The question nobody expects
An internal investigation into a data leak. Preservation is properly documented, the hash values match, the review is complete. Then, in the proceedings, comes a question nobody has prepared for: Who had access to the review platform during the investigation?
It turns out that a line manager of the person concerned could read along as the “client contact” – the same manager whose own role in the matter later becomes an issue. Two external reviewers still had active accounts after the project ended. And one administrator account was shared by three people.
Nothing about the data has changed. But the credibility of the investigation is damaged. A chain of custody that proves the path of the data, but not who could see it, is only half closed.
The second half of the chain of custody
The chain of custody answers where a piece of evidence comes from and that it is unchanged. As soon as the data sits on a review platform, a second question arises: who could view, comment on, tag, export or delete it – and was that person authorised to do so?
For the handling of digital evidence, ISO/IEC 27037 requires that every action can be traced by a qualified third party [1]. That applies not only to preservation. It applies just as much to the phase in which dozens of people work with the data.
Access matters for four reasons:
- Integrity: anyone who could write, tag or delete could have influenced the result.
- Confidentiality: investigation data often contains legal correspondence, bank client data or trade secrets. Professional and banking secrecy [2][3] show how narrow the circle of authorised persons must be.
- Data protection: the data concerns employees, customers and third parties – often including sensitive personal data.
- Independence: people who could themselves be the subject of the investigation must not read along. For law firms, ethical walls between matters come on top.
The legal and normative framework
Switzerland: traceability
In Switzerland, the Federal Act on Data Protection and the Data Protection Ordinance are particularly relevant. They deal with data security appropriate to the risk and with the traceability of processing, including logging [4][5].
The Federal Data Protection and Information Commissioner (FDPIC) has published technical recommendations on logging [6]. They are instructive in practice: even mere reading should be traceable, logs should be stored separately and protected against tampering, and a logging concept includes objectives, roles and regular review. One point that is often overlooked in day-to-day investigations is worth noting: the logs serve traceability, not the monitoring of the behaviour of the people who work with the data [6].
Which obligations apply in your specific case is for your law firm to assess.
International: access as a control objective
ISO/IEC 27001:2022 treats access as a control topic of its own: rules for access control (A.5.15), the granting, review and removal of access rights (A.5.18) and the logging of activities (A.8.15) [7]. Aligning a review environment with these controls means speaking the language that auditors, regulators and international counterparties understand.
For investigations with an EU connection – for instance involving employees or group companies in Germany – the GDPR and its requirements on the security of processing may also be relevant [8].
A log nobody reads protects nothing. Only regular review turns access data into proof.
Where it goes wrong in practice
| Weak point | Risk | Countermeasure |
|---|---|---|
| Accounts remain active after the project or matter ends | Unauthorised access to confidential data | Expiry date per account, check at every project close |
| Shared accounts (“Admin”, “Review team”) | Actions cannot be attributed to a person | Personal accounts, two-factor authentication |
| Roles granted too broadly | Reviewers can export or delete | Need-to-know roles, export and deletion rights separate |
| Client representatives with full access | Independence of the investigation open to challenge | Access to results instead of raw data, check conflicts of interest |
| Permissions checked only at opening | Gradual widening of the circle | Periodic access review with approval |
| Several workspaces, different teams | Overview is lost, ethical walls have gaps | Cross-workspace overview by person and role |
| Logs only in the system itself | Proof falls with the system | Export logs and keep them separately |
From log to proof
Every serious review platform keeps track of users, roles and activities. The problem is rarely that the data is missing. The problem is that it is scattered: per workspace, per user list, per role model. A court, a regulator or a board, however, wants a simple answer: who had which access to which data, when – and who approved it?
A usable proof of access therefore has three properties:
- Complete: it covers all workspaces, all users and all roles – not only the current project.
- Dated: it shows the state at a specific point in time and can be repeated, so that changes become visible.
- Readable: a lawyer without technical background understands it without explanation.
At Prism Discovery we read workspaces, users and permissions from our Farsight review platform automatically via its programming interface and condense them into an audit report. It shows, per workspace, who has access with which role and, per person, which workspaces they can access. Supplemented with usage and storage data, it feeds a dashboard that keeps the current state visible. The report is produced at project close and periodically, and archived with the project – as part of the documentation, not as a reconstruction after the fact.
Conclusion: five questions for every review environment
- Does every person have their own account, and can every action be attributed to a person?
- Do the roles follow the need-to-know principle – especially for export and deletion rights?
- Is it ensured that nobody has access who could themselves be the subject of the investigation?
- Are permissions reviewed periodically and removed when the project ends?
- Can the state of access be proven for any point in time – separately from the system that holds the data?
Where one of these questions remains open, it is not the content that is open to challenge but the environment in which it was examined. The chain of custody does not end with the upload. It reaches all the way to the last account that still has access.
This article is for general information only and does not constitute legal advice. For a legal assessment of your case, please consult a law firm.
Sources
[1] ISO/IEC 27037:2012 – Guidelines for identification, collection, acquisition and preservation of digital evidence – https://www.iso.org/standard/44381.html
[2] Swiss Criminal Code (Strafgesetzbuch, StGB), SR 311.0 – https://www.fedlex.admin.ch/eli/cc/54/757_781_799/en
[3] Federal Act on Banks and Savings Banks (Bankengesetz, BankG), SR 952.0 – https://www.fedlex.admin.ch/eli/cc/51/117_121_129/en
[4] Federal Act on Data Protection (Datenschutzgesetz, DSG), SR 235.1 – https://www.fedlex.admin.ch/eli/cc/2022/491/en
[5] Data Protection Ordinance (Datenschutzverordnung, DSV), SR 235.11 – https://www.fedlex.admin.ch/eli/cc/2022/568/en
[6] Federal Data Protection and Information Commissioner (FDPIC/EDÖB): Technische Empfehlungen für die Protokollierung gemäss Art. 4 DSV, version 1.0, 15 September 2023 – https://www.edoeb.admin.ch
[7] ISO/IEC 27001:2022 – Information security, cybersecurity and privacy protection – Information security management systems – Requirements, Annex A – https://www.iso.org/standard/27001
[8] Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) – https://eur-lex.europa.eu/eli/reg/2016/679/oj