Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.
TL;DR
- Is OSINT legal under UK GDPR? Information you find on the open web about a person is still personal data, and UK GDPR applies the moment your team collects, stores or combines it.
- Most commercial OSINT work relies on legitimate interests, which means passing the ICO's three-part test (purpose, necessity, balancing) and writing it down before you search.
- The Data (Use and Access) Act 2025 is now fully in force. It added a "recognised legitimate interest" basis with a crime condition, but necessity and transparency still apply.
- Minimise what you collect, set a retention period, be ready to explain your processing, and treat special category and offence data with extra care.
- UserSearch helps by keeping a Case record of what was searched and why, with Private mode for scoping checks where no stored search history is needed.
Is Public Data Still Personal Data?
OSINT can be lawful in the UK, but UK GDPR still applies: open-source research about people is lawful when your team has a lawful basis, usually legitimate interests, and can show its working. The most common question we hear from compliance leads is a simple one: "If it's public, why do we need a lawful basis at all?" The honest answer is that UK data protection law does not care where the information came from. It cares what you do with it. A director's name on a company register, a handle on a public forum and a photo on a business website are all personal data once you collect them into a case file about someone.
That does not make open-source research unlawful. It makes it regulated. Fraud teams, insurers, AML analysts, procurement leads and in-house legal teams run OSINT checks every day on a sound footing. What separates a defensible check from a risky one is rarely the search itself. It is whether the team can show, on paper, why they searched, why that much, and why the person's interests did not outweigh their own.
This guide walks through that reasoning the way a UK practitioner would: the lawful bases under Article 6, the ICO's three-part legitimate interests test, two worked assessments you can adapt, and the changes brought in by the Data (Use and Access) Act 2025. This is general information, not legal advice. For a decision about your own processing, speak to your data protection officer or a qualified adviser.
Which UK GDPR Lawful Bases Apply to OSINT Research?
Every processing activity needs at least one lawful basis from Article 6(1) of the UK GDPR. The list is short: consent, contract, legal obligation, vital interests, public task, legitimate interests and, since the 2025 Act, recognised legitimate interest (Article 6(1)(ea)). For OSINT, three of these do almost all of the work.
- Legal obligation (6(1)(c)) applies where a law requires the check, for example customer due diligence under the Money Laundering Regulations for a regulated firm. The obligation has to be specific, so "we are a regulated firm" is not enough on its own.
- Legitimate interests (6(1)(f)) covers most commercial research: supplier checks, claims review, brand abuse enquiries, security research. It is flexible, and that flexibility is why it comes with a balancing test.
- Recognised legitimate interest (6(1)(ea)) covers a closed list of purposes set out in Annex 1, including detecting and preventing crime. No balancing test applies, but necessity does.
Consent is almost never the right choice for research about a person who is not your customer. They cannot give it freely if they do not know the check is happening, and if they withdraw it you have to stop. Public task is for public authorities carrying out official functions. If you are a private company, your realistic choice is between legitimate interests, recognised legitimate interest, and a specific legal obligation.
What Did the Data (Use and Access) Act 2025 Change?
The Data (Use and Access) Act 2025 received Royal Assent in June 2025 and was commenced in stages. The biggest group of UK GDPR amendments, including section 70 on lawfulness of processing, came into force on 5 February 2026 under the Commencement No. 6 Regulations. On 19 June 2026 the ICO updated its guidance for organisations to say that all data protection provisions of the Act are now in force.
For OSINT teams, four changes matter most.
A new recognised legitimate interest basis
Annex 1 to the UK GDPR now lists pre-approved purposes: responding to requests from bodies with public tasks, national security and defence, emergencies, crime, and safeguarding vulnerable people. The crime condition covers processing necessary for detecting, preventing or looking into crime, and the ICO's recognised legitimate interest guidance confirms it includes scams, fraud and money laundering. Two catches: public authorities cannot use it for their own tasks, and the ICO says the processing must be "more than just useful". You also have to tell people you rely on it and name the condition.
Clearer examples of ordinary legitimate interests
Article 6 now gives examples of processing that may be a legitimate interest, such as direct marketing, intra-group sharing for internal administration and keeping network and information systems secure. These are examples, not free passes. You still run the three-part test.
Changes to the duty to inform
Article 14 covers data you did not collect from the person, which is exactly what OSINT produces. The old disproportionate effort exception in Article 14(5)(b) was replaced. The current Article 14 puts it in 14(5)(e) and (f), says disproportionate effort depends on things like the number of people and the age of the data, and requires "appropriate measures" when you rely on it, such as publishing the information more generally.
Complaints handling
Controllers must now have a way for people to complain about their data use, acknowledge complaints within 30 days and respond without undue delay. If your research team is the most likely source of a complaint, make sure it reaches the right inbox.
Why Regulators Take Open-Source Collection Seriously
If you want proof that "it was on the internet" is not a defence, the ICO's case against Clearview AI over images collected from public websites is the usual example: in October 2025 the Upper Tribunal ruled in the ICO's favour that UK data protection law applied.
Your team is not building a database on that scale. But the principle carries straight over to everyday work: the public nature of a source does not switch off the UK GDPR, and the regulator will look at the scale, purpose and effect of what you collect. A two-page supplier check with a recorded purpose sits in a very different place from an open-ended spreadsheet of everything a person has ever posted.
There is a commercial side too. Insurers, lenders and fraud teams who cannot show their lawful basis often end up either over-collecting (and carrying regulatory risk) or under-researching (and paying out on claims they should have questioned). Our insurance and fraud research page covers how teams in that sector use open sources inside a documented process.
Running the ICO Three-Part Test by Hand
The ICO's detailed legitimate interests guidance, updated in March 2026 for the new Act, breaks the basis into three questions. You must answer all three, and you should record the answers before the research starts. The ICO's guide on applying legitimate interests in practice sets out the questions for each stage.
Purpose: what are you trying to achieve?
Write the interest as an outcome, not an activity. "Research the claimant" is an activity. "Establish whether the business the claimant says was damaged was trading on the date of loss" is an outcome. The second version tells you when to stop searching, which is half the battle.
Necessity: is open-source research the least intrusive way to get there?
The ICO asks whether the processing actually helps and whether you could reach the same result with less data or a less intrusive method. In practice this means scoping: which Search types, which identifiers, which date range. If the claim form already includes a company number, start at the company register before you touch anything about the individual.
Balancing: would a reasonable person expect this, and could it cause unjustified harm?
The test is objective. Would a reasonable person in this position expect an insurer to check public information about a business claim? Probably yes. Would they expect you to review their family members' social media? Probably not. Weigh the nature of the data, the relationship, the likely impact and the safeguards you will apply.
A plain-text LIA record you can reuse
The ICO offers a sample LIA template in Word format. Many teams find it easier to keep a short structured record inside the case folder itself, so the reasoning travels with the work. Here is the format we suggest:
LIA-REF: LIA-2026-014
CASE-REF: CASE-0427
PURPOSE: Establish whether Examplefield Ltd was trading on 03/2026
LAWFUL BASIS: 6(1)(f) legitimate interests
SCOPE: Company register, domain history, business listings only
OUT OF SCOPE: Personal social media, family members, health information
NECESSITY: Claim documents conflict; register check alone is insufficient
BALANCING: Business claim, public business sources, low impact
SAFEGUARDS: Named analyst only; findings reviewed by team lead
RETENTION: Delete working notes 12 months after claim closes
REVIEW DATE: 2026-12-01
APPROVED BY: j.smith (team lead)Each line forces a decision. SCOPE and OUT OF SCOPE are the lines that do the most good, because they turn the necessity test into instructions an analyst can follow on a busy afternoon. REVIEW DATE matters because the ICO expects you to refresh an LIA if the purpose or context changes.
Checking your retention period is real
A retention period that nobody enforces is worse than none, because it tells a regulator you knew what to do. If your case files live in a shared folder, a one-line command will list folders older than your period:
find /shared/osint-cases -maxdepth 1 -type d -mtime +365 -printf "%TY-%Tm-%Td %p\n" | sort-maxdepth 1 keeps it to top-level case folders, -type d limits results to directories, -mtime +365 matches anything not modified for more than a year, and -printf prints the last-modified date beside each path so a reviewer can sanity-check before deleting. Folder modification times change when a file is added, so treat this as a prompt for review, not an automatic deletion rule.
When you do export a finished report, record its hash so you can show later that it has not changed:
sha256sum CASE-0427-report.pdf >> CASE-0427-hashes.txtWorked assessment one: a fraud team reviewing a business interruption claim
Context. A mid-sized UK insurer receives a business interruption claim from Examplefield Ltd, a small events company. The claim says a website outage and cancelled bookings cost £80,000 in March 2026. The claims handler notices the company website, examplefield.example.com, looks newly built.
Actions. The fraud team lead writes the LIA above before any research. Purpose: establish whether the company was trading at the time of loss. Necessity: the claim documents conflict, and public business records are the least intrusive way to test them. Balancing: the claimant is a business, the sources are business records, and a reasonable director would expect an insurer to check a claim of this size. Scope is set to the company register, domain registration and archive history, and business listings. The director's personal social media is recorded as out of scope unless the business sources raise a specific question.
Outcome. The register shows the company was incorporated in January 2026. The domain was registered in February 2026, and the earliest archived capture of the website is from April 2026, after the claimed loss. The team refers the claim for a formal interview. Because the LIA was written first and the research stayed inside scope, the file can be disclosed to the claimant's solicitor without embarrassment if a subject access request arrives.
Could the insurer have used recognised legitimate interest under the crime condition instead? Possibly, once there is a genuine suspicion of dishonesty. We would still record the reasoning in the same format, because necessity and transparency apply either way, and the insurer would need to tell people it relies on that basis.
Worked assessment two: supplier due diligence before a contract
Context. A procurement team at a UK logistics firm is about to sign a £250,000 warehousing contract with Example Storage Ltd. The supplier's two directors will have site access and the firm's policy requires proportionate checks on associated persons.
Actions. Purpose: confirm the supplier is established, solvent on its public filings, not subject to sanctions, and free of recent adverse press relevant to the contract. Necessity: the firm cannot rely only on the supplier's own questionnaire, and public registers are proportionate for a contract of this value. Balancing: directors of a limited company expect their appointments and filings to be checked. The team decides that the directors' names will be checked against the register, sanctions lists and news coverage connected to their business roles, but not against personal social accounts.
Outcome. Filings are up to date and there is no sanctions match. One news article mentions a director by name in connection with a 2019 dispute at another company. The team records it, notes it was resolved and unrelated to warehousing, and signs the contract. The LIA, the search log and the decision note sit together in one file, and the retention period is set at contract end plus six years to match the firm's contract records.
Recording the Lawful Basis Inside Your UserSearch Workflow
Doing all this by hand is possible. The friction is that the reasoning lives in one place (a Word template) and the research lives in another (twenty browser tabs, three CLI tools and a spreadsheet). When a subject access request or a complaint lands six months later, rebuilding what was searched, and why, takes days.
UserSearch 2.0 was built for on-demand professional research with that audit trail in mind. A few features map directly onto the legal duties above:
- Cases with Forensic Mode store search history and bookmarks in a Case, so your record of what was searched sits beside the LIA reference and the findings.
- Private mode does not store search history. That is useful for a quick scoping check where you have decided no record should be kept beyond your own notes, and it supports minimisation.
- OneScan runs one input across the data sources you select and merges the results with source attribution. The Credit cost is shown before you run it, and choosing sources deliberately is itself a necessity decision you can record.
- SargeBot, our AI research assistant, asks you to set a lawful objective before it builds entity searches, and can produce a PDF report. AI output is a draft for a human to verify, not a finding.
- Teams share Cases and a Credit pool controlled by the team leader, which makes it easier to restrict who can see a sensitive file.
If you are new to the platform, our beginner's guide to UserSearch walks through setting up a first Case. Treat every result as a lead to corroborate: coverage and freshness depend on the third-party source, and an old record is not proof of a current fact.
Advanced Patterns for Lawful OSINT Programmes
Template LIAs for repeat work
If your team runs the same kind of check fifty times a month, write one master LIA for that activity and a short case-level addendum for anything unusual. In our view there is no need to start from scratch for identical processing, but the ICO does expect you to refresh an LIA when the purpose, nature or context changes, so you need to notice when a case is not identical, for example when the person is a child or the enquiry moves into health information.
Separating the company from the individual
Most due diligence is about an organisation, but people come along with it. Run company-level Search types first (Corporate Intelligence, Domain Intelligence), and only move to individuals when the company record gives you a specific reason. That sequencing is the necessity test in action, and it reads well in a file review.
Answering a subject access request about your research
People can ask what you hold about them, and since the 2025 Act you only have to make reasonable and proportionate searches to answer. That is much easier when research lives in named Cases rather than personal browser histories. Agree in advance who decides whether an exemption applies, for example where disclosure would prejudice preventing crime.
Reusing findings for a new purpose
Findings gathered for a supplier check should not quietly become marketing data or an HR file. The Act added a new Article 8A on compatible purposes. Before you reuse anything, run a fresh compatibility check or a new LIA, and record the result.
Minimisation, Retention, Transparency and Sensitive Data
A valid lawful basis does not cover everything. The other principles still bite, and in our experience they are where OSINT files go wrong.
- Data minimisation. Collect what is adequate, relevant and limited to your purpose. The ICO's data minimisation guidance is short and worth reading with your analysts. In practice: screenshot the relevant post, not the whole account; note that a relative exists, not their details.
- Retention. Set a period for working notes and a separate one for final reports, and delete on schedule. The storage limitation principle expects you to justify both.
- Transparency. Your privacy notice should say that you may check public sources for the purposes you rely on. If you do not notify each person individually, record why under Article 14(5) and what appropriate measures you have taken instead.
- Special category data. Health, religion, political opinion, sexual orientation, ethnicity and the other categories need an Article 9 condition as well as an Article 6 basis. The ICO's special category data guidance notes that information you can infer with reasonable certainty counts too. If a search turns up this kind of material and it is not needed, do not keep it.
- Offence data. Information about offences or allegations falls under Article 10 and needs a condition in Schedule 1 of the Data Protection Act 2018, such as preventing or detecting unlawful acts, or regulatory requirements relating to unlawful acts and dishonesty. Many conditions need an appropriate policy document.
- High-risk processing. If your LIA finds a likely high risk to people, for example large-scale research programmes or anything involving vulnerable people, the ICO expects a data protection impact assessment before you start.
Stay inside the law and the platform's terms: use only information that is openly available, do not log in to places you are not entitled to be, and be open about who you are whenever you contact people. If a case starts to drift from the business question towards a person's private life, stop and go back to your LIA. Our OSINT fundamentals knowledge base covers the working habits that keep research proportionate.
One more time, because it matters: this article is general information about UK law as it stands in September 2026. It is not legal advice, and the ICO's guidance on the 2025 Act is still being updated.
Frequently Asked Questions About OSINT and UK GDPR
Is OSINT legal in the UK?
OSINT is legal in the UK when it is done on a sound footing. Information found on the open web about a person is still personal data, so UK GDPR applies once a team collects, stores or combines it. A defensible check has a lawful basis, a recorded purpose, a scope limited to what is needed, and a retention period.
Does UK GDPR apply to publicly available information?
Yes. UK GDPR applies to publicly available information about people, because data protection law looks at what an organisation does with information, not where it came from. A director's name on a company register, a handle on a public forum or a photo on a business website all become personal data once collected into a case file about someone.
What lawful basis do companies use for OSINT under UK GDPR?
Most commercial OSINT relies on legitimate interests under Article 6(1)(f) of the UK GDPR, supported by a written assessment. Legal obligation applies where a law requires the check, such as customer due diligence under the Money Laundering Regulations. Recognised legitimate interest covers a closed list of purposes, including detecting and preventing crime. Consent is almost never suitable.
What is the ICO three-part legitimate interests test?
The ICO three-part test asks three questions that must all be answered and recorded before OSINT research starts. Purpose: what outcome is the team trying to achieve? Necessity: is open-source research the least intrusive way to reach it? Balancing: would a reasonable person expect the processing, and could it cause unjustified harm, given the data, relationship and safeguards?
What did the Data (Use and Access) Act 2025 change for OSINT?
The Data (Use and Access) Act 2025 added recognised legitimate interest, a basis for a closed list of purposes including crime, with no balancing test but a necessity requirement. The Act also gave examples of ordinary legitimate interests, changed the Article 14 duty to inform, and required controllers to acknowledge data protection complaints within 30 days.
Do you need to tell people you researched them with OSINT?
Article 14 of the UK GDPR covers data not collected from the person, which is what OSINT produces. A privacy notice should say that the organisation may check public sources for the purposes it relies on. Where individual notice would involve disproportionate effort, the organisation should record why under Article 14(5) and what appropriate measures it has taken instead.
From a Documented Purpose to a Defensible File
OSINT is lawful in the UK when you can show your working. Pick the right basis, run the three-part test before the first search, keep the research inside the scope you wrote down, and delete what you no longer need. Teams that do this rarely fear a subject access request, because the answer is already in the file.
UserSearch makes that discipline easier to keep. One account gives you 18 Search types and access to 100+ third-party data sources, so you are not juggling separate provider logins. OneScan merges results with source attribution, Cases in Forensic Mode record what you searched, and SargeBot can turn verified findings into a PDF report that sits beside your LIA.
Stop guessing. Start researching with UserSearch. Open a Case, record your lawful objective, and run your next proportionate check at UserSearch.