Investigation guidance · European Union

EU Investigation Licensing and GDPR Compliance Across Borders

When an investigation involves more than one country, check who may do the work in each location and how personal data will be handled. National authorization and GDPR compliance are separate questions. A licence from the provider’s home country does not answer both, and neither does identifying a lawful basis for processing.

This guide provides general information, not legal advice or certification of a provider’s compliance. Check national requirements and the obligations for your particular assignment before work begins.

A national licence does not cover the whole EU

An investigator’s authorization at home may not cover the work you need in another EU country. Requirements vary with the activity, provider and location. Before commissioning an assignment, list where each task will take place and check the relevant licensing, qualification, registration or notification rules with the national authority.

Private security services fall outside the EU Services Directive. You still need to check how the particular investigative activity is classified and whether professional qualification or temporary service rules apply. A short assignment abroad does not automatically avoid the host country’s requirements.

In the Czech Republic, Služby soukromých detektivů (Private Detective Services) is a concessionary trade. That Czech concession does not establish permission to work elsewhere. Ask who will provide the service and verify the authorization for the proposed work.

Check the method, not only the provider

Ask how the investigator intends to carry out each task. A licence brings neither police powers nor an exemption from privacy restrictions. Observation, recording, record access, workplace enquiries and evidence handling may be subject to different local rules. Set out permitted methods and prohibited activities before fieldwork, along with the points at which local legal advice is needed.

Where several providers are involved, make clear who does each task and who supervises it. An agreement between coordinators cannot resolve uncertainty about a local provider’s authority or make a questionable method lawful.

GDPR: establish a lawful basis for each purpose

An investigation by a private business is not automatically exempt from GDPR. Processing personal data requires an applicable lawful basis under Article 6. If the proposed basis is legitimate interests, identify the interest, assess whether the processing is necessary and balance it against the individual’s rights and interests. Describing the work as an investigation is not enough.

Article 5 also governs how the information is handled. Its principles cover lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality. The parties need to be able to show what they did to meet those requirements, rather than simply describe the work as compliant.

A public source can still contain personal data. An online profile or register entry is not permission to collect and retain everything available about someone. Keep the collection relevant to the assignment and avoid unnecessary details about people who are not involved.

Sensitive information needs additional assessment

Health information and data about a person’s sex life or sexual orientation are among the special categories covered by Article 9. An Article 6 basis alone will not suffice; an applicable Article 9 condition is also needed. Suspected wrongdoing does not create a general exception.

Article 10 deals separately with criminal convictions and offences. Its requirements must be met, including authorization under EU or Member State law where applicable. A client cannot supply that authorization merely by requesting the information.

When people must be informed

Articles 13 and 14 set out what people must be told when their data come directly from them or from another source. An exception or lawful restriction may apply in a particular case, but covert investigations have no blanket exemption. Record the precise provision being relied on, why its conditions are met and which safeguards are required.

Plan for requests from people exercising their GDPR rights. Do not assure a client that the subject will never be informed or can never exercise those rights. Ask qualified counsel about any exception or restriction that depends on the circumstances of the case.

Who is responsible for the data?

Start with who actually decides why and how the data are processed. That determines controller, joint controller and processor roles, not the label chosen in an engagement letter. A processor agreement must include the required Article 28 terms where that article applies. Joint controller arrangements need a separate assessment under Article 26.

Article 32 requires technical and organizational security appropriate to the risk. Agree access controls, secure sharing and storage, incident handling and retention. Specify who can receive the report, how long the raw material is needed and when it will be deleted or retained for a justified purpose.

Under Article 35, processing likely to result in high risk requires a data protection impact assessment before it starts. Review the methods, scale, sensitivity and people affected, as well as relevant supervisory authority requirements. Not every enquiry needs a DPIA, but a small assignment is not automatically exempt.

Sharing within and outside the EEA

The GDPR framework covers the European Economic Area: the EU, Iceland, Liechtenstein and Norway. Sharing data between EEA organizations is not a Chapter V transfer to a third country just because it crosses a national border. Lawful processing, security and clear responsibilities are still required.

For a transfer outside the EEA, check Chapter V. An applicable adequacy decision or appropriate safeguards may offer a route. Derogations have specific conditions and should not be the routine solution. Where safeguards are used, assess whether they are effective and whether supplementary measures are needed.

Follow the information, not just the provider’s office address. Identify recipients, storage locations, onward disclosures and remote access. An EEA office does not prove that all processing takes place within the EEA.

Compliant Background Checks: Screening Across Countries

Before ordering an international background check, decide what question the check needs to answer. A relevant scope and lawful basis come before the search. Assess the proposed checks against the role or transaction, the countries involved and local rules. A package used in one country may be unsuitable in another.

Some records may be easy to obtain without being necessary for the decision. Identity, qualifications, employment history and directorships may be relevant, but access and processing must still be lawful. Public registers and social media profiles are not exempt from GDPR because anyone can view them.

Record an Article 6 basis for each screening purpose. A signed consent form is not a universal answer: consent must be freely given, specific, informed and unambiguous. The relationship between an employer and an applicant or employee can make genuinely free consent difficult. Legitimate interests need a necessity and balancing assessment too.

Criminal record checks need their own Article 10 and national law assessment. Special category data require an applicable Article 9 condition as well as an Article 6 basis. A broad online search should not incidentally collect unnecessary health information, political opinions or other sensitive material.

The appropriate Article 13 or 14 information process should explain the purposes, data categories, recipients, retention approach and rights. If an exception or lawful restriction is relied on, check its particular conditions. Do not assume that every background check can take place without notice.

Check that a record belongs to the right person. Keep the source and date, and distinguish verified facts from allegations, old entries and unresolved identity matches. There should be a way to review disputed or inaccurate information before it affects a decision. Article 22 needs assessment where a decision is based solely on automated processing and has legal or similarly significant effects. Any human involvement must be meaningful, not nominal.

Agree the client’s and provider’s actual controller or processor roles, who can receive the findings and which subcontractors are involved. Use security appropriate to the risk throughout collection, storage and delivery. Set a justified retention period for each purpose and arrange deletion or review when the information is no longer needed. GDPR does not set a single retention period for all background checks.

Find out where the data will be stored and who can access them, including overseas recipients and people working remotely. Sharing within the EEA still needs lawful processing and safeguards. Transfers outside it require a Chapter V assessment of the applicable mechanism and any necessary supplementary measures. A local office does not establish that all processing stays within the EEA.

Put the permitted sources, excluded data, local restrictions, correction process, report recipients and retention arrangements in writing before commissioning the checks. These are safeguards to assess for the assignment. This guide does not certify any provider or screening package as compliant.

Compliance does not guarantee admissibility

A court decides whether and how to consider material. Licensing, lawful processing and careful evidence handling do not settle that question. Keep the sources, collection context and an accurate account of the methods, without promising a result in litigation.

If the findings are intended for proceedings, involve counsel who knows the law where the material is collected and where it may be used. Agree what the evidence needs to establish before collection. A report written afterwards cannot remedy an unlawful method.

Before commissioning work abroad

List the countries, tasks and providers involved.
Check each provider’s national authorization and any conditions for working abroad.
Agree permitted methods, limits and when to seek local legal advice.
Record why data will be processed, the lawful bases and any Article 9 or 10 conditions.
Plan how to inform people and handle rights requests. Check any applicable exceptions.
Agree controller or processor roles, security, recipients and retention.
Decide whether the processing is likely to be high risk and needs an impact assessment.
Map sharing and access within and outside the EEA, including transfer safeguards.
Discuss reporting requirements with counsel without promising that evidence will be admitted.

Official sources

Related guidance

Discuss an international assignment