Is address tracing legal in the UK?

The law that applies

Tracing a person's address means processing their personal data. UK GDPR and the Data Protection Act 2018 require a lawful basis for that processing (Article 6), fairness and transparency, data minimisation, security and limited retention. There is no licence for tracing in the UK; there is a duty to do it properly.

Our lawful basis

For most instructions the basis is legitimate interests (Article 6(1)(f)): recovering a debt, pursuing or defending legal claims, serving documents, administering an estate, resolving a tenancy or commercial dispute. We carry out and record a legitimate interests assessment for every instruction: what the purpose is, why tracing is necessary, and why the person's rights do not override it. Where the purpose is personal, such as reconnecting with a relative, we rely on the consent of the person being traced and never disclose an address without it.

What we refuse

• Anything that looks like stalking, harassment, or locating a person who has taken steps to avoid the instructing party without a legal purpose.
• Finding anyone who has a non-molestation order, restraining order, injunction or bail condition in place against the instructing party, or who has said they do not want contact.
• Personal reasons of any kind, other than consent-based reconnection, where we pass on a message and disclose nothing without the person's agreement.
• Instructions where the instructing party will not identify themselves or verify their identity, or is acting for someone they will not name.
• Purposes we cannot record a lawful basis for. The full list is in our terms.

What the instructing party signs up to

Every instruction carries a recorded declaration: who they are, that the reason given is true and their only reason, that they have a lawful basis, that the result stays confidential and is used for that purpose alone, and that they understand a false declaration may be a criminal offence. We keep that declaration with the date, time and network address it was made from, and we hand it to the police or the Information Commissioner if it proves false. Obtaining personal data by deception is an offence under section 170 of the Data Protection Act 2018; using an address to harass someone is an offence under the Protection from Harassment Act 1997. For a landlord, a creditor, an executor or a solicitor with a genuine reason, the declaration is a ten-second step.

What the person being traced can expect

We collect only what is needed to confirm an address, from public and licensed sources. We do not contact them, except in consent-based reconnection cases where contact is the point. Data is deleted after 12 months. They can ask us what we hold about them.

Registration and accountability

Trace Bureau is operated by a limited company registered in England and Wales and registered with the Information Commissioner's Office. The registered name, company number and ICO registration number are on the company details page. Complaints go to [email protected] first and to the ICO if we cannot resolve them.