Is OSINT legal? Where public research ends and trouble begins

Is OSINT legal? In most countries, including India, collecting and analysing information that anyone can lawfully see is legal. The trouble starts in two places: when you get information you weren't allowed to reach, and when you use public information in a way the law forbids, such as stalking someone or reusing their personal data without a valid reason. This guide explains both lines, the Indian and European laws that draw them, and a checklist you can run before any piece of research. It's a plain-language explainer, not legal advice.

What "legal OSINT" actually means

OSINT, or open-source intelligence, means answering a question with information that is open to the public: news, official records, maps, websites and posts published in public. If the term is new to you, our beginner guide on what OSINT is covers the method step by step.

The word "open" is where the legal question begins. It describes how you got the information, not what you are allowed to do with it. So there are always two separate questions:

1. Access: did I get this information without breaking into anything, tricking anyone or ignoring a restriction?
2. Use: is what I'm doing with it allowed, for this kind of information, for this purpose?

A piece of research can pass the first test and fail the second. A photo on a public profile was reached lawfully, but collecting dozens of them to follow a person around is still harassment. Keep both questions in mind and most of the law becomes easier to understand.

Why "public" doesn't mean "free to use for anything"

Many beginners assume that if something shows up in a search, it's fair game. The law doesn't work that way, for three reasons.

• Personal data stays personal. A phone number on a public page still belongs to a person. Data protection laws in many countries keep applying to it.
• Context changes meaning. One public fact is harmless. Many public facts about one person, combined into a single file, can reveal where they live and when they're alone. That combination is what stalking and doxxing laws target.
• Mistakes are not invitations. A document uploaded to a public folder by accident is reachable, but the person never meant to publish it. Opening, saving or sharing it can cause real harm.

Line one: looking vs accessing

The clearest legal line in OSINT is between looking at what is published and getting into what isn't. In India, this line is drawn mainly by the Information Technology Act, 2000 (the IT Act), which you can read on India Code, the government's official database of laws.

• Section 43 covers accessing a computer, computer system or network without the permission of its owner or the person in charge. It makes the person who does it liable to pay compensation for the damage.
• Section 66 turns the acts listed in Section 43 into a criminal offence when they are done dishonestly or fraudulently, with up to three years in prison, a fine of up to ₹5 lakh, or both.

In practice, that rules out anything that gets past a barrier: guessing or reusing a password, logging in with someone else's account, using a login exposed in a data breach, changing a web address to reach pages that need a login, or exploiting a bug to see data that the site doesn't show the public. None of that is OSINT, whatever a tutorial calls it.

Looking, on the other hand, means reading what a website shows any visitor, searching with a search engine, viewing a public map or reading a public register. That's the ground OSINT stands on.

Website rules and scraping

Between those two sits a grey zone: website terms of service. Many sites forbid automated collection (scraping, meaning programs that copy pages in bulk) or creating fake accounts. Breaking terms of service is usually a contract matter rather than a crime, but it can get your account banned, and it can still matter in court. For beginners, the simple rule is: read pages by hand, don't create fake accounts and don't run scrapers on sites that forbid them.

Line two: what you do with personal data

The second line is about personal data, meaning any information about an identifiable person.

India: the Digital Personal Data Protection Act, 2023

India's Digital Personal Data Protection Act, 2023 (the DPDP Act) sets rules for anyone who processes personal data in digital form. Its rules were notified in November 2025, and most of the obligations come into force in phases over the following 18 months, as of November 2026.

The Act has an exclusion that matters for OSINT. Under Section 3(c)(ii), it doesn't apply to personal data that was made publicly available by the person it belongs to, or by someone who was legally required to publish it, such as a register that a law says must be public. Two warnings come with that:

• The exclusion covers what a person chose to publish about themselves, or what the law required to be published. It doesn't cover data that someone else exposed without their consent, such as a database exposed in a breach or a document shared by mistake.
• Falling outside the DPDP Act doesn't mean falling outside the law. Other laws, including the IT Act and criminal law, still apply to how you use the information.

Europe: the GDPR

If you research people in the European Union, or work for an organisation there, the General Data Protection Regulation (GDPR) applies. It is stricter on this point: it has no general exclusion for public data. Personal data stays personal data even when it's public, so an organisation that collects it needs a lawful basis, such as a legitimate interest, and usually has to tell people it holds their data. The UK's data protection regulator, the ICO, says in its guidance on the right to be informed that information being public doesn't take away a person's right to know how it's being used.

Stalking and harassment laws

The sharpest limit is criminal law. In India, Section 78 of the Bharatiya Nyaya Sanhita, 2023, which replaced the old IPC Section 354D, makes stalking an offence. It includes monitoring a woman's use of the internet, email or any other electronic communication. Watching someone's online activity can be a crime even though every post you looked at was public. Most countries have similar laws on stalking, harassment and publishing someone's personal details to target them (doxxing).

That's why OSINT on this blog stays away from people altogether: no searches by name, phone, email or face, no people-search sites, no working out where someone lives. Checking claims, organisations, places and your own data is where the legal and ethical ground is solid.

Ethical frameworks professionals follow

Laws set the minimum. Professional investigators also follow written standards. The best known is the Berkeley Protocol on Digital Open Source Investigations, published by the UC Berkeley Human Rights Center with the UN Human Rights Office and launched in 2020. It was written for investigations into human rights violations, but its core ideas apply to anyone:

• Lawfulness: know the laws of the places involved before you start.
• Minimise harm: collect only what you need, and think about who could be hurt if your findings are published.
• Accuracy and transparency: record your sources and method so others can check your work.
• Security: protect yourself, your notes and the people in your material.

A worked example: one question, two approaches

Imagine a message in your college group: a photo of a collapsed bridge, captioned "This happened on the highway near our campus this morning."

The legal approach. You save the image and run a reverse image search on Google. The earliest copy is in a news report from another state, two years ago. You open the news site, read the article as any visitor would, and check the date against an archived copy of the page. You reply in the group with the link. Every step was looking, the subject was an event rather than a person, and you kept only the links you needed.

Where it would go wrong. Now imagine you got curious about who forwarded the photo. You search their name, find their other accounts, note their workplace and screenshot their family photos to "expose" them as a fake-news spreader. None of the pages were private, but you've moved from checking a claim to building a file on a person. Depending on what you do with it, that can be harassment, and posting it could be doxxing. Same tools, very different legal position.

The difference wasn't the technique. It was the target and the purpose.

A practical checklist before you start

Run through these questions before any piece of research. If any answer is "no" or "I'm not sure", stop and rethink.

If a search ever shows you personal data exposed by mistake, such as ID cards or marksheets in a public folder, don't open, download or share it. Tell the site's owner, or report it to CERT-In, India's national cyber security agency. The tools on our OSINT tools page are built for the safe side of this table: checking files, photos and pages, not people.

Common mistakes

• "It was public, so it's fine." Public access answers only the first question. The use still has to be lawful.
• Treating a leak as a source. Data from a breach or a misconfigured server was never published on purpose. Don't use it, even if others already are.
• Following a tutorial blindly. Some "OSINT" guides online teach techniques that cross into unauthorised access or people tracking. The name doesn't make them legal.
• Forgetting other countries. If your research involves people or servers abroad, their laws may apply too.
• Publishing everything you found. Your report should include what answers the question, not every detail you came across.

A practice exercise

Take three research ideas and sort them using the checklist above. For example:

1. "When was this viral flood photo first published?"
2. "Is this online shop registered as a company, and how old is its website?"
3. "Where does the person who posted this video live?"

For each one, write down which checklist questions it passes and which it fails. You should find that the first two pass every question, because they're about a photo and a business, while the third fails at the very first one. Turning a question about a person into a question about a claim ("Is this video real, and where was it filmed?") is the habit that keeps OSINT legal.

Frequently asked questions

Is OSINT legal in India?

Collecting and analysing information that anyone can lawfully see is generally legal in India. It becomes illegal when you access systems or accounts without permission, which the IT Act covers, or when you use information to stalk, harass or harm someone, which criminal law covers. This article is general information, not legal advice.

Is using Google search operators illegal?

No. Operators such as site: or filetype: only refine what a search engine already shows the public. What matters is what you do with the results: personal data that appears by mistake should be left alone and reported, not opened or shared.

Can I get in trouble for researching a company?

Checking a company through public registers, its own website and news reports is normal due diligence. Stay away from employees' private lives, don't use fake accounts to get internal information and be careful about publishing accusations you can't prove, since defamation laws apply.

Do I need permission to save screenshots of public pages?

Saving a screenshot of a public page for your own notes is a normal part of research. Publishing it is a different matter: copyright and privacy can apply, especially if it shows other people's personal details. Crop or blur anything that isn't needed to support your finding.