ABI UK GDPR Code of Conduct for Investigative & Litigation Support Services

The Association of British Investigators (ABI) has published an ICO-approved UK GDPR Code of Conduct for Investigative and Litigation Support Services. This important resource provides practical guidance for investigators, surveillance operatives, litigation support professionals, and organisations that commission investigative services.

The Code is designed to help organisations demonstrate compliance with UK data protection law when conducting investigations, surveillance, tracing, background checks, fraud enquiries, and other investigative activities. It focuses on key areas including:

• Understanding whether an investigator is acting as a Controller, Joint Controller, or Processor of personal data.

• Identifying the correct lawful basis for processing personal data.

• Managing special category and criminal offence data.

• Conducting Data Protection Impact Assessments (DPIAs), particularly where surveillance or other intrusive investigative methods are used.

• Ensuring transparency, accountability, and respect for individuals’ rights.

• Applying appropriate safeguards when carrying out covert or “invisible” processing activities.

 

Of particular relevance to surveillance practitioners, the Code highlights that surveillance activities are inherently high risk and will generally require a DPIA before processing begins.

It stresses that covert monitoring must be necessary, proportionate, justified, and supported by clear legal grounds.

​

For organisations procuring investigative services, the Code provides assurance that compliant service providers understand their data protection obligations and operate to recognised standards. Independent monitoring and compliance assessments form part of the framework, helping clients identify providers who can demonstrate good practice and accountability.

This resource is highly recommended for anyone conducting surveillance, investigations, tracing, litigation support work, or contracting private investigation and surveillance services, helping to ensure that investigative activity is undertaken lawfully, ethically, and in accordance with UK GDPR requirements.