How to Investigate Suspected Employee Moonlighting

Suspected employee moonlighting should be investigated as a workplace fact-finding exercise, not treated as misconduct from the outset. A second job, freelance work or side business is not automatically unlawful or incompatible with employment. The real issues are whether the activity breaches a contractual term, creates a conflict of interest, misuses confidential information, affects performance or safety, competes with the employer, involves dishonest time recording or causes another specific business risk.

At Trojan Investigations, we help employers separate legitimate concerns from assumptions. A good investigation identifies the rule or risk first, gathers evidence from both sides and uses covert methods only where a documented, proportionate need exists.

Published: 18th September 2026

What Does “Moonlighting” Mean?

Moonlighting commonly describes paid work outside a person's main employment. It can include a second PAYE job, freelance work, running a business, consulting, online selling, gig-economy work or work for a competitor. It may happen in evenings and weekends or, more seriously, during hours when the employee is supposed to be working for the primary employer.

The label can therefore cover very different risk levels. A weekend role unrelated to the employer may be entirely manageable, while secretly working for a direct competitor using confidential information raises much more serious questions.

A Second Job Is Not Automatically Misconduct

The first document to check is the employment contract and relevant policies. GOV.UK explains that contractual terms can be written, verbally agreed, contained in handbooks or implied by the employment relationship. Some employers require declaration or approval of outside work, particularly where conflicts, fatigue, confidentiality or regulated activities are concerned.

Employers should avoid assuming that “we do not like second jobs” is enough. The investigation should identify the actual contractual or operational issue and apply the organisation's rules consistently.

Working-Time Rules Can Be Relevant Across Two Jobs

GOV.UK states that combined working hours across more than one job should normally not exceed an average of 48 hours a week unless the worker has opted out or an exception applies. Acas gives the practical example of an employee working 30 hours in one job and 20 in another, requiring the overall hours and health-and-safety risk to be considered.

This does not mean an employer should secretly measure everything an employee does outside work. It means that where combined hours create a genuine safety or compliance concern, the issue should be addressed transparently and proportionately.

Start With Internal Evidence

Before considering surveillance, employers should use information they already hold lawfully and that directly relates to the concern: rota records, timesheets, work allocation, login times, access-control data, company-device records, expenses, customer complaints or missed deadlines.

These records may reveal an innocent explanation or show exactly where further investigation is needed. They are usually more proportionate than monitoring private activity away from work.

Follow the Acas Principle: Gather Evidence From All Sides

Acas updated its investigation guidance in June 2026. It describes an investigation as a process for finding out all that can reasonably be established, gathering evidence from all sides, deciding whether there is a case to answer and helping ensure fair treatment.

Our business investigation services support that fact-finding stage. An investigator should not become the decision-maker on disciplinary sanction; the employer must keep the investigative and employment-process roles appropriately separated.

When Public-Source Research Is Appropriate

If the concern is an undeclared company, directorship, public professional profile or advertised service, open-source research may help establish whether outside work exists. The result still needs context. A dormant company, old profile or historic directorship does not prove that the employee is currently moonlighting.

Public information should be matched carefully to the correct person and limited to what is necessary for the defined employment concern.

When Surveillance May Be Considered

Surveillance should not be the default response to a rumour that somebody has another job. The ICO's monitoring-workers guidance says covert monitoring is unlikely to be justified in most ordinary circumstances, but may be possible exceptionally where there are grounds to suspect criminal activity or equivalent gross misconduct and telling the worker would prejudice detection.

The ICO also expects covert monitoring to be authorised at senior level, supported by a DPIA, strictly targeted, time-limited and stopped when the investigation is complete. If a private investigator is used, the employer should have contractual controls requiring compliant data collection.

What Surveillance Should Not Capture

The ICO specifically warns against covert audio or video monitoring in areas where workers would reasonably expect privacy, such as toilets or changing rooms, and says personal communications should generally not be captured covertly. Monitoring at home is especially intrusive because expectations of privacy are greater.

Our surveillance services are therefore scoped around public activity and a defined business question, not around broad observation of an employee's private life.

Conflict of Interest Is Often the Real Issue

Secondary employment can create an actual or perceived conflict even if it happens entirely outside contracted hours. Government conflict-of-interest guidance treats outside employment as a matter that may need declaration where it overlaps with responsibilities, commercial interests or access to information.

Private employers should look to their own contract and policy rather than importing Civil Service rules, but the underlying governance principle is useful: identify the conflict, assess its seriousness, consider whether it can be managed and document the decision.

Confidential Information and Intellectual Property

If the concern is that an employee is using customer lists, pricing, designs, software, strategy or other confidential information in outside work, the investigation should focus on the suspected information flow. That may involve lawfully reviewing authorised company-system logs, document access, email forwarding rules, removable-media alerts or other security records.

Do not broaden the investigation into private accounts without lawful authority. Our legal and litigation support can be coordinated with employment or commercial solicitors where evidence may be needed beyond an internal HR process.

Visa Conditions Can Matter for Sponsored Workers

Some immigration categories contain specific rules about additional employment. Current GOV.UK Skilled Worker guidance, for example, permits additional work only within defined conditions and normally limits qualifying supplementary work to 20 hours a week unless the visa is updated to cover both jobs.

An employer should not make immigration assumptions from nationality. If visa compliance is genuinely relevant, use the employee's actual immigration status and current official guidance, with specialist advice where needed.

How We Structure a Moonlighting Investigation

What Should an Employer Give the Investigator?

Keep the Investigation Separate From the Disciplinary Decision

The investigator's role is to establish and report relevant facts. The employer must decide whether there is a case to answer, conduct any formal disciplinary stage fairly and consider the employee's explanation. Acas warns that an unreasonable investigation can make later decisions unfair and increase legal risk.

A focused investigation also protects innocent employees. If the allegation is wrong, the process should be capable of showing that rather than being designed only to confirm suspicion.

Use the Least Intrusive Method That Can Answer the Question

Moonlighting investigations are often most effective when they are narrow. If the issue is a conflict of interest, public corporate information and an interview may be enough. If the issue is working during company hours, system and attendance evidence may be more probative than off-duty surveillance. If the issue is confidential data, security logs may be the correct starting point.

Proportionality is both a legal and practical advantage: it reduces privacy risk, cost and irrelevant material while producing evidence that is easier to explain.

Distinguish Outside Work From Working for a Competitor

The phrase “second job” can conceal the most important fact: who the employee is working for and what they are doing. Delivering food at weekends, teaching a class, running an unrelated online shop and consulting for a direct competitor are not equivalent risks.

Where the concern is competitive activity, the employer should identify the information, customer relationships, procurement influence or commercial decisions that could be affected. That produces a focused conflict-of-interest investigation rather than a general enquiry into the employee's personal finances or lifestyle.

Remote Work Creates a Specific Time-Theft Question

Moonlighting allegations have become more complex where employees work remotely or on flexible schedules. An employee being at home during working hours does not prove they are not working, and a gap in online status does not prove they are working elsewhere.

The better approach is to compare objective work expectations with evidence: agreed hours, output, meeting attendance, system access, customer contact and recorded leave. If the concern is simultaneous employment during the same paid hours, the investigation should test that specific overlap rather than assume every second job is dishonest.

Interview Evidence Still Matters

Documentary or surveillance evidence may identify a discrepancy, but the employee may have a legitimate explanation. Acas emphasises gathering evidence from all sides. A fair process normally gives the worker an opportunity to explain the outside activity, the hours involved and any approval they believed they had.

Interview notes should distinguish questions, answers and follow-up evidence. The investigator should not use accusatory questioning designed to obtain a confession when the role is fact finding.

Think About Retention Before Collecting More Data

Employee investigations can generate surveillance images, access logs, interview notes and sensitive personal information. The employer should know who will receive that material, how long it will be retained and when irrelevant information will be deleted.

This is especially important where covert monitoring captures third parties or off-duty activity that has nothing to do with the allegation. Collecting less, for a defined period, is easier to justify and easier to secure.