Chain of custody is the unbroken record of who handled a piece of evidence, when, and what they did with it. In corporate investigations it is often the difference between evidence that persuades and evidence that gets waved away as unreliable.
This is a practical primer for South African security, loss-prevention and investigations practitioners. It is general guidance, not legal advice; for high-stakes matters, confirm your approach with counsel.
Why chain of custody matters outside a courtroom
Most workplace investigations never reach a criminal court. They end at a disciplinary hearing or, if contested, at the CCMA or a bargaining council. The standard of proof is lower than in a criminal trial, but the principle is the same: a decision-maker must be able to trust that the evidence in front of them is what it claims to be and has not been altered. A weak custody trail invites the obvious challenge, “How do we know this footage, this document, this item is genuine and untouched?”
The anatomy of a custody record
A custody record answers five questions for every item, from the moment it is obtained to the moment it is presented.
- What the item is, described specifically enough to distinguish it from similar items.
- Where it came from — the physical or digital location it was collected from.
- When it was collected, with an accurate date and time.
- Who collected it, and every person who handled it afterwards.
- Why each transfer or access happened.
Each handover is a link. The chain is only as strong as its weakest documented step, so a single unexplained gap can undermine an otherwise solid item.
Physical evidence
For physical items — recovered stock, a damaged asset, a device — the fundamentals are labelling, sealing and logging. Give the item a unique reference, seal it in tamper-evident packaging where appropriate, and record every time it is removed from storage and returned. Photograph the item on collection so its condition at that moment is fixed. Store originals securely and work from copies where you can.
Digital evidence needs extra care
Digital evidence is easy to copy and easy to alter, which cuts both ways. Best practice is to preserve the original, work on copies, and be able to show the copy matches the original. Recording a hash value (a digital fingerprint) at the point of collection lets you demonstrate later that a file is unchanged. For CCTV, note the source system, camera, time range, the export method and who performed the export. For system logs or reports, record the platform, the query or filter used and the extraction time. Metadata — timestamps, author, device — is often as important as the content itself, so avoid actions that overwrite it.
Treat every item as if you will one day have to explain, under questioning, exactly how it reached the hearing without being tampered with.
Common ways the chain breaks
- Informal handovers. An item passes between colleagues with no note of the transfer.
- Editing the original. Someone annotates or crops the only copy of a document or image.
- Gaps in time. An item sits unaccounted for between collection and storage.
- Shared, unlogged storage. Evidence kept in a drawer or a shared drive that anyone can reach and no one is logging.
- Reconstruction after the fact. Custody notes written from memory days later, which a representative can readily attack.
Build the record as you go
The reliable fix is to log custody at the moment of each action, not afterwards. This is far easier when evidence is registered against a case in one system, with timestamps and user identity captured automatically. A structured case management approach ties each exhibit to its custody history, and a controlled document library keeps originals access-controlled rather than floating around inboxes.
Custody and POPIA
Evidence frequently contains personal information, so custody and data protection overlap. POPIA expects that personal information is kept secure and accessed only by those who need it. A good custody regime — controlled access, logged handling, secure storage — is also good POPIA practice. You can read more about handling operational records in our POPIA approach.
Key takeaway
Chain of custody is a habit, not a form you complete at the end. Log every handover as it happens, preserve originals, and be ready to explain each link, and your evidence will carry the weight you need it to.
A useful next step is to pull one recent case and trace a single exhibit from collection to presentation. If you can account for every link without guessing, your process is sound; wherever you hesitate is where to tighten up.