Privacy, Confidentiality & Data Protection
Last updated: 23 September 2026
London Confidential handles information that can be highly sensitive. This Privacy Policy explains how we collect and use personal information when someone visits londonconfidentialinvestigations.com, contacts us, makes a confidential enquiry, instructs us, is involved in an investigation, appears in evidence or research, or otherwise interacts with our services.
Our work can involve private individuals, businesses, directors, employees, legal professionals, witnesses, family members, investigation subjects and other third parties. The exact information we process, our role and the lawful basis we rely on depend on the circumstances of each matter.
London Confidential provides private, corporate and legal investigation and intelligence services from Salisbury House, 29 Finsbury Circus, London EC2M 5SQ.
For information collected through this website, direct enquiries and most investigation work that we undertake in our own professional capacity, London Confidential will usually act as a data controller. This means we decide why personal information is needed and the means by which it is handled.
In some professional arrangements, particularly where we work within a wider legal, corporate or outsourced instruction, our precise data-protection role can depend on the contractual and factual circumstances. We may act as an independent controller, joint controller or, in some situations, process specified information on documented instructions. Where that distinction materially affects you, the relevant engagement terms or additional privacy information will explain it.
This policy may apply to personal information relating to:
This policy is intended to explain our general approach. A particular instruction may require additional or more specific privacy information because investigative work is fact-sensitive.
Our handling of personal information is governed primarily by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where relevant to electronic communications or device storage, the Privacy and Electronic Communications Regulations 2003 (PECR). The Data (Use and Access) Act 2025 has amended parts of the UK's data-protection and privacy framework without replacing the UK GDPR or Data Protection Act 2018.
We aim to handle personal information lawfully, fairly and transparently; collect only what is relevant; keep it accurate where necessary; retain it only for as long as justified; and apply security appropriate to the sensitivity and risk of the information.
Important: private investigation does not create a general exemption from data-protection law. We consider the legal basis, necessity, proportionality, sensitivity and purpose of the information we process in each matter.
The categories of personal information involved vary widely depending on whether you are simply using our website, making an enquiry or connected with an investigation. They may include:
Some investigations can involve particularly sensitive information. Under the UK GDPR, special category data includes information revealing or concerning matters such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data used for identification, health, sex life or sexual orientation.
Criminal offence data is separately protected and can include information about convictions, allegations, suspected offences, investigations and related proceedings concerning an offender or suspected offender.
We do not treat the existence of an investigation as permission to process this information automatically. Where special category data is necessary, we identify both an Article 6 lawful basis and an additional Article 9 condition. Depending on the circumstances, an additional condition may relate to legal claims, explicit consent, vital interests or an applicable substantial-public-interest condition.
Where criminal offence data is necessary, we identify an Article 6 lawful basis and, where we do not have official authority, a relevant condition under Schedule 1 of the Data Protection Act 2018. Where the legislation requires an appropriate policy document or additional records, those obligations must also be met.
Because these categories can create a higher privacy risk, we consider whether the information is genuinely necessary, whether a less intrusive route is available, who needs access, how it should be secured and how long it should be retained.
Information may be obtained from several sources, including:
We do not offer hacking, unlawful interception, unauthorised access to accounts or private systems, impersonation of police or public officials, or other unlawful methods of obtaining personal information.
A significant feature of professional investigation is that we may process personal information about a person who has not contacted us and is not our client. For example, a solicitor may instruct us to trace someone, a business may ask us to investigate suspected misconduct, or a private client may ask us to verify a relevant fact.
When personal information is obtained from someone other than the individual it concerns, the UK GDPR ordinarily requires organisations to provide privacy information within prescribed timeframes. However, the law also recognises circumstances in which this may not be required, including where providing the information is impossible, would involve disproportionate effort, would seriously impair the purpose for which the information is used, or where another statutory exemption applies.
We do not assume that an investigation automatically removes the duty to provide privacy information. We consider the position case by case, taking into account the nature of the instruction, the person's rights, the purpose of the processing, any risk of prejudice to a legitimate investigation, confidentiality, legal professional privilege and any applicable statutory exemption.
Where we rely on an exception or exemption, we may document the reason and apply other safeguards appropriate to the risk.
We may use personal information to:
Data-protection law requires a valid lawful basis for each purpose. The basis can differ according to the relationship, the information and the reason for using it.
| Purpose | Typical lawful basis | How this may apply |
|---|---|---|
| Responding to an enquiry or consultation request | Steps at your request before entering a contract; legitimate interests | We need enough information to understand the enquiry, communicate with you and decide whether we can help. |
| Providing services to an individual client | Contract; legitimate interests; legal obligation where applicable | We process information necessary to perform the agreed service and manage the professional relationship. |
| Work instructed by a company, solicitor or professional adviser | Legitimate interests; legal obligation; contract for the instructing organisation's contact information | We may need to process information about people who are not parties to our contract in order to answer a legitimate investigative or legal question. |
| Investigative research, tracing, verification and evidence gathering | Legitimate interests; legal obligation; establishment, exercise or defence of legal claims where relevant | The exact basis depends on the purpose, necessity, expectations and impact on the people concerned. |
| Special category data | Article 6 basis plus an Article 9 condition | The additional condition depends on the circumstances and may include legal claims or another condition available under UK law. |
| Criminal offence data | Article 6 basis plus official authority or an applicable DPA 2018 Schedule 1 condition | We identify the additional authorisation required before this information is processed. |
| Business records, invoicing and tax | Legal obligation; contract; legitimate interests | We may need to retain business and financial records to manage accounts and comply with legal duties. |
| Website security and abuse prevention | Legitimate interests | We have a legitimate interest in protecting our website, systems, users and communications from misuse or attack. |
| Website analytics | Consent where required; or an applicable statutory exception where its conditions are satisfied | Our Cookie Policy explains analytics and storage/access technologies in detail. |
Consent is not necessarily the most appropriate lawful basis for core investigative activity. Where we do rely on consent, it must be valid for the purpose and can be withdrawn, although withdrawal does not make earlier lawful processing unlawful.
Legitimate interests can be an appropriate lawful basis where there is a genuine and lawful interest in using information, the processing is necessary for that purpose, and the individual's interests, rights and freedoms do not override it.
Depending on the circumstances, the legitimate interests may belong to London Confidential, our client or another person. Examples may include establishing facts relevant to a legal dispute, preventing or investigating fraud or misconduct, locating a person for a legitimate legal or personal purpose, verifying material information before a significant decision, protecting property or business interests, or obtaining evidence relevant to a defined private or commercial concern.
Where legitimate interests is relied on for potentially intrusive processing, we consider the purpose, necessity and privacy impact. We may document a legitimate interests assessment or other balancing assessment where appropriate.
We do not use legitimate interests as a blanket justification for any activity a client asks us to perform.
An investigation begins with a defined question or objective. We aim to collect and use information that is relevant to answering that question rather than gathering information simply because it is available.
Depending on the instruction, this may involve comparing information from different sources, checking identity or address information, analysing corporate or professional connections, conducting lawful surveillance, reviewing public online material, tracing individuals, preserving evidential material or preparing a report.
We may create new personal information through our work, such as observations, analysis, chronologies, reports and professional conclusions. Where we make an inference about a person, we consider the evidence supporting it and distinguish between established fact, source material and professional assessment where appropriate.
Investigative information may be disclosed to the client or relevant professional adviser as part of the agreed service, but disclosure is limited by the purpose of the instruction, confidentiality, data-protection law, privilege, contractual terms and the rights of other people.
When you contact us through the website, email, telephone, WhatsApp or our consultation form, we may collect the information you provide so that we can respond, assess the matter and determine an appropriate next step.
Please provide only information that is reasonably necessary for the initial assessment. Do not send passwords, account-access credentials, unlawfully obtained material or excessive sensitive information through a general website enquiry.
Our website also generates limited technical information when it is accessed. Analytics and cookie-related information is described separately in our Cookie Policy.
We use third-party technology to operate parts of the website and business. Depending on how you interact with us, this can include:
These providers may process information as processors acting on our instructions, or in some cases as independent controllers for their own service operations. Their own privacy terms may also apply when you interact directly with their platforms.
We do not make information generally available. Where necessary and lawful, information may be shared with:
Before sharing sensitive investigative information, we consider what the recipient needs, the purpose of the disclosure and whether data can be limited, redacted, anonymised or otherwise protected.
We are sometimes instructed by solicitors or work in support of legal proceedings and disputes. Information in those matters may be subject to legal professional privilege, litigation privilege, confidentiality obligations or court-related restrictions.
Where privilege applies, the privilege normally belongs to the relevant client rather than to London Confidential. We will handle privileged or potentially privileged material in accordance with the circumstances of the instruction and the directions of the relevant legal professional where appropriate.
Data-protection rights continue to apply, but particular information may be exempt from disclosure where a statutory exemption applies, including in relation to legal professional privilege or the rights and freedoms of other people.
Some technology or service providers operate internationally. This means personal information may in some circumstances be transferred to, stored in or made accessible from a country outside the United Kingdom.
Where a transfer is a restricted transfer under UK data-protection law, we must ensure an appropriate transfer mechanism applies. Depending on the circumstances this may be UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, or a permitted exception. Where appropriate safeguards are used, a transfer risk assessment — referred to in legislation as the data protection test — may also be required.
The exact position depends on the provider, the recipient, the destination, the information and the legal arrangements in place at the relevant time.
Investigation work can involve information whose unauthorised disclosure could cause significant harm. We therefore apply technical and organisational measures appropriate to the nature and risk of the information we hold.
Depending on the system and information involved, those measures may include access controls, need-to-know restrictions, secure authentication, encryption or protected transfer methods where appropriate, secure devices, backups, confidentiality obligations, controlled sharing and procedures for responding to incidents.
No internet transmission or storage system can be guaranteed to be completely secure. If a personal-data breach occurs, we assess the nature of the breach, the information affected and the likely risk to people. We will notify the Information Commissioner's Office and affected individuals where the law requires us to do so.
We do not keep personal information simply because storage is available. We retain it only for as long as we can justify by reference to the purpose for which it is held.
There is no single retention period for every investigation. Factors we consider include:
Website analytics and cookie-related retention is explained in our Cookie Policy. Where a matter-specific retention period is appropriate, it may also be recorded in engagement documentation, internal retention rules or the relevant case file.
Investigation frequently involves disputed, incomplete or conflicting information. We therefore distinguish, where appropriate, between information supplied by a source, information verified through another source, direct observations and professional assessment.
We take reasonable steps to ensure that personal information used for a material purpose is sufficiently accurate for that purpose. Where information is uncertain, disputed or time-sensitive, the report may record that limitation rather than presenting it as established fact.
We also aim to minimise the information we collect. An investigation should not become an unrestricted search into a person's private life when a narrower and less intrusive route can answer the legitimate question.
Depending on the circumstances, you may have the following rights:
These rights are not absolute. Whether a particular right applies can depend on the lawful basis, the purpose, legal professional privilege, third-party rights, legal claims and statutory exemptions. If we cannot comply fully with a request, we will explain the position where the law permits us to do so.
Where we rely on legitimate interests, you have the right to object to the processing. We will consider your reasons and the circumstances carefully. We may continue processing only where the law allows us to do so, for example where compelling legitimate grounds override the interests, rights and freedoms concerned or where processing is needed for legal claims.
If personal information is used for direct marketing, the right to object is stronger: you can tell us to stop using your information for that purpose.
You can ask whether we hold personal information about you and, where the right applies, request access to it. This is commonly called a subject access request or SAR.
Because investigation files may contain highly sensitive information about more than one person, we may need to verify identity before disclosing information. We may also need to consider redactions, third-party confidentiality, legal privilege and statutory exemptions before providing a response.
If your request is complex or covers a large volume of information, we may contact you to clarify what information you are seeking where the law permits. We will not require you to explain why you want access simply to exercise the right.
To make a rights request, email info@londonconfidentialinvestigations.com with enough information for us to identify you and understand the request.
Our website and services are not marketed directly to children. However, some private, family, safeguarding or legal matters can involve information about children or young people.
Where information about a child is genuinely necessary for a lawful instruction, we take particular care with necessity, confidentiality, disclosure, retention and the child's rights and interests. We do not treat the fact that an adult client supplied information about a child as removing our responsibility to handle that information lawfully and proportionately.
This website does not make solely automated decisions about individuals that produce legal effects or similarly significant effects.
Technology may assist with administrative, research, search, organisation or analytical tasks. Where we use technology in connection with personal information, responsibility for the investigation and material professional conclusions remains subject to human judgement and the applicable legal framework. We do not treat an automated output as automatically accurate simply because a system produced it.
If we introduce a form of solely automated decision-making that triggers additional rights or transparency obligations, we will provide the information required by law.
Messages needed to respond to an enquiry, manage an instruction, provide an update, issue an invoice or deal with a service matter are service communications rather than direct marketing.
If we send direct marketing, we will do so only where permitted by applicable data-protection and electronic-communications law. Where consent is required, we will seek it. Where another route is lawfully available, we will still provide an appropriate way to opt out.
You can tell us at any time that you do not want to receive marketing by contacting info@londonconfidentialinvestigations.com.
If you believe we have not handled personal information properly, please contact us first so that we can investigate the concern.
Current UK data-protection law requires organisations to have a process for handling data-protection complaints. We will deal with a complaint through our privacy/contact channel, acknowledge it within the applicable legal timeframe and investigate the issues raised appropriately.
To complain to London Confidential: email info@londonconfidentialinvestigations.com, call 020 7099 9566 or write to Salisbury House, 29 Finsbury Circus, London EC2M 5SQ.
If you remain dissatisfied, you have the right to raise the matter with the Information Commissioner's Office (ICO), the UK's data-protection supervisory authority.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · Helpline: 0303 123 1113 · ICO data-protection complaints.
We may update this Privacy Policy when our services, technology, suppliers, legal obligations or regulatory guidance change. The date at the top of the page shows when it was last materially revised.
If we intend to use personal information for a materially different purpose and the law requires additional information to be provided first, we will take appropriate steps before beginning that use.
If you have a question about this policy, want to exercise a data-protection right or wish to raise a data-protection complaint, contact us:
We have used current primary regulatory and government material when preparing this policy. These references are provided for transparency and further reading: