Legal and regulatory framework

The UK GDPR is the primary data protection framework in the United Kingdom. It sets out the principles that must govern the processing of personal data, the rights of individuals whose data is processed, and the obligations of those who process it.

Key principles relevant to investigation work: personal data must be processed lawfully, fairly, and transparently; collected for specified, explicit, and legitimate purposes; adequate, relevant, and limited to what is necessary; and kept no longer than necessary.

We assess and document a lawful basis before processing personal data. Where we rely on legitimate interests, we assess purpose, necessity, and the balance with the individual’s rights. Special category and criminal offence data need additional conditions; a client’s interest alone is not enough.

The Data Protection Act 2018 supplements and tailors the UK GDPR for the United Kingdom. It provides additional provisions for specific processing contexts and sets out exemptions that may apply in certain circumstances.

Some exemptions can restrict particular data protection obligations where their specific conditions are met. An ongoing private investigation is not a blanket exemption from transparency or subject access rights. We assess exemptions case by case, following the ICO’s guidance.

RIPA provides a framework for public authorities to authorise certain covert surveillance and human intelligence activity. Much of its original interception and communications-data framework has been replaced by the Investigatory Powers Act 2016.

Harwick has no public-authority surveillance powers. RIPA does not give us permission to follow someone, compel disclosure, or intrude into private communications. We do not intercept phone calls, emails, or private messages.

Private investigation must independently comply with data protection, privacy, harassment, and other applicable law. Public-authority authorisation procedures are not a private-investigator licence.

The Investigatory Powers Act 2016 updated and expanded the framework for state surveillance powers. Like RIPA, it primarily applies to public authorities and does not confer powers on private investigators.

The Act also creates offences, including interception without lawful authority. Its exceptions and authorisation routes are specific; the fact that a client wants information does not authorise access to it.

The Human Rights Act 1998 incorporates the rights set out in the European Convention on Human Rights into UK law. The right most directly relevant is Article 8 — the right to respect for private and family life.

The Human Rights Act directly binds public authorities, including courts, and privacy rights also inform the law applied to disputes between private parties. Necessity and proportionality guide our assessment, but do not by themselves authorise an intrusive method.

Evidence obtained through disproportionate or unlawful intrusion may be inadmissible and could expose those who obtained it to civil or criminal liability.

The Protection from Harassment Act 1997 creates civil and criminal liability for a course of conduct that amounts to harassment. It is relevant to our work in two ways: it constrains surveillance operations (persistent surveillance could constitute harassment), and it is frequently the basis on which clients instruct us to gather evidence.

The Computer Misuse Act 1990 creates criminal offences for unauthorised access to computer material. This is a firm boundary for our cyber investigation work: we do not access computer systems, accounts, or data without lawful authorisation.

Our cyber and OSINT investigations rely exclusively on open-source information, passive observation, and data that is publicly accessible or to which we have been granted authorised access. We will not accept instructions that would require us to do otherwise; our guide on phone records and messages explains what that rules out and what is possible instead.

A misconduct investigation should establish the facts fairly, including evidence that supports and challenges the allegation. A report alone does not make a dismissal fair: the employer must consider the applicable law, procedure, and circumstances. The Acas Code of Practice explains the main disciplinary safeguards in Great Britain.

The Equality Act 2010 is relevant in two respects: the investigation process itself must not discriminate on the basis of protected characteristics; and we may be instructed to investigate allegations of discrimination or harassment in the workplace. Our reports focus on conduct and evidence rather than characteristics of individuals.

The Fraud Act 2006 creates a general offence of fraud by false representation, by failing to disclose information, or by abuse of position. It is the primary legislation under which many matters our clients ask us to investigate are criminal offences. Evidence gathered may support a complaint to the police, civil proceedings for recovery of losses, or internal disciplinary action.

Where we become aware of possible money laundering in the course of an investigation, we may be required to make a Suspicious Activity Report (SAR) to the National Crime Agency. We take legal advice on our obligations in any case where this arises. We will not inform a subject that a SAR has been, or may be, made, as doing so could constitute a tipping-off offence.

The Online Safety Act 2023 creates new communications offences including sending communications that are false with intent to cause harm. It is relevant to our cyber harassment and online threat investigation services — clients who are victims of online harassment may have recourse under these new offences, and our investigations are designed to gather evidence in a form that supports complaints and proceedings.

The Act continues to cover certain indecent or grossly offensive communications sent with the required intent. Its false-message and threatening-communication provisions were replaced for conduct from 31 January 2024 by offences under the Online Safety Act 2023. The date, content, intent, and jurisdiction matter; see the CPS guidance on communications offences in England and Wales.

Section 78 concerns prosecution evidence in criminal proceedings in England and Wales. It allows exclusion where admission would adversely affect the fairness of proceedings to the extent that it ought not be admitted. It is not a general rule that lawfully collected private-investigator evidence must be accepted.

The SIA operates a licensing regime for a number of security roles. A licensing requirement for private investigators was provided for under the Act but has not yet been brought into force. As of 2026, private investigators are not currently required to hold an SIA licence to operate lawfully in the UK.

We monitor developments in the regulation of the industry closely, and we assess the licensing requirements of each activity and jurisdiction. We do not claim to hold a private-investigator licence or meet a future licensing standard. Because there is no licence to check, choosing an investigator sets out what you can ask and verify yourself, and our guide on what a private investigator can and cannot legally do explains what the absence of a licence does and does not mean.