Why Some People Tracing Requests Are Restricted in the UK

Professional people tracing in the UK operates within a framework that extends well beyond technical capability. While modern tracing methods can identify address associations and contact points with a high degree of accuracy, the decision to proceed with a trace is governed by legal, ethical, and safeguarding considerations, not simply whether information can be located.

Tracing services are routinely used for legitimate and well-established purposes, including civil litigation, debt recovery, probate matters, asset recovery, and corporate due diligence. In these contexts, tracing plays an important procedural role by enabling lawful contact, correspondence, or service of documents. However, not every request that appears reasonable on its face can be accepted, and not every asserted purpose satisfies the standards required under UK data protection and safeguarding principles.

Responsible tracing agents are required to assess how the information will be used, the relationship between the requester and the subject, and the potential risk to the individual being traced. This assessment is not a formality. Certain categories of requests carry an inherently higher risk of misuse, harassment, or harm, even where a client believes their intentions to be justified. In such cases, ethical and regulatory obligations may require a tracing provider to restrict, refuse, or reroute the request, regardless of commercial considerations.

Safeguarding exclusions exist to prevent tracing services from being used in ways that could expose vulnerable individuals to unwanted contact, coercion, or emotional harm. They also protect clients by ensuring that any tracing undertaken can be relied upon without creating legal, reputational, or compliance risk. These boundaries are particularly important in scenarios involving personal relationships, family disputes, or situations where power imbalances may be present.

This article explains why safeguarding restrictions are a necessary and integral part of professional people tracing in the UK, outlines the types of tracing requests that typically raise heightened concern, and clarifies how responsible tracing agents determine when work cannot proceed or when it must be undertaken only with appropriate legal oversight.

For a general overview of people tracing, see our main guide

Why Safeguarding Is Central to Professional Tracing

People tracing involves the identification of individuals through the use of regulated and lawfully accessed data sources. While these tools are essential for legitimate investigative and legal purposes, they also carry an inherent responsibility. When tracing capabilities are misapplied or insufficiently controlled, they can expose individuals, particularly those in vulnerable circumstances, to unwanted contact, intimidation, harassment, or emotional harm.

For this reason, professional tracing in the UK is not governed solely by what is technically possible, but by what is proportionate, lawful, and ethically defensible. Tracing agents are required to exercise judgement at the outset of every instruction, assessing risk alongside legality. This is a fundamental distinction between regulated professional tracing services and automated or unregulated data lookups.

UK tracing professionals operate within overlapping legal and regulatory obligations, including:

UK GDPR and the Data Protection Act 2018, which require personal data to be processed lawfully, fairly, and in a manner that is necessary and proportionate to a defined purpose.
ICO guidance on legitimate interest, which makes clear that lawful basis alone is not sufficient if the individual’s rights and freedoms are likely to be adversely affected.
Safeguarding best practice, which requires consideration of the potential impact of tracing on the subject, particularly in situations involving personal relationships, conflict, or imbalance of power.
Industry standards for ethical investigations, which emphasise restraint, accountability, and refusal where risk outweighs justification.

Together, these obligations impose a duty on tracing agents to evaluate how tracing results may be used, not merely whether they can be obtained. A tracing request may be lawful in isolation, but still inappropriate when viewed through a safeguarding lens.

As a result, professional tracing agents must assess more than data availability. They must consider the context of the request, the relationship between the parties involved, and the foreseeable consequences of disclosure. Where the risk of misuse or harm cannot be reasonably mitigated, ethical practice requires that tracing work is restricted, declined, or redirected through appropriate legal channels.

This safeguarding-led approach is not an obstacle to legitimate tracing, it is the mechanism that ensures tracing remains a responsible, trusted, and defensible professional service in the UK.

Categories of Requests That Require Restriction

Certain types of tracing requests carry inherent safeguarding risk, regardless of how they are presented.

Family Law and Relationship-Based Tracing

Tracing requests connected to:

Ex-partners
Divorce or separation disputes
Family law matters
Estranged relatives

are particularly sensitive.

These scenarios may involve:

Ongoing emotional conflict
Power imbalances
Risk of harassment or coercive behaviour

For this reason, responsible tracing firms do not undertake such requests for private individuals, even where a financial dispute is alleged.

Where tracing is genuinely required in these contexts, it is typically undertaken only via a solicitor, ensuring appropriate oversight and lawful purpose.

Consent-Based Tracing in Family or Friend Matters

In limited circumstances, professional tracing services may undertake consent-based tracing for family or friend-related matters. This approach differs from standard tracing in that no personal data is disclosed to the requester unless and until the subject has given explicit consent.

Consent-based tracing is typically used where there is a genuine welfare or reconnection purpose, such as attempting to re-establish contact with an adult family member or long-standing friend, and where no legal dispute or adversarial context exists. In these cases, the tracing agent acts as an intermediary, forwarding a confidential communication to the subject and allowing them to decide whether to respond.

Crucially, consent-based tracing does not involve revealing an address, location, or contact details to the requester. If consent is refused or no response is received, the process concludes without disclosure. This safeguard ensures the individual’s autonomy and right to privacy are fully respected.

However, even within a consent-based framework, strict exclusions remain in place. Responsible tracing firms do not undertake consent-based tracing in relation to:

Ex-partners or former spouses
Divorce, separation, or family law disputes
Situations involving prior conflict, control, or emotional harm

These scenarios carry an inherently higher safeguarding risk, and the presence of consent-based mechanics does not remove that risk. Allowing such requests could inadvertently facilitate unwanted contact or reopen harmful dynamics, even where intentions are presented as benign.

For this reason, reputable tracing providers maintain a clear distinction between non-adversarial reconnection requests and matters arising from the breakdown of personal relationships. Where tracing is genuinely required in ex-partner or divorce contexts, it must be undertaken only through a solicitor, ensuring appropriate legal oversight and safeguarding controls are in place.

This approach reflects best practice across the UK tracing industry and ensures that consent-based tracing remains a narrowly defined, carefully controlled service rather than a workaround for restricted requests.

Adoption and Birth-Relative Tracing

Tracing relating to:

Adoption
Birth parents
Children placed in care

is subject to additional legal protections and safeguarding frameworks.

In the UK, specialist statutory or regulated services exist specifically to manage these cases. General people tracing services are not an appropriate channel, and responsible firms will decline such requests outright.

Harassment, Stalking, or Obsessive Behaviour Indicators

Tracing agents are trained to identify red flags, including:

Requests framed with emotional urgency rather than lawful purpose
Attempts to bypass solicitor involvement
Inconsistent or evasive explanations of intended use
Repeated tracing attempts on the same individual

Where risk indicators are present, ethical practice requires refusal — even if data access would technically allow a trace to proceed.

Legitimate Interest Is Not Unlimited

A common misconception is that asserting “legitimate interest” automatically permits tracing.

In reality, legitimate interest requires a balancing test:

Is the purpose lawful and specific?
Is the tracing necessary to achieve that purpose?
Does the subject’s right to privacy outweigh the requester’s interest?

Where safeguarding risks are elevated, the balance may fall decisively against proceeding.

Why Solicitor-Led Tracing Is Treated Differently

When tracing is conducted via a solicitor:

The purpose is clearly defined
Legal accountability exists
Safeguarding decisions are supported by professional oversight

This is why certain categories of tracing are accepted only when instructed by legal professionals.

It is not a commercial distinction, it is a safeguarding requirement.

What Happens When a Request Is Excluded

When a tracing request falls outside acceptable parameters, responsible providers will:

Decline the request
Explain the restriction clearly
Avoid collecting unnecessary personal data
Prevent misuse through cancellation rather than partial fulfilment

This protects:

The subject
The client
The tracing provider

and maintains the integrity of the tracing process.

Why These Boundaries Matter for Clients

Safeguarding exclusions are not obstacles, they are evidence of professionalism.

They demonstrate that:

Tracing is conducted responsibly
Legal and ethical standards are upheld
Results can be relied upon without reputational or legal risk

Clients who require tracing for legitimate, lawful purposes benefit from knowing that clear lines exist and are enforced.

GDPR Still Applies to Open-Source Information

A common misconception in people tracing is that information found online or in the public domain can be freely used without restriction. In practice, this assumption is incorrect and potentially exposes both clients and tracing agents to significant legal and ethical risk.

Open-source intelligence (OSINT) refers to information that is publicly accessible, such as electoral roll extracts, business registers, company filings, social media content, online directories, archived webpages, or forum posts. While these sources may be publicly viewable, the use, aggregation, assessment, and onward disclosure of that information still constitutes the processing of personal data under UK data protection law.

Publicly Available Does Not Mean Unregulated

Under the UK GDPR and the Data Protection Act 2018, personal data does not lose its protected status simply because it is publicly accessible. If information can be linked to an identifiable living individual, it remains personal data regardless of where it was sourced.

When a professional tracing agent:

Searches for an individual using OSINT techniques
Correlates online information with other datasets
Assesses likelihood of residency, contactability, or association
Produces a report for a client

they are actively processing personal data. This triggers full GDPR obligations, including lawful basis, purpose limitation, data minimisation, accuracy, and safeguarding considerations.

Legitimate Interest Still Must Be Assessed

Even where OSINT is used, tracing activity must still be grounded in a clearly defined lawful basis—most commonly legitimate interest. This is not automatic and cannot be assumed simply because the data is “public”.

A proper legitimate interest assessment requires consideration of:

The purpose of the trace and whether it is lawful, proportionate, and necessary
The reasonable expectations of the data subject
The potential impact or harm that disclosure or contact could cause
Whether less intrusive means could reasonably achieve the same outcome

Where the purpose fails these tests—such as in cases involving family disputes, ex-partners, harassment risk, or vulnerable individuals—OSINT data cannot be used as a workaround to bypass safeguarding restrictions.

Safeguarding Risks Are Often Higher With OSINT

Open-source data can be incomplete, outdated, misleading, or taken out of context. Social media profiles, online comments, or historical posts may suggest an association with an address or location that no longer exists, or may reflect shared households, family homes, or temporary accommodation.

More importantly, misuse of OSINT presents heightened safeguarding risks, particularly where:

The requester has a personal or emotional relationship with the subject
There is a history of conflict, separation, or estrangement
The subject may be vulnerable or deliberately avoiding contact

For this reason, responsible tracing agents apply stricter safeguards, not fewer, when OSINT indicators appear in sensitive scenarios.

Professional Tracing Agents Remain Data Controllers

When a tracing agency collects, analyses, and reports on OSINT data, it does so as a data controller, not merely a passive conduit of information. This means the agency is responsible for:

Determining whether the data should be processed at all
Ensuring the purpose is lawful and justified
Preventing misuse, harm, or unlawful disclosure
Refusing instructions where the risk outweighs the legitimacy

This responsibility applies equally whether the data originated from a credit reference agency, a regulated database, or an open-source platform.

Why OSINT Does Not Bypass Ethical or Legal Limits

It is sometimes suggested that if information can be “found on Google,” it can be freely used for tracing. This is incorrect. The key issue is not where the data comes from, but how and why it is used.

Professional tracing is outcome-driven: it enables contact, service of documents, or enforcement action. Because of that downstream impact, tracing agents must apply the same legal, ethical, and safeguarding standards to OSINT as they would to any other data source.

Where a tracing request cannot be justified using regulated datasets due to safeguarding concerns, OSINT cannot lawfully be used to achieve the same end by alternative means.

A Compliance-Led Approach to OSINT

In responsible tracing practice, open-source information is used:

As a supporting indicator, not a sole determinant
In conjunction with regulated and verified data sources
Within a documented lawful basis framework
Subject to manual review and safeguarding checks

OSINT does not sit outside GDPR, it sits firmly within it. Any professional tracing service that suggests otherwise is either misunderstanding the law or exposing clients to unnecessary risk.

Tracing

Financial

Property

Investigations

Get Help

Your Account

Services