Covert surveillance is the investigative method most commonly instructed in sickness absence fraud investigations, and the one most likely to produce direct, evidential proof of what an employee is actually doing during their reported absence. It is also the method most frequently misunderstood in terms of how it must be conducted to produce evidence that is legally usable in a disciplinary or tribunal context.
This article sets out why surveillance is used in sickness investigations, the legal framework within which it must operate, how a professional surveillance operation is planned and conducted, and what kinds of evidence it typically produces. It is written for HR directors, in-house legal teams, and managers who are considering instructing a surveillance investigation and need to understand what they are commissioning and what standards they should expect it to meet.
Why Surveillance Is Used
Documentary and data-based evidence has limits in sickness fraud investigations. The fit note confirms the GP’s professional opinion based on the patient’s self-reported symptoms. Social media provides evidence of what the employee has chosen to make publicly visible. Corporate records confirm business activity that is registered. What none of these sources can directly establish is what the employee is physically doing on any given day during their absence.
Covert surveillance fills that evidential gap. A trained investigator who observes an employee over the course of their absence period can establish, with video evidence, whether the employee’s physical capabilities and daily activities are consistent with the condition they have reported. An employee who claims to be incapacitated by a back injury and who is observed carrying out activities requiring significant physical effort has provided, through their own behaviour, evidence that contradicts their reported condition.
Surveillance is not simply about catching fraud. It also resolves ambiguity in cases where management cannot determine whether an absence is genuine. An investigation that confirms an absence is genuine allows the employer to manage it appropriately, with confidence that the employee is not being treated as a suspected fraudster. Resolution in either direction is a better outcome than sustained uncertainty.
Legal Framework
Surveillance of employees, even those on sick leave, must be conducted within the legal framework applicable to private investigation in England and Wales. The key requirements are:
UK GDPR and Data Protection Act 2018: the processing of personal data gathered through surveillance must have a lawful basis. Legitimate interests is the most commonly applicable basis in employment investigation contexts, provided the investigation is proportionate to the purpose pursued and the employee’s rights are not overridden. The employer should consider conducting a data protection impact assessment before commissioning surveillance.
Investigatory Powers Act 2016: directed surveillance — covert observation of a specific individual in a specific location — by private investigators is not authorised conduct under the Act in the same way as public authority surveillance. Private investigators must confine their activity to observation in public places and must not use devices to intercept communications or conduct surveillance in private spaces.
Human Rights Act 1998, Article 8: the right to respect for private and family life applies in the employment context. Surveillance that is proportionate to a legitimate purpose — investigating credible suspicion of sick pay fraud — is unlikely to breach Article 8. Surveillance that is disproportionate or speculative may do so.
ICO Workplace Monitoring Guidance: the Information Commissioner’s Office has published guidance on the use of monitoring in employment contexts, including covert monitoring. The guidance requires that covert monitoring be directed at a specific, credible concern rather than used as a general monitoring tool.
Employment law fairness: evidence gathered through surveillance must be capable of being used fairly in a disciplinary process, which means the employee must be given the opportunity to see and respond to it before any disciplinary decision is made.
Surveillance Planning
Effective surveillance in a sickness investigation is planned, not improvised. The planning stage determines the scope, duration, and focus of the investigation and ensures that the surveillance activity is proportionate to the specific concern that has given rise to it.
Defining the scope: the investigation should have a clear and documented purpose: what specific concern it is designed to address, what the employee’s reported condition is, and what activities or patterns would be consistent or inconsistent with that condition. The scope defines both what the investigator is looking for and the limits of what surveillance should cover.
Identifying start points: the investigation begins with the employee’s known address. The investigator establishes a surveillance presence at or near that address to observe the employee’s movements during the absence period.
Duration: a professional surveillance operation typically runs for several days to a week initially, with the potential to extend if the initial period is inconclusive. A single day of observations, positive or negative, is rarely sufficient to produce a reliable evidential picture.
Documentation standards: all surveillance activity must be contemporaneously documented in an investigator’s log, with times, locations, and observations recorded as they occur. Video footage should be time-stamped and preserved without editing or alteration. Both the log and the footage form part of the evidential record.
Types of Evidence Gathered
Video footage: the primary evidential output of a surveillance investigation. Footage showing the employee engaged in physical activities, travelling, working, or otherwise conducting themselves in a manner inconsistent with their reported condition is the most direct form of evidence available in a sickness fraud case.
Contemporaneous log: the written record of the investigator’s observations, corroborating the video footage and providing context for what is shown on camera. The log is as evidentially important as the footage in tribunal proceedings, where the contemporaneous record of the investigator’s observations is tested alongside the video evidence.
Witness statement: the investigator’s witness statement, prepared for use in any disciplinary or tribunal proceedings, setting out who they are, what they were commissioned to do, how they conducted the surveillance, and what they observed. The investigator must be willing to give evidence at tribunal if required.
Photographic evidence: still photographs taken during the surveillance operation, providing a clear documentary record of the employee’s presence at specific locations at specific times.
Common Findings
The most common findings in sickness absence surveillance investigations are: the employee is observed engaged in physical activities incompatible with their reported musculoskeletal or physical condition; the employee is observed travelling or on holiday during their reported absence; the employee is observed attending a workplace — either their own business premises or another employer’s — during their reported absence; or the employee is observed engaged in lifestyle activities — sport, home improvement, social events — that are inconsistent with their reported level of incapacity.
Investigations that confirm a genuine absence — where the employee is observed at home, presenting as someone genuinely unwell or incapacitated — are also significant outcomes. They resolve the employer’s uncertainty and allow the absence to be managed appropriately without the suspicion that has been clouding the relationship.
Reporting Evidence
The investigation produces a written report, setting out the investigation’s commission, the methodology employed, the observations made, and the evidence gathered. The report is accompanied by the video footage, the contemporaneous log, and the investigator’s witness statement.
The report and its accompanying evidence are presented to the employer or their HR or legal advisers, who then assess it in the context of the disciplinary process. The evidence does not determine the disciplinary outcome — that is the employer’s decision, made after giving the employee the opportunity to respond. What it does is provide the factual foundation on which the disciplinary process is built.
Need surveillance support for a sickness absence investigation? Contact iSpy Detectives for expert covert investigation services.