Is tracing someone legal under UK GDPR?

The question deserves a precise answer, because both extremes circulate: that GDPR banned tracing (it did not) and that anyone can be traced for any reason (they cannot). The truth is a framework, and professional tracing is built to operate inside it.

The lawful basis

Article 6 of UK GDPR requires every processing of personal data to rest on a lawful basis, and for tracing without the subject's consent that basis is legitimate interests. It is applied through a three part assessment: a genuine interest is identified, recovering a debt, serving proceedings, distributing an estate, reuniting family; the tracing must be necessary to achieve it, meaning no less intrusive route works; and the interest must not be overridden by the subject's rights and freedoms, the balancing stage where risk to the individual is weighed. The Information Commissioner's Office guidance sets out the test, and professional agencies document it case by case.

The safeguards that make it lawful in practice

Instruction vetting comes first: identity verification of the client and a written statement of purpose, with refusal where the purpose is absent, flimsy, or carries any indicator of stalking, harassment or domestic abuse risk. Data minimisation shapes the work, only the information the purpose needs, and security, retention limits and confidentiality govern the result; disclosure of the traced address is itself controlled, with intermediary contact used in sensitive reunification cases so the found person chooses. The Association of British Investigators' code of conduct, approved by the ICO as a UK GDPR code, embeds these duties, and Tremark operates to it alongside ISO 27001 certified information security.

Where the line sits

Lawful: tracing a debtor for enforcement, a respondent for service, a beneficiary for probate, a lost relative who can choose whether to respond. Unlawful: tracing an ex partner who does not wish to be found, monitoring someone, or any blagged or deceptive data gathering, which can amount to a criminal offence under the Data Protection Act 2018. A legitimate purpose, honestly stated, is the entry ticket; everything else follows from it.