Must the person under investigation be notified? The duty to inform, professional confidentiality and private investigation
It is a question that compliance departments ask us more and more often: if the GDPR requires informing people that their data is being processed, how can a private investigator investigate someone without telling them?
The answer requires separating two levels.
The first is professional: private investigation can be carried out discreetly because, if the person under investigation knew in advance that they were being observed, the very purpose of the service could be frustrated.
The second is a data-protection level: the duty to inform exists, but its application must be examined within the GDPR, national legislation, and the specific framework of Law 5/2014. There is no universal, unlimited exemption for private investigators, but neither can the GDPR be turned into an obligation to warn the person under investigation in advance of every action, when the very legitimate nature of the processing requires confidentiality.
Discretion is not a trick
An investigation serves to find out how a person behaves when they do not know they are being observed.
If an investigator had to announce their presence before a surveillance operation, an activity check, or an operation using a cover identity, the investigation would lose much of its usefulness.
Case law naturally accepts that an investigator may act incognito and conceal their professional status when necessary to verify facts within a legitimate assignment.
STS 1194/2024, of 24 September, is a recent example of an operation using a cover identity that was not held unlawful for that reason alone.
Confidentiality during the gathering of evidence does not mean absolute opacity. It means that discretion is subject to purpose, proportionality, documentation, and subsequent oversight.
The GDPR does not turn every investigation into a prior warning
When data is not obtained directly from the data subject, Article 14 of the GDPR establishes duties to inform, and it also provides for exceptions and modulations in certain cases.
A private investigation requires a case-by-case analysis of what the legal basis for the processing is, what information is obtained, whether informing at that moment would genuinely frustrate the legitimate purpose, and what alternative safeguards exist.
That is why it is preferable to speak of information that may be limited, deferred, or omitted when the legal requirements are met, rather than of a supposed automatic exemption for every investigation.
Earlier Spanish administrative doctrine on private investigators already recognised that informing the person under investigation during an inquiry could make the purpose of the service impossible to achieve. Under the GDPR, that logic must now be integrated into a more complete balancing of legal basis, necessity, proportionality, and the data subject's rights.
Legitimate interest and minimisation
Confidentiality can only be defended when it is backed by a legally legitimate investigation.
The client must demonstrate their legitimate interest. The object of the investigation must be well defined. The investigator must process only the information necessary for that purpose. And the report, in accordance with Article 49.2 of Law 5/2014, must exclude anything that bears no direct relation to the assignment.
The question, therefore, is not only "can we investigate without warning?" It is also "what are we investigating, why, and how much do we need to know?"
The more narrowly defined the service, the more defensible the confidentiality.
Professional secrecy: the other half of the system
Law 5/2014 imposes on private investigators a particularly intense duty of professional confidentiality.
The investigator has access to information about the client, the person under investigation, and, often, third parties incidentally captured during the service.
That information does not become public simply because it was lawfully obtained.
The report and its data must remain within the circle of legally entitled recipients. The investigator is also subject to duties of cooperation with judges, courts, and law-enforcement bodies when appropriate.
The logic is very clear: discretion during the investigation is offset by confidentiality after the investigation.
An investigator's report does not always have an exclusively judicial purpose
A clarification is worth making.
Many reports end up in judicial proceedings, and that is one of the most important outcomes of our activity.
But not every private investigation necessarily has to end up in court.
It can serve to make a business decision, negotiate a dispute, verify compliance with a contract, rule out a suspicion, or establish that there are no grounds to sue.
What the law requires is that the use of the information remain connected to the legitimate purpose of the assignment and within the permitted recipients.
Compliance and the investigator: not opposite worlds
I would also avoid a common oversimplification: that compliance "must always warn" while an investigator "may always stay silent."
An internal investigation can, in certain cases and with the necessary safeguards, carry out confidential actions. And an investigator's inquiry remains subject to the GDPR and the Private Security Act.
The important difference lies in the professional framework.
An investigator is a third party legally authorised to obtain and provide information and evidence about private facts on behalf of an entitled client. Their activity is designed precisely to investigate, discreetly, facts that would otherwise be difficult to prove.
The compliance department, by contrast, operates within the organisation and must coordinate employment rights, internal policies, the whistleblowing channel, data protection, document preservation, and the safeguards of the corporate procedure.
They are not substitutes for each other.
They are complementary tools.
Internal investigation and preservation of evidence
In certain incidents, the company needs to preserve emails, logs, files, or devices before they are lost.
In others, it needs to observe conduct that continues to occur outside the corporate systems.
Internal investigation is especially strong with respect to information that legitimately belongs to the company.
An investigator is especially strong at documenting external facts, observable conduct, relationships, and activity carried out outside those systems.
When both lines are legally coordinated, the result can be much more complete.
Why confidentiality also protects the person under investigation
It may seem paradoxical, but a discreet, narrowly scoped investigation can be more respectful than a massive corporate investigation.
A professional investigator must limit themselves to the object of the assignment.
They do not need to access all of a person's emails, review years of communications, or reconstruct their entire life.
They can observe specific conduct for a few days and end the service once the matter is resolved.
Proportionality does not depend on whether the investigation is secret or known.
It depends on its intensity, necessity, and purpose.
Conclusion: confidentiality does not eliminate the law
An investigator can investigate discreetly because the very usefulness of their role often depends on the person under investigation not altering their behaviour.
But that discretion does not create a rule-free zone.
There is legitimate interest.
There is data protection.
There is minimisation.
There is proportionality.
There is professional secrecy.
There is administrative and judicial oversight.
Private investigation works precisely because it combines two elements that seem opposed:
operational confidentiality and legal accountability.
A good investigator stays silent for as long as they need to investigate.
And afterwards answers for everything they did.
Truth has a method.