Define the requested outcome precisely
A business may ask for its “data back” when it actually needs payroll files, client contact records or access to a particular application. It may ask for hardware when a lawful copy would restore the essential service. Clarify the need before choosing the application.
Identify what was physically seized and what became inaccessible. Section 36 addresses both documentation and the forensic-image process. Return of original equipment raises additional questions about evidence, custody and the stage of proceedings. [1]
A narrowly defined request is easier to evaluate than an undifferentiated demand for all devices and all data. It also helps the business avoid obtaining material it is not entitled to access.
Reconcile the inventory and ownership
Obtain the seizure record and match it to the company’s asset register, invoices or other ownership evidence. Where equipment belongs to an employee, landlord, client or leasing provider, identify that fact accurately and assess who has authority to apply.
Ownership alone does not defeat a legitimate evidential need. A third party’s device may still contain relevant material, and company ownership does not entitle every director to all data stored on it. Explain the legal and operational interest in the particular item.
If the inventory is unclear, raise the discrepancy promptly and seek accurate identification. Record serial numbers, descriptions and the relationship between the device and the requested data where available. Avoid guessing details that may later prove wrong. [1]
Use the forensic-image procedure for the correct purpose
Section 36 allows the owner or authorised agent to seek a forensic image through its stated procedure, subject to conditions, costs and possible court restriction where disclosure would prejudice the investigation or proceedings. Read the actual requirements before promising access. [1]
The seven-day reference relates to the officer’s application to court to withhold an image on the specified grounds. It is not a universal deadline for returning a laptop or all business records.
A request should identify the authorised applicant, relevant material and intended use. Where a complete image contains sensitive or unrelated information, consider whether defined access or appropriate handling safeguards address the legitimate concern. Do not claim that an ordinary copy supplied by the business is necessarily an adequate forensic substitute.
Identify the correct property-custody procedure
The Code of Criminal Procedure includes provisions concerning custody and disposal of property, including sections 516A and 523 in their respective settings. Their application depends on how the property is before the authorities or court and the procedural stage. They should not be cited as interchangeable guaranteed-release provisions. [2]
Counsel should establish whether a report has been filed, which court has the matter and what orders already exist. Any bond, undertaking, preservation obligation or production requirement must reflect the actual order.
Constitutional relief may require separate consideration where a specific unlawful act is established and the maintainability conditions are met. It is not automatically the first or only route for every seized computer. [3]
Offer a technically credible preservation plan
A useful proposal may address imaging by competent personnel, integrity verification, controlled access, segregation of unrelated business data or an undertaking to produce equipment when lawfully required. The appropriate option depends on the material and the investigation.
Do not promise that all evidential value can be preserved through a quick export. Metadata, system state, encryption and application dependencies can matter. A technical specialist should explain limitations honestly rather than give a certificate that merely repeats management’s desired conclusion.
Section 35’s proportionality and legitimate-business safeguards support attention to workable alternatives, but do not require acceptance of an inadequate proposal. [1]
Worked example: payroll access while a device remains held
Suppose a seized server contains both campaign material under inquiry and payroll records needed for an upcoming salary run. The company can identify the payroll dataset, authorised recipient and proposed secure access method. That may support a more focused request than immediate return of the entire server.
The request should explain how access can occur without alteration of the investigated material and whether another lawful source of the payroll information exists. If the company has an unaffected backup, that fact should be disclosed rather than presenting the seized server as the only possible source.
This hypothetical illustrates proportionality, not an entitlement to a particular order. The authority or court must assess the evidence and practical safeguards.
Keep recovery and restoration legally controlled
After an item or copy is released, follow the conditions and preserve the order. Record receipt, condition and any relevant integrity checks. Do not erase material because the equipment has physically returned; a continuing preservation or production duty may remain.
Before reconnecting a device, have competent personnel assess security and operational readiness without altering protected evidence. Review client confidentiality and any notification obligations separately.
Maintain an asset-level closure record showing what remains held, what has been copied, what was released and the next legal or operational action. This prevents the common problem of a business announcing full recovery while important access restrictions or court conditions remain unresolved.
Legal assistance for this issue
Legal Bridge LLP can assess the appropriate request or application for equipment or data access after reviewing the inventory, case stage and existing orders. Specialist technical evidence may be needed to support the proposed solution.
