Authority and Consent for Business Device Investigations

Identify the instructing party

Record the organisation or owner, authorised representative and basis for instruction. Verify who can approve the investigation and receive the report. Physical possession or an available password is not by itself proof of lawful authority.

Define devices, accounts and time range

List the exact items and questions. Separate company systems from personal accounts and third-party data. Set the permitted collection, examination and disclosure scope, including what is excluded.

Company devices and employee privacy

Review applicable employment terms, acceptable-use rules, notices, privacy obligations and the proposed purpose with the appropriate advisers. A business-owned Mac can still contain personal material. Avoid assuming that ownership authorises unrestricted inspection.

Personal devices and disputed access

For bring-your-own-device arrangements, shared devices, family disputes or contested accounts, obtain case-specific direction before access. Consent must come from a person with authority for the relevant material. Where authority is unclear, preserve appropriately and pause intrusive work.

Legal process and law-enforcement powers

The Cybercrimes Act contains search, access and seizure provisions for law enforcement. Those powers must not be treated as a general licence for a private service provider. A warrant or other legal process may be required in a particular matter; counsel should determine the route.

Agree handling, retention and reporting

Document access controls, recipients, storage, retention, legal holds and permitted remediation. Obtain instructions before expanding the scope or erasing material. ZA Support performs the technical work; legal and regulated representation remain with the relevant qualified partners.

Further reading

• Cybercrimes Act 19 of 2020
• ECTA electronic-evidence provisions