Private Surveillance Standards in the UK: What Clients Should Expect

Private surveillance can provide valuable factual evidence, but the quality of an investigation depends on much more than whether an operative can discreetly follow a subject.

Professional surveillance should begin with a defined objective, be proportionate to the issue being investigated and take account of privacy and data-protection responsibilities.

For clients, that means choosing a provider that can explain not only what surveillance may achieve, but also where the boundaries lie.

The UK does not currently operate a general SIA licensing regime specifically for private investigators. However, that does not mean private surveillance operates without legal or professional standards. Investigators must still work within the wider legal framework governing privacy, personal information and the methods used during an assignment. The ICO has also approved a dedicated UK GDPR Code of Conduct for the private investigation and litigation-support sector.

For a broader explanation of surveillance methods and how investigations work, read our guide to private investigator surveillance.

Is Private Surveillance Regulated in the UK?

There is an important distinction between private investigation and other security activities regulated by the Security Industry Authority.

The SIA licenses activities such as close protection, security guarding and certain public-space CCTV work. General private investigation itself is not currently subject to a dedicated SIA licensing regime. GOV.UK guidance on the proposed regulation of private investigators confirms that such regulation has not been implemented.

That does not give investigators unrestricted freedom to conduct surveillance.

Depending on the circumstances, relevant considerations can include:

• UK data-protection law.
• Privacy rights.
• Harassment legislation.
• Property rights.
• The methods used to obtain information.
• The handling and retention of personal data.
• The purpose for which information is collected.
• Contractual and evidential considerations.

Professional standards therefore matter particularly in a sector where there is no single statutory licence covering every private investigative activity.

What Is the ABI UK GDPR Code of Conduct?

In October 2024, the Information Commissioner's Office approved the Association of British Investigators' UK GDPR Code of Conduct for Investigative and Litigation Support Services.

The ICO described it as the first sector-owned code approved under UK GDPR. It is designed to help participating investigators demonstrate compliance with specific areas of data-protection law.

The code addresses areas including:

• The roles of investigators as controllers, processors or joint controllers.
• Lawful bases for processing personal information.
• Legitimate interests assessments.
• Data Protection Impact Assessments.
• Covert surveillance.
• Tracking devices.
• Background checks.
• Social-media monitoring.
• Tracing and locating individuals.

The existence of the code is significant because many investigative techniques involve what the ICO describes as invisible processing: collecting or using personal information without the individual being directly aware of the processing at that moment.

Surveillance Should Have a Defined Purpose

A professional surveillance instruction should begin with a clear question.

Examples might include establishing whether:

• A person regularly attends a particular location.
• An employee is undertaking activity relevant to an investigation.
• A claimant is carrying out activities relevant to a civil dispute.
• An individual appears to be residing at a particular address.
• A person is meeting another identified individual.
• Activity relevant to litigation can be independently documented.

An instruction such as "find out everything you can about this person" is very different.

The wider and less defined an investigation becomes, the greater the risk of collecting unnecessary information unrelated to the client's legitimate objective.

A professional provider should therefore establish what the client actually needs to know before recommending surveillance.

Necessity and Proportionality Matter

An investigation should not automatically use the most intrusive technique available.

The appropriate question is whether the proposed surveillance is necessary for the objective and proportionate to the circumstances.

That may involve considering:

• The seriousness of the issue.
• Whether less intrusive enquiries could answer the question.
• The expected duration of surveillance.
• How much personal information is likely to be collected.
• Whether unrelated third parties may also be observed.
• The impact on the subject's privacy.
• How the resulting material will be used.

Proportionality does not mean that surveillance must always be minimal.

Some legitimate investigations require sustained observation over more than one day.

It does mean there should be a rational relationship between the issue being investigated and the level of surveillance proposed.

Private Investigators Do Not Have Police Powers

Private investigators do not gain special statutory powers simply because they have been instructed by a client.

They cannot assume the investigative powers available to the police, HMRC or other authorised public bodies.

This is particularly important when discussing the Regulation of Investigatory Powers Act 2000.

RIPA provides an authorisation framework for covert surveillance by specified public authorities. Government guidance describes it as governing covert techniques used by bodies such as police forces and government departments.

Private investigators should therefore not present RIPA as a licence or authorisation that allows them to conduct surveillance.

Their work instead needs to be considered against the wider laws and responsibilities relevant to private-sector investigation.

Working in Public Does Not Remove All Privacy Considerations

A common misconception is that anything visible from a public place can automatically be recorded without further consideration.

The position is more nuanced.

An investigator may legitimately observe activity from places where they are lawfully present, but prolonged or systematic observation can reveal substantial information about an individual's movements, relationships and behaviour.

The government's covert-surveillance code itself recognises that surveillance can involve monitoring a person's movements and activities and can result in the acquisition of private information.

For private investigators, the practical question should therefore be whether the observations being collected are relevant and proportionate to the purpose of the assignment.

What Should a Surveillance Provider Establish Before Accepting an Instruction?

A professional provider should obtain enough information to understand both the objective and the circumstances surrounding the request.

This can include:

• Who the client is.
• The client's relationship to the subject.
• Why surveillance is being requested.
• What information the client wants to establish.
• How the resulting information may be used.
• Relevant litigation or employment circumstances.
• Known risks or sensitivities.
• Whether other investigative methods have already been used.
• Any deadline affecting the operation.

This assessment can also identify instructions that should not be accepted.

For example, unexplained requests to monitor a former partner, colleague or other individual without an identifiable legitimate purpose should raise concerns.

Client Responsibility Also Matters

Professional standards do not apply only to the investigator.

Clients should also consider whether the surveillance they are commissioning is genuinely necessary and how they intend to use the resulting information.

A business instructing surveillance of an employee, for example, may have its own employment and data-protection responsibilities.

A solicitor commissioning work for litigation will need to consider the relevance and use of evidence within the proceedings.

A corporate client may need to ensure that appropriate internal authority exists before intrusive investigative measures are approved.

The fact that surveillance is outsourced does not mean the client can ignore the purpose or consequences of the instruction.

Employee Surveillance Requires Particular Care

Surveillance involving workers can be especially sensitive.

Employers may have legitimate reasons to investigate suspected fraud, theft, unauthorised secondary employment or other serious misconduct.

However, covert monitoring should not become routine employee management.

The scope should be linked to the specific issue being investigated and limited to what is reasonably necessary.

Where surveillance gathers information unrelated to the investigation, that material should not automatically be treated as relevant simply because it has been collected.

What Should a Professional Surveillance Report Look Like?

A useful surveillance report should provide a factual chronological record of the operation.

Depending on the assignment, it may contain:

• Dates and times.
• Locations.
• Observed movements.
• Relevant activities.
• Vehicle information.
• Photographs.
• Video footage.
• Relevant meetings.
• Periods when surveillance was lost.
• Operational limitations.

The report should make clear what the investigator actually observed.

It should avoid presenting speculation as fact.

For example, if a subject meets another unidentified individual, the report should not assign that person an identity without evidence supporting the conclusion.

Likewise, an investigator should not state that a person was undertaking a particular activity where the footage only supports a more limited observation.

Surveillance Evidence Should Not Be Overstated

Clients sometimes instruct surveillance because they hope to establish a particular fact.

The investigation may or may not produce evidence supporting that expectation.

A surveillance provider should never guarantee that an operation will prove:

• Infidelity.
• Fraud.
• Employee misconduct.
• Cohabitation.
• Dishonesty.
• Exaggeration of an injury.
• Breach of contract.

The role of surveillance is to document relevant activity during the period of observation.

A professional report should also explain limitations where necessary.

A subject may not leave a property during the surveillance period, an operative may lose sight of them, weather or environmental conditions may affect coverage, or the anticipated activity may simply not occur.

Those outcomes are part of legitimate investigative reporting.

Data Handling After Surveillance

Professional standards continue after the operational work has finished.

Surveillance may produce substantial amounts of personal information, including photographs, video footage, addresses, vehicle details and records of movements.

Investigators therefore need appropriate processes for:

• Secure storage.
• Access control.
• Data transfer.
• Retention.
• Deletion.
• Recording the basis on which information was obtained.
• Handling requests or legal obligations relating to the data.

The ICO-approved ABI code specifically addresses data-protection responsibilities within investigative and litigation-support services.

Clients should be comfortable that sensitive material will not simply be retained indefinitely or distributed without appropriate controls.

Questions to Ask Before Instructing a Surveillance Provider

Before commissioning surveillance, consider asking:

• How will you establish whether surveillance is appropriate?
• How do you assess proportionality?
• What information do you need from me before accepting the instruction?
• Who will conduct the operation?
• How will the evidence be recorded?
• How will photographs and video be stored?
• How will irrelevant personal information be handled?
• What will the final report contain?
• How are operational limitations explained?
• What happens if surveillance cannot achieve the requested objective?

Be cautious if a provider promises a guaranteed outcome before the operation has begun.

Professional surveillance is evidence-led. The investigator cannot know in advance exactly what a subject will do.

Warning Signs When Choosing a Surveillance Provider

Potential warning signs include a provider that:

• Guarantees a particular piece of evidence.
• Claims private investigators have police-style powers.
• Shows little interest in why the surveillance is being requested.
• Is willing to undertake unrestricted monitoring without discussing purpose.
• Makes categorical claims about legality without understanding the circumstances.
• Offers methods that appear unnecessarily intrusive.
• Cannot explain how personal information will be protected.
• Treats assumptions as established findings.
• Cannot explain how its reports are produced.

Low price alone should also not determine the choice of provider.

Poorly planned surveillance may produce little useful information while creating additional privacy, reputational or evidential problems for the client.

Professional Surveillance Services

Conflict International provides Surveillance Services for businesses, legal teams, insurers and private clients in the UK and internationally.

Assignments are scoped around a defined investigative objective and the circumstances of the case.

Our role is to conduct surveillance professionally, document relevant observations and report the findings and limitations clearly.

We do not promise a predetermined result or claim surveillance can remove every uncertainty surrounding an investigation.

Discuss Your Surveillance Requirements

If you are considering surveillance for a corporate, litigation, insurance or private matter, Conflict International can assess the circumstances and discuss whether surveillance is an appropriate and proportionate investigative option.

Complete the enquiry form below to discuss your surveillance requirements in confidence.