Understanding Lawful Basis for Professional Surveillance in the UK

In the United Kingdom, professional surveillance is governed by a complex interplay of data protection legislation, human rights law, and industry codes of practice. For private investigators, solicitors, insurers, and corporate clients, establishing a lawful basis before deploying any observational or research methodology is not optional — it is the foundation upon which the admissibility and legitimacy of the entire investigation rests. This article examines the legal frameworks that underpin lawful surveillance, the practical steps investigators take to document their authority, and the consequences of operating without a clearly articulated basis.

The Legal Framework Governing Surveillance

The primary legislation shaping private sector surveillance in the UK is the Data Protection Act 2018, which incorporates the UK General Data Protection Regulation (UK GDPR). Any activity that results in the collection, processing, or storage of personal data — including CCTV footage, observational logs, vehicle tracking data, and open-source research — falls within its scope. An investigator must identify a lawful basis under Article 6 of the UK GDPR before processing begins, and in many cases must also satisfy a condition for processing special category data under Article 9.

The Human Rights Act 1998 incorporates the European Convention on Human Rights into domestic law. Article 8 guarantees the right to respect for private and family life, and any surveillance that intrudes upon that right must be proportionate, necessary, and lawful. While the Regulation of Investigatory Powers Act 2000 (RIPA) applies primarily to public authorities, its principles of necessity and proportionality are widely regarded as the benchmark for private sector conduct. Professional investigators apply these standards voluntarily to ensure their evidence withstands judicial scrutiny.

The Investigatory Powers Act 2016 further regulates the interception of communications, and private investigators are expressly prohibited from undertaking any activity that would constitute unlawful interception. This boundary is critical: an investigator may observe a subject in a public place, but may not hack a device, intercept private messages, or deploy intrusive technical measures without consent and lawful authority.

Establishing a Lawful Basis in Practice

Before any surveillance operation commences, a written assessment of the lawful basis should be documented. For litigation support, the most commonly relied upon basis is 'legitimate interests' under Article 6(1)(f) of the UK GDPR. This requires the investigator to balance their legitimate interest in conducting the surveillance against the rights and freedoms of the data subject. A documented Legitimate Interests Assessment (LIA) demonstrates that this balancing exercise has been carried out.

For legal proceedings, the basis may also fall under Article 6(1)(c) — compliance with a legal obligation — or Article 6(1)(e) — performance of a task carried out in the public interest. Insurance fraud investigations frequently rely on legitimate interests, supported by the terms of the insurance contract that permit verification of claims. Corporate due diligence engagements may rely on legitimate interests where the processing is necessary to assess a commercial risk.

The key principle is documentation. A verbal instruction is insufficient. A written engagement letter, signed terms of business, and a documented assessment of the lawful basis provide the evidential trail that protects both the investigator and the instructing client. If the matter proceeds to court, opposing counsel will scrutinise the basis upon which evidence was obtained, and any gap in the documentation can render otherwise compelling evidence inadmissible.

Proportionality and Necessity

Even where a lawful basis exists, the surveillance must be proportionate to the objective being pursued. This means using the least intrusive method capable of achieving the investigative goal. If a single day of observation is sufficient to establish whether a claimant is performing physical tasks inconsistent with their stated disability, deploying a team for two weeks would be disproportionate. If open-source research can verify a subject's current address, physical surveillance is unnecessary.

Necessity requires that the information cannot reasonably be obtained by less intrusive means. Investigators must document the alternatives considered and explain why surveillance was the only viable option. This documentation becomes part of the evidential chain and demonstrates to the court that the investigator acted judiciously rather than opportunistically.

Proportionality also extends to the duration, intensity, and methods of surveillance. Continuous covert tracking, prolonged observation of a private residence, and monitoring of a subject's family members are all indicators of potential disproportionality. A professional investigator sets clear operational boundaries at the outset and reviews them throughout the engagement.

Data Handling and Evidence Preservation

Once surveillance data is collected, it becomes personal data subject to the UK GDPR. It must be stored securely, retained only for as long as necessary, and deleted when the purpose for which it was collected has been fulfilled. Investigators must maintain a data processing register, document retention periods, and ensure that raw footage is stored in encrypted formats with controlled access.

Evidence preservation is equally critical. The continuity of evidence — the unbroken chain from collection to presentation in court — must be maintained. Surveillance logs should record the date, time, location, operatives involved, and equipment used. Original footage should be preserved without editing, and any working copies clearly labelled as such. Metadata, including timestamps and GPS coordinates, should be preserved in their original format.

For open-source intelligence, source preservation is paramount. Screenshots alone are insufficient; investigators should capture the URL, access date, page source code, and where possible archive the page using a third-party preservation service. This ensures that if the original content is altered or removed, the investigator can demonstrate what was publicly available at the time of access.

Consequences of Unlawful Surveillance

Surveillance conducted without a lawful basis exposes both the investigator and the instructing client to significant legal risk. The Information Commissioner's Office (ICO) has the power to issue substantial monetary penalties for breaches of the UK GDPR. Civil claims for misuse of private information and breach of confidence can result in damages awards and legal costs. In serious cases, criminal prosecution under the Data Protection Act for unlawful data obtaining or selling may follow.

For the instructing client, the consequences extend to the courtroom. Evidence obtained unlawfully may be excluded under section 78 of the Police and Criminal Evidence Act 1984 in criminal proceedings, or challenged in civil proceedings on the grounds of public policy. A solicitor who instructs surveillance without ensuring a lawful basis may face professional conduct scrutiny. The reputational damage to all parties can be severe and long-lasting.

This is why professional investigators operating to recognised standards — such as those accredited by the World Association of Professional Investigators (WAPI) or holding membership of the Institute of Professional Investigators (IPI) — insist on documented lawful basis before accepting any instruction. It is not a bureaucratic hurdle; it is the cornerstone of professional, ethical, and legally defensible investigative practice.

Conclusion

Establishing a lawful basis for surveillance is the single most important step in any professional investigation. It protects the client, the investigator, and the integrity of the evidence. At FIND Investigations, every instruction begins with a documented assessment of lawful basis, proportionality, and necessity — because evidence that cannot withstand legal challenge is worth nothing.

Frequently Asked Questions