PRIVACY NOTICE
Last updated: 22 October 2026
1. Who we are
This notice explains how The Association of British Investigators Limited (“the ABI”, “we”, “us”), a company limited by guarantee registered in England and Wales (company number 998568), collects and uses personal information. The ABI is the controller of that information. Our registration number with the Information Commission’s Office (ICO) is Z5636882.
Our administration, including all data protection activity, is carried out on our behalf by ABI Secretariat Ltd, which acts as our processor.
Contact details: ABI Secretariat, The Brentano Suite, Unit 720, Catalyst House, Centennial Park, Centennial Avenue, Elstree, Hertfordshire WD6 3SY. Telephone 020 8191 7500. Email Secretariat@theABI.org.uk.
2. Who this notice covers
• applicants for membership, members and former members;
• referees nominated by applicants;
• complainants and others involved in complaints, including complaints about investigators who are not ABI members;
• members of the public, solicitors, insurers and other organisations who contact us or look for an investigator through us;
• delegates and speakers at ABI events and training, and recipients of our newsletter;
• members of the Governing Council and its committees.
Applicants and members should also read the ABI Notice to Members & Applicants for Membership – Processing your Personal Data & Criminal Offence Data (Consent) and the ABI Criminal Offence Data – Policy Statement, available from the Secretariat.
3. What we collect, why, and our lawful basis:
4. Criminal offence data
As part of vetting, applicants produce a Basic Disclosure certificate no older than 12 months, and members produce a new certificate every three years. The certificate is inspected by no more than three individuals at ABI Secretariat Ltd. Only the date, reference number and outcome of the inspection are recorded, and the certificate is then securely destroyed. Any adverse entry is referred to the Membership Selection Chairman and, where necessary, the Membership Selection Committee and, on appeal, the Governing Council.
We rely on your consent, given separately in writing, to process criminal offence data. You may withdraw consent at any time. Because vetting is a condition of membership, withdrawal means that membership cannot be granted or continued. Full details are in the ABI Criminal Offence Data – Policy Statement.
5. Special category data
We do not seek special category data (for example, health information). If it is provided to us, for example in a complaint or an event registration, we process it only with your explicit consent (Art. 9(2)(a)) or where necessary for legal claims (Art. 9(2)(f)), and only to the extent needed.
6. Where we get personal information from
• You directly
• Referees you nominate
• Publicly available sources, including internet searches and public registers (such as the ICO register of fee payers)
• Commercial database providers, which may include credit reference agencies
• Regulatory authorities, legal bodies and professionals (such as courts and solicitors)
• Insurers, previous employers and other suppliers and service providers
• Complainants and other parties to a complaint
7. Use of artificial intelligence (AI)
ABI Secretariat Ltd uses AI tools, currently Claude provided by Anthropic, to help with administrative tasks such as drafting correspondence and documents and organising records. Only the minimum personal data needed is used, and it is anonymised or pseudonymised wherever practicable. Criminal offence data and special category data are never entered into AI tools. All decisions are made by people. No significant decision about you is taken based solely on automated processing (Articles 22A to 22D UK GDPR). You may object to the use of AI tools in connection with your personal data by contacting the Secretariat.
8. Who we share information with
• ABI Secretariat Ltd, our processor, for all administration;
• our service providers, including cloud storage, accounting, email, workflow, payment, event booking and publishing platforms (currently PCloud, Dropbox, Xero, Mailchimp, Smartsheet, PayPal, Eventbrite and issuu), our website host and AI tools;
• the Membership Selection Chairman, the Membership Selection Committee and the Governing Council, where necessary for vetting, appeals, upgrades and discipline;
• the public, through the online directory and register, if you have chosen to be included;
• solicitors, insurers, financial institutions and others seeking to instruct an investigator, where you have opted in to assignment referrals;
• regulators, law enforcement and fraud prevention bodies, where we are required or permitted by law;
• our professional advisers, insurers and external auditors;
• referees and previous employers, when verifying an application.
We do not sell personal information.
9. Transfers outside the UK
Some of our service providers process data outside the UK. Where they do, the transfer is protected by UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum. Where an applicant nominates a referee outside the UK, we transfer the necessary details to that referee under an exception in Article 49 UK GDPR, as the transfer is necessary to take steps the applicant has asked for before admission to membership.
10. How long we keep information?
At the end of the retention period, information is securely deleted or destroyed, unless there is a lawful basis for keeping it longer, which we will record.
11. Keeping your information secure
Personal information is held almost entirely in electronic form, on access-controlled platforms with secure backups. Access is limited to those who need it. Paper records are kept to a minimum and stored securely.
12. Your data protection rights
You have the right to:
• access your personal information;
• have inaccurate information corrected;
• have your information erased;
• restrict how we use it;
• object to processing based on our legitimate interests, including AI-assisted administration;
• receive your information in a portable format, where processing is based on consent or contract;
• withdraw your consent at any time, where we rely on consent.
Not every right applies in every case. We will respond without undue delay and within one month. To make a request, use the contact details in section 1. There is normally no charge.
13. Cookies
Our website uses cookies. See our cookie policy for details and to manage your preferences.
14. How to complain
You have the right to complain to us about how we use your personal information (section 164A Data Protection Act 2018). Please send your complaint to the Secretariat using the details in section 1. We will acknowledge it, look into it and tell you the outcome without undue delay.
You also have the right to complain to the Information Commission’s Office (ICO) under section 165 Data Protection Act 2018: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk/make-a-complaint. The ICO will usually expect you to have raised the matter with us first.
15. Changes to this notice
We review this notice regularly and will publish any changes on this page.
