I work for a small UK company in the IT department.

After hearing other employees struggle with the slow internet connection, I discovered malicious software (a trojan horse) in the Internet access point.

I had concerns that the installation of Trojan Horse may involve someone from technical management. Therefore, I addressed the issue directly to the company owner and suggested a non-invasive and silent internal network audit. I got permission from the Company owner to conduct an examination.

Two months later, I was accused of possible gross misconduct addressed as Data Breach according to the ISO 27001 standard.

My concern is that the disciplinary investigation and hearing process implied in The letter of termination (due to gross misconduct) has a formality to terminate my employment in a disciplinary manner.

Until the accusation, I had little knowledge of the company's ISO 27001.

Asking about details such as ISO 27001 Appendix A, which states as follows

A.5.1 Information security policy Objective: To provide management direction and support for information security following business requirements and relevant laws and regulations.

A.5.1.1 Information security policy document


An information security policy document shall be approved by management and published and communicated to all employees and relevant external parties.

I was told I should have been aware of the policy as it is A daily Jira process.

My further concern is that ISO 27001 was used as a tool to conduct the process procedurally.

The investigation finished with the termination letter within a three-day notice period. I can make an appliance for the company owner within seven days.

What are the steps I can take in this situation?

Edit @Myles

That makes a compelling case for constructive dismissal

My worry is the Data Breach allegations leading to my dismissal. Fortunately, I had no access to production data in this company, but from previous experience, such access is sometimes necessary to carry on daily tasks.

I am concerned about how this allegation may deface me in the eyes of my future employers.

Update: Let me break this down:

I passed the report with the findings to the company owner, who handed me this task. He publicly acclaimed my work and passed it on to the managing director.

A pivotal point to understand is that a relatively new developer took over all systems after the previous team members had moved on.

I went through the .git and discovered that, on average, every developer worked for just two months before vanishing.

Our young CTO (according to LinkedIn) threatened the managing director to quit immediately unless I was removed from the team.

This situation wasn't just about work; it was a personal issue I had no idea about.

  • Comments are not for extended discussion; this conversation has been moved to chat.
    – user44108
    Commented Nov 2, 2018 at 14:48
  • 1
    "Constructive Dismissal" would be them unfairly creating a situation where you feel you need to resign. Disproportionate or incorrect disciplinary action falls into this. If they do fire you based on incorrect disciplinary action then it would be a case of Unfair Dismissal instead. Your citizen's advice bureau will be able to run through the specifics with you.
    – Myles
    Commented Nov 2, 2018 at 15:44
  • Sorry missed the fact that termination was a fact rather than a threat. This situation is not constructive dismissal as they've actively terminated you. Talk to your citizen's advice bureau about if this qualifies as unfair dismissal.
    – Myles
    Commented Nov 2, 2018 at 15:53
  • Internet access point. what exactly do you mean here ? did you have the owners instruction in writing ? and where you represented at your disciplinary hearing ? Commented Nov 2, 2018 at 23:21
  • 1
    > The investigation has finished with the letter of termination within three days notice period. I can make an appliance to the company owner within seven days. I hope that was meant to say "application". You should at least follow the procedure to appeal against the decision, to show that you disagree with it.
    – Simon B
    Commented Apr 2 at 21:14

3 Answers 3


An information security policy document shall be approved by management, and published and communicated to all employees and relevant external parties.

This is a company responsibility to communicate this policy to all required parties. I'm assuming that you have never signed any documents stating that you have read policies when you have in fact not read them. If this assumption is true then they are firing you based on non-adherence to a policy that they never informed you of but were required to. That probably makes a strong case for unfair dismissal. I'd advise contacting your citizens advice bureau for the best path forward.

  • 2
    unless OP signed off saying they read the policy when you first started. Most places make sign something (on paper or digitally) saying you read the policies. Commented Nov 1, 2018 at 17:23
  • 2
    @SaggingRufus If the OP signed off on reading the policies and can still say "Till the moment of accusation, I had little if any knowledge of the company's ISO 27001", they have absolutely made a grave mistake.
    – Myles
    Commented Nov 1, 2018 at 17:32
  • exactly my point. Commented Nov 1, 2018 at 17:47
  • 4
    This isn't constructive dismissal, this is just plain dismissal. Constructive dismissal is where you do something like make an employee's life so miserable that they quit. Commented Nov 2, 2018 at 15:43
  • @Acccumulation Sorry you are correct, I had to re-read this. I thought the letter of termination was a threat not a reality.
    – Myles
    Commented Nov 2, 2018 at 15:48

I got permission from Company owner to conduct an examination.

Two months later I have been accused of a possible gross of misconduct

Sounds like you have no problems.

Just tell whoever accused you that you got the owner's permission. As long as the owner agrees, it's hard to argue with that.

  • If I understand the OP correctly they've already been fired.
    – jcm
    Commented Nov 3, 2018 at 7:41

From the discussion in the comments, it sounds like your company has not been following its Disciplinary Policy (as well as not communicating Security Policy effectively to staff).

In a way, it's a shame your colleague wasn't discouraged by senior staff to attend the second meeting - this information would possibly play very well for you at an employment tribunal. Even so, the idea that you didn't know (and weren't advised) they could have been there for the Investigatory Meeting is a significant point against the way the company has handled things.

Your letter to the company owner (within 7 days), reminding them of your earlier discussion, will be a chance for the company to redeem themselves.

Otherwise, document everything and consult with legal representation (as Myles said, the Citizens' Advice Bureau is a good place to start). If the company has behaved the way it appears, saving your job might not be the best outcome - and if a future employer is concerned about the allegation of Data Breach, having an industrial tribunal rule in your favour will be a good way to mitigate this.

  • Not following standard discipline procedures is an automatic win for the employee Commented Nov 2, 2018 at 23:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .