Can a company, council or landlord give me someone's address? Data protection, the legal proceedings exemption and how to ask

What the law allows

An address is personal data, so a company, council or landlord that holds one may disclose it only in line with UK GDPR and the Data Protection Act 2018. Normally that stops them handing it to you: they collected it for their own purposes, and the person was not told it might be passed on.

Paragraph 5 of Schedule 2 to the 2018 Act makes room for legal claims. It lifts some of the usual requirements, to the extent that they would prevent a disclosure, where:

• the organisation is required by law, or by an order of a court or tribunal, to disclose the data; or
• the disclosure is necessary for the purpose of, or in connection with, legal proceedings, including proceedings that are only in prospect, or for obtaining legal advice, or is otherwise necessary for establishing, exercising or defending legal rights.

The first is an obligation. The second is a choice. The Information Commissioner's guidance is that organisations should consider exemptions case by case, rely on them only where complying with the usual rules would actually prevent the disclosure, and record their reasons. In practice a request has to persuade someone, usually in a data protection or legal team, that disclosing to you is necessary and that they can justify it.

Who holds addresses, and how they usually respond

The pattern is clear: the organisations with the most reliable addresses are the least likely to disclose them, and the people most willing to help may hold an address that is out of date.

How to make a request that has a chance

Put it in writing, to the organisation's data protection officer or legal team if it has one, and make it easy to say yes. Include:

• who you are, and your connection with the person;
• the person's full name, any date of birth you know and the last address you had;
• the proceedings: a claim already issued, with its number, or the claim you intend to bring and why;
• why the address is necessary: what you need to send or serve, and any deadline;
• what you have already tried;
• that you will use the address only for those proceedings and will not share it;
• an alternative: that you would be content for them to forward a letter if they will not disclose.

Refer to paragraph 5(3) of Schedule 2 to the Data Protection Act 2018. A request from a solicitor on the firm's letterhead is more likely to succeed. Expect a refusal, or a request for a court order, and do not treat a refusal as unreasonable: the organisation carries the risk of getting the decision wrong.

What you cannot do

• Use a subject access request. The right of access is to your own personal data. It is not a way of obtaining someone else's.
• Pretend. Obtaining personal data from an organisation without its consent, for example by posing as the person or as someone entitled to the information, is a criminal offence under section 170 of the Data Protection Act 2018, and so is getting someone else to do it for you.
• Lean on staff. A receptionist or a former colleague who tells you an address without authority may be breaking their employer's rules and the law, and obtaining it that way can be an offence in itself.

When a court can order disclosure

Where an organisation will not disclose voluntarily, a court order changes the position, because the disclosure is then required. The routes depend on the case:

• In family proceedings the court can ask government departments for an address, as serving divorce papers without an address explains.
• Where a wrongdoer cannot be identified, the High Court can make a Norwich Pharmacal order against a third party mixed up in the wrongdoing.
• In existing civil proceedings, the court has limited powers to order someone who is not a party to disclose documents.
• Where service is the real problem, the court can permit another method of service under rule 6.15 of the Civil Procedure Rules, which can make the address unnecessary.

Each of these takes time and usually needs a solicitor. For most matters, a professional trace is quicker and cheaper.

How a professional trace differs

A tracing service does not ask anyone to break a confidence. Trace Bureau cross-references more than 150 sources, registers and records, a private investigator checks and verifies the result, and you receive a dated PDF report with the person's current registered UK address and a confidence rating: Confirmed, Probable or Possible. The purpose is recorded against every instruction, the person is not told who instructed the trace, and nothing is ever obtained by deception.

The minimum to start is the full legal name plus a date of birth or a previous address, and a lawful reason: money owed, legal proceedings, a former tenancy, an estate or a commercial dispute. Standard is £150, delivered within 3 to 5 working days; Priority is £200, delivered within 2 to 3 working days. There is nothing to pay when you instruct. Your card is only saved, and it is charged only when a private investigator has verified a current address. Not found, no fee.

If someone asks you for an address

The same rules apply the other way round. If you are a landlord, employer or business and someone asks for a former tenant's, employee's or customer's address, you are the one deciding whether paragraph 5 applies. Ask for the request in writing, check who is asking and why, consider whether forwarding a letter would do, record your decision, and refuse anything that looks like a personal search. If there is any suggestion that the person left to get away from someone, do not disclose.

When to instruct a professional trace

Instruct when a proper request has been refused or ignored, when you cannot wait for a court order, or when you would rather not explain your business with someone to their former employer or landlord. Instruct a trace online, or read whether address tracing is legal.