Yes, provided it is proportionate and aimed at establishing a specific breach. We adhere to the Wpbr and GDPR, and assess with you beforehand whether there is sufficient grounds for an investigation.