement them is the moment a triggering event occurs. Everything that follows depends on what is preserved in that critical window between complaint and investigation.