> Lawful basis, purpose limitation, minimisation, special categories and audit trails: how to apply the GDPR to an OSINT investigation. Blog · [Ethics and law](https://pandorasearch.com/blog/topic/ethics-legal/) # OSINT and the GDPR: investigating within the law 30 October 2026 · 6 min read "It's public" is a common justification in OSINT, and a misleading one. The General Data Protection Regulation (GDPR) applies to personal data whether or not it is available online. Being able to see something does not mean you can collect it, combine it and keep it for any purpose. This article walks through the GDPR principles that weigh most on an open-source investigation and how to apply them in practice. It is written from an EU and Spanish perspective; in the UK, the UK GDPR and the Data Protection Act 2018 rest on the same principles, and the regulator is the Information Commissioner's Office (ICO). > **Note:** this article is general information, not legal advice. Every case depends on who is investigating, for what purpose and in which country. Talk to a lawyer or your data protection officer. ## Public data is still personal data Under the GDPR, personal data is any information relating to an identified or identifiable person. A handle, a photo, an email address or a company directorship all qualify if they lead to a specific individual. And processing is not just publishing: collecting, consulting, combining, storing and deleting all count. In OSINT this matters for one reason: cross-referencing public sources creates new information, a profile that did not exist anywhere before. Each data point may be harmless on its own; put together, they may not be. The GDPR's household exemption covers purely personal activities. A professional investigation, whether commissioned or carried out inside a company, is not covered. ## A lawful basis for every processing activity Article 6 of the GDPR lists six lawful bases. In OSINT, three come up most often: - **Legitimate interests.** This is the most common basis in the private sector, and the GDPR's recitals give fraud prevention and network security as examples. It requires a three-part test: the interest must be legitimate, the processing must be necessary to achieve it, and the rights of the person being investigated must not override it, taking into account what they can reasonably expect. That balancing exercise should be written down. - **Legal obligation.** For example, the due diligence that anti-money laundering law imposes on obliged entities; in Spain, Ley 10/2010. - **Public task or official authority**, in the case of public bodies. Consent rarely fits an investigation. Journalism has its own regime: Article 85 of the GDPR requires member states to reconcile data protection with freedom of expression and information. ## Purpose limitation Data must be collected for specified, explicit and legitimate purposes and not reused for incompatible ones. In practice: - Define the purpose before you start, and write it down. "Verify the identity of a supplier's director before signing" is a purpose; "look into John Smith" is not. - If the investigation drifts towards something else, stop and assess whether the new purpose is covered. - Do not reuse what you found in one case for a different one. Pandora asks for the purpose before an investigation starts and stores it in the audit log alongside every query. ## Data minimisation Data must be adequate, relevant and limited to what is necessary. This is the principle that clashes most with OSINT habits, which lean towards collecting everything "just in case". - Choose the sources that answer your question, not every source available. - Discard what is not useful: namesakes, third parties caught up incidentally, irrelevant details. - Set a retention period and delete the data when the case is closed. Third parties deserve particular attention. Relatives, colleagues and friends often turn up in an investigation, and being in the graph does not mean you should keep pulling on their thread. ## Accuracy Data must be accurate. In OSINT, the main risk is less a wrong data point than a wrong attribution: merging two different people because of a shared handle or a common name. Corroborate with independent sources, record the confidence level of each conclusion and correct it when new information appears. ## Special categories and criminal offence data Article 9 prohibits, with limited exceptions, processing data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data used to identify a person, health data and data concerning a person's sex life or sexual orientation. Article 10 further restricts processing data about criminal convictions and offences. In OSINT, the risk usually comes from inference: an account on a dating site, a health forum or a religious community reveals a special category even if nobody wrote it down. That is why Pandora leaves out adult, dating, health, religious and political sites, does not use facial recognition, and never queries infostealer log search engines. ## Transparency and rights When data is not collected from the person themselves, Article 14 generally requires you to inform them. There are exceptions, such as where informing them is impossible, would involve disproportionate effort or would seriously impair the purpose of the processing, but they have to be assessed and documented, and accompanied by measures to protect the person's rights. The person being investigated also keeps their rights of access, rectification, erasure and objection. To honour them, you need to know what data you hold, and on whom. ## Data protection impact assessments Article 35 requires an impact assessment when processing is likely to result in a high risk, and supervisory authorities publish lists of processing that requires one. The list from Spain's data protection authority, the Agencia Española de Protección de Datos (AEPD), includes, among others, processing that combines or links datasets collected for different purposes or by different controllers, processing that observes or monitors people systematically, and processing of special categories. As a general rule, meeting two or more criteria calls for an assessment. A professional OSINT practice focused on people can fall squarely within that. ## Audit trails and accountability The GDPR does not just ask you to comply; it asks you to be able to demonstrate it. For an investigation, that means being able to say what was queried, when, by whom, for what purpose and with what result. In Pandora, every case carries its purpose, every query is written to the audit log (timestamp, case, purpose, transform, entity and number of results), and every data point keeps the transform and source that produced it. The case can be exported for your records. Add the usual security measures on top: restricted access, encryption and deletion at the end of the retention period. ## The Spanish regulator's perspective The AEPD is Spain's supervisory authority. It handles complaints, investigates and imposes fines, which under the GDPR can reach €20 million or 4% of worldwide annual turnover, whichever is higher. For the AEPD, as for other European authorities, the starting point is the GDPR, supplemented in Spain by Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD). Two points from that framework are useful for investigators: - **Presumptions are narrow.** The LOPDGDD presumes a legitimate interest in processing the professional contact details of people who work for a company, but only to maintain relations with that company. It is not a licence to investigate its employees. - **Documentation matters.** The AEPD has published guidance on risk management and impact assessments, as well as its list of processing that requires one. Following that material and keeping a record of your decisions is how you show compliance if a complaint arrives. ## Checklist before you start - The purpose is written down and specific. - You know which lawful basis applies and, if it is legitimate interests, you have done the balancing test. - Your sources are limited to the question. - You are not processing special categories or secrets such as passwords. - There is a retention period. - You know who has access to the data. - You can respond to an access or erasure request. - The audit trail is switched on. ## Final note This article is general information and is not legal advice. Laws and their interpretation change, and every case has its nuances. If in doubt, consult a qualified lawyer or your data protection officer. ## Frequently asked questions **Can I use personal data because it is public?** Not automatically. The GDPR also applies to data available online: you need a legitimate purpose and a lawful basis, and you must limit yourself to what is necessary. **Which lawful basis applies to an OSINT investigation?** In the private sector it is usually legitimate interests, which means weighing your interest against the person's rights and documenting it. In some cases there is a legal obligation, such as anti-money laundering due diligence. **Do I need a data protection impact assessment?** If you investigate people systematically, combine sources of different origin or handle sensitive data, probably yes. Supervisory authorities' lists, such as the AEPD's, help you decide: as a rule, meeting two or more criteria means you need one. **What should be recorded during an investigation?** The purpose, who queried what and when, the source of each data point, the conclusions with their confidence level, and the retention period. **Is this article legal advice?** No. It is general information. For a specific case, talk to a lawyer or your data protection officer. **Investigate with Pandora: a declared purpose, an audit trail and traceable sources.** Every new account gets 3 trial searches, with no card. [See plans and pricing](https://pandorasearch.com/pricing/) Tags: GDPR data protection ethics compliance OSINT ## Keep reading - [How to investigate an email address with OSINT](https://pandorasearch.com/blog/how-to-investigate-an-email-address-with-osint/): What open sources reveal about an email address: provider and MX, Gravatar, registered services, breach exposure, and how to corroborate it. - [Who runs a company: BORME, Companies House and OpenCorporates](https://pandorasearch.com/blog/who-runs-a-company-borme-companies-house/): How to find out who runs a company in Spain and the UK using BORME, Companies House and OpenCorporates, without mixing up namesakes. - [Checking breach exposure without touching passwords](https://pandorasearch.com/blog/check-breach-exposure-without-touching-passwords/): Using Have I Been Pwned, XposedOrNot and LeakCheck to measure an email's breach exposure, and why handling leaked passwords crosses a line. [All articles on Ethics and law](https://pandorasearch.com/blog/topic/ethics-legal/) --- Page: https://pandorasearch.com/blog/osint-and-gdpr-investigating-within-the-law/