How should a decision not to seize or preserve something be documented?¶
Record the item considered, the question it might answer, the available alternatives and the proportionate reason for leaving it. No physical action does not mean no decision record is needed.
Show that the potential evidence was assessed¶
Identify the device, account, service, file or system, where it was found and who controlled it. State its possible relevance without labelling it irrelevant merely because preservation would be inconvenient. Record any immediate risk that it may be altered, lost or disposed of.
Reasons not to act may include duplication, limited value, legal boundaries, safeguarding, disproportionate disruption, specialist advice or a safer authoritative source. Preserve the assumptions and information available to the decision-maker at the time.
Record alternatives and review points¶
Consider photographs and identifiers, native export, provider preservation or later authorised acquisition. Retain enough information to relocate the source where lawful and appropriate. Record the decision-maker, authority and time.
If the investigation or loss risk changes, the decision may need review. The record should demonstrate deliberate assessment, not allow an overlooked opportunity to be reconstructed later as a reasoned choice.
Key takeaway
Document non-seizure and non-preservation as positive decisions, tying the potential value and loss risk to alternatives, proportionality and a clear basis for later review.
