Tracing Agents and the Data (Use and Access) Act

Tracing Agents and the Data (Use and Access) Act

Before a defendant can be served or a judgment enforced, someone has to be found. That is the work of a tracing agent, and the ground under it shifted in 2026 as the Data (Use and Access) Act 2025 came fully into force. The headline change, a new lawful basis, turns out to be narrower than many assume, and understanding where the line falls keeps a trace usable.

June 2025 to February 2026: the Act arrives

The Data (Use and Access) Act 2025 received Royal Assent in June 2025. Most of its data protection changes were switched on from 5 February 2026, amending the UK GDPR, the Data Protection Act 2018 and the privacy rules that sit alongside them. For anyone who locates people, one question mattered above the rest: does this make finding a debtor, defendant or witness easier or harder to justify? The Act was billed as a growth measure, so expectations of a looser regime for locating individuals were understandable, if misplaced.

March 2026: a new lawful basis, tightly drawn

On 23 March 2026 the Information Commissioner’s Office published guidance on the recognised legitimate interest basis created by the Act. Unlike ordinary legitimate interests, it needs no balancing assessment, which is the feature that drew attention. It is reserved, though, for five listed situations: responding to a request from a body exercising public functions, safeguarding national or public security, dealing with an emergency, preventing or detecting or investigating crime, and protecting children or vulnerable adults. Routine civil recovery work does not fall within any of them, so the assessment free shortcut is not available to a private trace instructed for litigation.

June 2026: what a tracing agent may still do

The Act commenced on 19 June 2026, a milestone the ICO marked by confirming more guidance would follow through the summer. For a trace carried out to serve proceedings or enforce a judgment, the lawful basis remains ordinary legitimate interests under Article 6(1)(f). In practice a tracing agent must document a three part assessment: a legitimate purpose such as service or enforcement, a trace that is genuinely necessary to achieve it, and a balance that respects the rights and reasonable expectations of the individual being located. None of that has been swept away, and the ICO now holds stronger enforcement powers, including higher fines, behind it.

 

The data a tracing agent relies on

Lawful tracing draws on sources such as the edited and full electoral registers, credit reference data and other public records, cross checked so that an address rests on more than one live source rather than a single stale entry. The recognised legitimate interest basis has opened up no new datasets for recovery work, and it removes neither the duty to be transparent about processing nor the individual’s right to object. The boundary is clear once you read the five categories together: the assessment free route is built for crime prevention and public protection, not for commercial debt recovery or ordinary civil claims.

Instructing a trace that survives scrutiny

For solicitors the practical point is record keeping. Ask what lawful basis the trace relies on and to see the assessment sitting behind it, because a result you cannot explain is a result you may not be able to use. A trace with a clear audit trail is one you can put before a court or an enforcement officer without a second argument breaking out about how the address was obtained.

If you need a current address to serve or enforce, fill in the form below and the Tremark people tracing team will discuss the work on a documented and defensible footing.

Frequently Asked Questions

What lawful basis does a tracing agent use for litigation work?

Ordinarily legitimate interests under Article 6(1)(f), backed by a documented balancing assessment. The new recognised legitimate interest basis is limited to matters such as crime prevention and public safety, so it does not apply to a routine civil trace.

Did the Data (Use and Access) Act make tracing easier?

Not for civil recovery. The new basis is narrow, so locating a debtor or defendant still relies on legitimate interests and the assessment that goes with it, much as it did before the Act.

What should I ask before instructing a tracing agent?

Ask which lawful basis they rely on, how they record the assessment, and how many independent sources confirm the address. That audit trail is what makes the result usable in proceedings.