United States: Dealing With An Investigation: Data Collection And Management

Global Crisis Management Series: This post is part 4 in a series concerning topics further elaborated on in Cleary Gottlieb's Global Crisis Management Handbook—a desk reference for spotting issues and avoiding common mistakes when faced with a crisis. The current version is available here.

Depending on the matter, data collection and management can be among the most daunting and logistically difficult tasks. Ensuring that the full relevant universe of data is being preserved and considered and that accurate recordkeeping is being performed is essential to managing large volumes of information and, in turn, facilitating fact-finding goals and risk assessment.

Data Preservation

After identifying all of the individuals who are likely to have relevant information, a company should take steps to preserve any such information for the relevant timeframe. Not doing so can lead to future issues regarding credibility and may impact the ability to evidence important facts. The first step for preservation is to identify the types of information that may exist. This often includes considering physical evidence, servers, local drives, audio recordings, instant messaging and other business software, smartphones, shared databases, visitor entry logs and other security data, personal information managers, videos, pictures or graphics, and hardcopy documents, among other sources and formats of data. Take a broad view at the identification stage, for example, by potentially including information held by assistants of key individuals, off-site storage locations, information in hardcopy format, social media applications or home office computers.

The scoping and initial fact-gathering steps taken early in an investigation will determine the universe of potentially relevant individuals and sources of information from which to collect data. It is important during the initial fact-gathering stage to ask individuals about where relevant information may be located. Organizational charts should be located if possible, as they can be essential to data preservation and collection. As with all aspects of an investigation, preserving and collecting data is typically an iterative process, and investigators should take care to document and update all records pertaining to data collection and processing steps in real time. This ensures consistency and will assure investigators that all information collected is current.

In some circumstances, issuing hold notices to employees and taking steps to preserve centrally stored information is important to ensure that employees do not inadvertently destroy relevant information. Investigators should work with IT departments to confirm that any and all relevant automatic deletion procedures in place are disabled. The spoliation of evidence, inadvertently or otherwise, only disrupts the fact-finding process. In the context of an investigation that involves external parties, such as auditors or regulators, such spoliation could erode trust between parties and reflects negatively on the team conducting the investigation.

Recordkeeping for Data Collection and Storage

Often times, investigations require collecting, storing and managing large amounts of data. There are many tools to keep track of data that will be reviewed as part of an investigation stemming from a crisis. For smaller investigations, this is perhaps ably handled in-house with the help of internal IT departments. But it is likely that larger investigations will rely on data vendors specialized in collecting, processing and hosting data. Investigation teams and external counsel are often more likely to have experience in handling larger amounts of data covering multiple investigation topics. Incorporating discipline and flexibility into the data collection and management process is crucial to ensuring that the investigation is complete, thorough and verifiable. Establishing a data collection protocol achieves each of these goals and serves as a basis for communication between those managing the investigation and the stewards of the relevant data. At the very least, good data collection protocol logs information about relevant data depositories, IT systems, group data location and storage, custodians, archives, data formats, dates of collection, volume collected and all relevant collection notes, including identifying technical details of the data and process used to copy or extract it.

Whether the investigation is entirely internal or independent, overseen by regulators or auditors, the technical details matter. Good recordkeeping of what has been collected and processed, when, where and how will prevent confusion at a later stage in the investigation when such questions may resurface. For example, many regulators require certain metadata to be produced and retained. Good recordkeeping of technical details of collection and processing can save a lot of time at a later date if and when such details become more relevant.

An open dialogue between the investigation management team and the data vendor service ensures that logistical questions do not overshadow the fact-finding of the investigation. For this reason, investigators benefit greatly from making sure to track what data was collected by whom, the chain of custody, and how data was or should be labeled and hosted. Each of these considerations should be made against the backdrop of understanding (and balancing) the data privacy regimes for each relevant jurisdiction, which can be critical to deciding how data is collected, stored, reviewed and produced.

Data Review

All data review should follow a review protocol that outlines the facts and issues so that reviewers are able to effectively and efficiently sort through what can be potentially very voluminous amounts of information. The protocol should lay out how potentially relevant data will be initially identified (through the use of electronic keywords or otherwise), how the data will be categorized by the initial reviewers, and what information will be elevated for further review by more senior investigators. Not all data will be in document form—each investigation should consider at the collection stage the various formats in which the data exists and, if not in document form, how best to review that data and convey that information to other team members. For example, listening to audio recordings, taking appropriate notes or creating transcripts of relevant discussions may be necessary for certain matters. In other cases, it may be necessary to analyze large sums of numerical data using transaction testing or a more involved forensic review. Again, good recordkeeping is crucial, as it enables efficiencies at the information analysis and production stages. Investigators should balance pacing the review with the virtue of being able to quickly identify information at a later point according to specific categories and classifications. Moreover, depending on the goals of the investigation, identifying potentially privileged information at this stage will allow for a quicker and more efficient assessment method for maintaining that privilege throughout the course of the investigation, especially when sharing information with authorities or other entities is a focus of the investigation.

Data Production

Before responding to a production request, consider whether the request is within the sending authority's jurisdiction. Identify whether there are any legal impediments to complying with the request, such as jurisdictional limitations, attorney-client privilege and work product protections, data privacy and blocking statutes or employees' rights and privileges. Early consideration of these issues will help avoid potential waivers.

Open a dialogue with the requesting entity early on and negotiate the scope and timing of the requested information, especially when requests are broadly drawn. The requesting agency might be amenable to limiting the scope of the request if the investigatory team is willing to help them quickly discern the relevant information. These negotiations can also help build rapport and demonstrate that the company is taking requests seriously. Staying organized should also mean quicker and more effective responses to requests, which also enhances the company's credibility with the requesting entity.

Keeping detailed production logs is important, as there inevitably are questions post-production regarding what was provided to whom, when and why. A good production log contains as much information as is sufficient to understand the contents and circumstances of the production, including (i) the date, format and recipient(s) of the production; (ii) information sufficient to later identify or locate the data within a broader universe of productions; (iii) details regarding the circumstances underlying the request for information; and (iv) a summary sufficient to identify the contents of the production.

Staying organized at the document collection, review and production stages is vital to the success of the project and the ability to maintain efficiencies during an investigation. Implementing good recordkeeping and process controls for the lifecycle of the matter is the best quality control measure that can be taken to guarantee a comprehensive investigation.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

In association with
Related Topics
Related Articles
Related Video
Up-coming Events Search
Font Size:
Mondaq on Twitter
Mondaq Free Registration
Gain access to Mondaq global archive of over 375,000 articles covering 200 countries with a personalised News Alert and automatic login on this device.
Mondaq News Alert (some suggested topics and region)
Select Topics
Registration (please scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.


The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.


Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions