Covert Surveillance: Do's and Don'ts for Private Surveillance Investigations

✅ DO

Do have a legitimate reason

Only carry out covert surveillance where there is a clear, lawful, and justifiable purpose, such as investigating suspected fraud, gathering evidence for legal proceedings, or protecting legitimate business interests.

Do complete a DPIA

Assess the privacy risks before surveillance begins. Consider whether the activity is necessary, proportionate, and legally justified.

Do consider less intrusive alternatives

Ask whether the objective could be achieved through interviews, open-source research, document reviews, or other investigative methods before resorting to covert surveillance.

Do identify a lawful basis

Ensure there is a valid UK GDPR lawful basis for processing personal data, and document your reasoning.

Do keep surveillance proportionate

Only collect information that is relevant to the investigation. Limit the duration, scope, and intensity of monitoring.

Do protect the information you collect

Store recordings, photographs, notes, and reports securely and restrict access to authorised personnel only.

Do maintain accurate records

Keep clear records of your instructions, risk assessments, surveillance activity, and decision-making process.

Do review the necessity of surveillance regularly

If circumstances change, reassess whether continued surveillance remains justified.

Do understand your role

Be clear whether you are acting as a Controller, Joint Controller, or Processor of personal data.

Do stop if the surveillance becomes unjustified

If the original reason for surveillance no longer exists, stop collecting information.

❌ DON'T

Don't conduct surveillance "just in case"

Covert surveillance should never be used as a fishing expedition or speculative exercise.

Don't ignore privacy rights

Individuals still have rights under UK GDPR, even when they are the subject of an investigation.

Don't collect excessive information

Gather only the information necessary for the investigation. Avoid collecting irrelevant personal data.

Don't use tracking devices or covert monitoring without strong justification

These are highly intrusive activities and require careful assessment and robust justification.

Don't monitor private spaces

Avoid surveillance in locations where people have a strong expectation of privacy, unless there is a clear legal basis and compelling justification.

Don't keep information longer than necessary

Delete or securely dispose of surveillance material when it is no longer required for the purpose for which it was collected.

Don't share information unnecessarily

Only disclose surveillance findings to those with a legitimate need to know.

Don't assume public information is free to use

Personal data obtained from social media, websites, or public records is still subject to data protection law.

Don't ignore special category or criminal offence data

Extra legal requirements apply when surveillance captures sensitive information or evidence of alleged criminal activity.

Don't proceed if the risks outweigh the benefits

If a DPIA identifies significant privacy risks that cannot be adequately mitigated, surveillance should not proceed.

Golden Rule

If you cannot clearly explain why the surveillance is necessary, proportionate, lawful, and fair, you probably should not be doing it.