# DISCIPLINARY OUTCOME LETTER
## Worked fictional document
Date: 9 June 2027
Private and confidential
To: Maya Louise Chen, Customer Insight Analyst, 6 Harcourt Terrace, Leeds LS6 2PN Email: maya.chen@example.test Employee reference: HSN-EMP-4418 From: Gareth Williams, Head of Risk and Compliance, Harbour Street Networks Limited, 22 Wellington Street, Leeds LS1 4DL Email: gareth.williams@harbourstreet.example.test Subject: Disciplinary outcome — confidential-data incident of 18 April 2027
Dear Ms Chen,
I write after the disciplinary hearing on 31 May 2027. The hearing followed an investigation by Joanne Field, who was not involved in the incident or the decision below. You attended with your companion, Erin Walsh, GMB representative, and were given the investigation report, access audit, customer-data policy, your written response and the witness statements at least five calendar days before the hearing. You answered questions, challenged the evidence and provided a mitigation statement. I chaired the hearing and had no prior involvement. I have considered the evidence on the balance of probabilities and have applied the Harbour Street Networks disciplinary policy and the Acas Code.
## Allegation and finding
The allegation was that on 18 April 2027 you copied a file containing 1,842 customer records from the Insight production workspace to an unapproved personal cloud folder, contrary to the Confidential Information and Acceptable Use Policy, and then shared a link with your personal email account. The file contained names, postcodes, customer-reference numbers and renewal dates. It did not contain payment-card numbers, passwords or medical information.
I find, on the balance of probabilities, that you copied the file to the folder at 16.18, sent the link to maya.chen@example.test at 16.21, and deleted the folder at 16.47 after the automated alert. The cloud audit shows no access by anyone other than your account, and the email provider's log shows no onward forwarding. You accepted the copy and email at the hearing. You said you believed the folder was permitted because you had used it for non-personal training data in 2026. That belief was not reasonable on this occasion: the policy dated 1 February 2027, which you acknowledged on 8 February, prohibits personal-cloud storage of identifiable customer data and requires the approved secure-transfer service.
I find that the conduct was a serious breach of the policy and a failure to protect confidential information. I do not find deliberate disclosure to an outside person, commercial misuse, or an attempt to conceal the incident. Your immediate deletion and report are relevant, but deletion occurred after the alert and does not undo the unauthorised copy. The incident was reported to the Information Governance Manager on 18 April at 17.05 by you and recorded under incident reference HSN-IG-270418-06. The investigation found no external access and no evidence of actual customer harm. Those findings are important mitigation, not a reason to disregard the breach.
## Sanction
I have decided to issue a final written warning. This is a formal sanction, but it is not dismissal. It will remain live for 12 months from 9 June 2027, until and including 8 June 2028, subject to the policy. It will be disregarded for disciplinary purposes after that date unless a later policy or lawful process requires an accurate historical record for another purpose. It will not be disclosed outside those who need it for management, HR, legal compliance, audit, safeguarding of data or a fair future process.
The sanction is proportionate because the information was identifiable customer data, the policy was clear, and you used an unapproved service. You completed the recorded two-hour information-security refresher on 4 February 2027, as shown by attendance record HSN-TR-270204, and acknowledged the current policy on 8 February. A first written warning would not adequately mark the seriousness of a breach after that training and acknowledgement. Dismissal would nevertheless be disproportionate on the facts I found: the transfer was self-limited, there was no external access or onward forwarding, you reported it promptly, you co-operated fully, you have seven years' service with no live warning, and your previous performance record is strong. I have not treated your use of a personal email address as a separate aggravating breach beyond the single incident.
During the warning period, any further misconduct or failure to follow information-security controls may result in further disciplinary action, up to and including dismissal, depending on the facts and fair process. The existence of this warning does not predetermine any future allegation. Any future matter will be investigated and heard separately, with an opportunity for you to respond.
## Required corrective actions and support
By 23 June 2027, please complete the two-hour Secure Handling of Customer Data course with a pass mark of at least 80 per cent. The company will provide the course, paid working time and one retake. By 30 June, you must meet Daniel Ibrahim, Information Governance Manager, for a practical review of the approved transfer service. For the next six months, until 8 December 2027, a named colleague must review any export containing identifiable customer data before it leaves the production workspace. This is a proportionate control and not a second disciplinary sanction. Your manager will record the reviewer and date in the normal system.
Harbour Street Networks will provide the secure-transfer service, an approved encrypted work device and a clear written list of permitted locations. You may ask the IT Service Desk for an access check without fear that a good-faith question will itself be treated as misconduct. If disability, neurodivergence or another protected circumstance affects your ability to complete the course or follow the process, tell People Services so that reasonable adjustments can be considered. I have not received evidence requiring a particular adjustment in this case.
## Confidentiality and records
Please keep this letter, the investigation report and customer information confidential. You may share the outcome with your companion, professional adviser, trade union, Acas, a regulator or a court where lawful and necessary. You may also discuss your own employment terms with a person who reasonably supports you. Do not identify customers or copy the incident materials to a personal account. The company will retain the disciplinary record securely and restrict access to People Services, me, your line manager, Information Governance, legal advisers and those responsible for a fair appeal or future process. Retention does not mean the warning remains live beyond 8 June 2028.
## Appeal
You may appeal within five working days after confirmed receipt. For an email route, the five working days run from the date shown by the server-delivery confirmation or written acknowledgement; for the postal route, they run from the date shown by the Royal Mail delivery record or signed receipt. If both routes produce evidence on different dates, the earlier evidenced delivery date starts the period. An appeal must therefore be sent no later than 16 June 2027 if email or post is confirmed as delivered on 9 June 2027, but a later evidenced delivery date produces a later deadline calculated under this rule. Send it to Claire Robertson, Managing Director, Harbour Street Networks Limited, 22 Wellington Street, Leeds LS1 4DL, or by email to claire.robertson@harbourstreet.example.test. Your appeal should state whether you challenge the finding, the sanction, the procedure or new evidence, and explain the grounds. A suitable appeal ground might identify material evidence not considered, a procedural unfairness that affected the outcome, or a sanction that is disproportionate; an appeal need not use those words. Claire did not investigate the incident, chair the hearing or recommend this sanction. You may be accompanied at an appeal meeting by a work colleague or certified trade-union official. The appeal will not increase the sanction merely because you exercise the right, except where a lawful correction is required after a fair process.
The appeal does not suspend the final written warning unless the appeal decision says so. It does suspend any corrective action that cannot safely wait only if People Services confirms that in writing; the data-security controls remain in place while an appeal is pending. The written appeal outcome will state whether the warning is confirmed, reduced, removed or replaced and will explain the reasons.
For service, this outcome is sent by Royal Mail Special Delivery to 6 Harcourt Terrace, Leeds LS6 2PN and by email to maya.chen@example.test on 9 June 2027. The company will retain the email transmission record, server-delivery confirmation and any acknowledgement, together with the postal tracking record and delivery signature. Neither route is treated as received merely because it was sent or posted. The appeal deadline is calculated from the confirmed delivery route as set out above, not from an assumed date. If you have moved, please provide an updated address to People Services.
This internal outcome does not prevent you from seeking independent advice or contacting Acas. It is not a finding by an employment tribunal and does not change any statutory right or time limit.
Yours sincerely,
Gareth Williams
Signature: Gareth Williams Date signed: 9 June 2027 Head of Risk and Compliance, Harbour Street Networks Limited
Acknowledgement of receipt, not agreement: Employee signature: __________________________ Name: Maya Louise Chen Date: __________________________ The signature confirms receipt only and does not waive the right of appeal.