Public-source reputational due diligence starts with information that can lawfully be accessed, but the assessment does not consist simply of collecting search results, news reports or social-media material. The work has to answer a defined question. That means establishing the scope, identifying what is genuinely attributable to the person or organisation concerned, examining the evidence behind what has been found, considering context and chronology, and limiting the assessment to what is relevant and proportionate to the decision it is intended to inform.
Publicly accessible does not mean unrestricted
Public-source research begins with material that is genuinely available to the public or otherwise legitimately accessible for the commission concerned.
For Integri, that does not include bypassing access controls, obtaining login credentials, using false identities or pretexting, accessing private or restricted accounts, or using technical measures intended to defeat privacy settings.
The fact that personal information can be found online also does not put it outside data-protection law. Current ICO guidance expressly addresses personal data obtained from publicly accessible sources and continues to require transparency unless an applicable exception or exemption applies.
The existence of information and the right to use it for a particular purpose are therefore separate questions.
Integri's service-specific position on the collection and processing of personal data, including special-category and criminal-offence information where relevant, is set out in its Privacy Notice.
Start with the decision, then define the scope
A due-diligence assessment should not begin with the instruction to find everything that can be found.
It begins with the decision or engagement that the work is intended to inform.
The agreed scope identifies what is being assessed, why the assessment is being carried out, the relevant person, organisation, role or engagement, the assessment period and the categories of material that are relevant to the question being asked.
That matters because relevance is not an abstract quality. Information that may be material to one appointment or engagement may have little or no significance to another.
The ICO's data-minimisation principle requires personal data to be adequate for the stated purpose, relevant to that purpose and limited to what is necessary. Its guidance also makes the underlying point explicit: an organisation must first be clear about why it needs information before it can decide how much information is appropriate.
A search without a defined purpose can accumulate information; a scoped assessment asks what information is actually relevant to a defined decision.
Discovery is not evidence
Search engines, archives, databases and other discovery tools can identify potentially relevant material.
They do not determine what that material establishes.
A search-result snippet may omit important qualifications. An automated summary may simplify or misstate the underlying source. A secondary article may repeat another report without adding independent evidence. A social-media result may concern a namesake. A historic report may have been overtaken by later events.
For that reason, Integri distinguishes between discovery and evidence.
Search and discovery tools may identify leads; reportable findings rest on citable, reviewable evidence.
The underlying material has to be examined. Where a proposition depends on a source, that source needs to support the proposition attributed to it.
This page explains the principles behind that process. It does not publish Integri's controlled research protocols, search procedures, internal evidential thresholds or quality-assurance rules.
Attribution comes before assessment
Before information can be assessed, there must be a sufficient basis for concluding that it concerns the person or organisation being assessed.
A matching name is not enough.
Names may be shared by many people. Photographs may be mislabelled. Social-media accounts may be unofficial, satirical, impersonating or simply unrelated. Biographical fragments may point in different directions.
Attribution therefore depends on the surrounding evidence: identifiers, chronology, roles, locations, organisations, relationships and other contextual information capable of distinguishing the subject from someone else.
This principle is already explicit in Integri's Public Profile Readiness service:
A name match alone is not enough.
If attribution cannot be established sufficiently, uncertainty should not be converted into a finding.
Corroboration and source quality
Not all public sources answer the same question or carry the same evidential weight.
An original public record may establish that a particular filing was made. An official decision may establish the outcome of a regulatory process. A contemporaneous statement may establish what a person said at the time. A newspaper article may report an allegation or event, but the evidential significance of that report depends on what it is based upon and what happened afterwards.
Source quality therefore involves more than counting how many search results repeat a claim.
Questions include whether the underlying source can be identified, whether apparently separate reports rely on the same originating material, whether important information is missing, whether the source is current and whether it actually supports the proposition for which it is being cited.
UK government guidance on its own engagement due-diligence processes makes similar distinctions. It tells departments to consider the appropriateness, reliability, gaps and limitations of information sources; to use up-to-date information; to keep checks relevant; and to consider exculpatory material as well as adverse material. That guidance governs a different public-sector process and is not an Integri standard, but it illustrates the broader importance of evidential discipline in open-source due diligence.
Integri does not publish a simplistic rule that a source becomes reliable merely because it is official, or that every proposition must appear in a fixed number of independent sources. The question is what the available evidence actually establishes.
Facts, allegations, opinions and unresolved matters
Public material frequently contains statements with different evidential status.
A source may establish a fact. It may report an allegation. It may contain an opinion. It may record that a dispute exists without establishing which account is correct.
Those distinctions matter.
A reliable report that an allegation was made can establish that the allegation existed. It does not, without further evidence, automatically establish that the underlying allegation was true.
The same applies to opinion. The ICO's accuracy guidance distinguishes opinion from fact and says records should make clear when something is an opinion and, where appropriate, whose opinion it is. It also emphasises the importance of keeping the source and status of personal data clear.
Where the available evidence does not justify a definitive conclusion, the proper result may be to record uncertainty or an unresolved matter rather than force the material into an adverse finding.
Due diligence is weakened, not strengthened, when uncertainty is concealed.
Context and chronology can change what evidence means
A source can be accurate about what happened at one point in time while becoming misleading if presented without what happened next.
An allegation may later have been withdrawn. Proceedings may have ended without the outcome originally anticipated. A statement may have been corrected. A decision may have been overturned. An organisation may have changed ownership or leadership. Further evidence may materially alter the significance of the original information.
The chronology therefore matters.
The ICO's accuracy guidance recognises this distinction. A historical record does not become inaccurate simply because circumstances later change, but the record must remain clear about what is historic and should not misrepresent the person's current position. It similarly gives examples where later outcomes need to be retained alongside the earlier event so that the record is not misleading.
A reputational assessment should therefore examine material in context rather than treating the first adverse result found as the end of the enquiry.
Proportionality: enough to answer the question, no more
More information is not automatically better due diligence.
The appropriate extent of an assessment depends on the legitimate purpose for which it is being conducted and the decision or engagement it is intended to inform.
That means considering whether a line of research is relevant, whether its potential significance justifies further examination, whether the information being sought is necessary to answer the agreed question and whether the overall scope remains proportionate.
The ICO's data-minimisation guidance reflects the same underlying discipline: organisations should collect enough personal information to fulfil their purpose, but no more than they need. It specifically warns against obtaining irrelevant material merely on the possibility that it might prove useful later.
UK government engagement guidance likewise describes due-diligence checks in terms of necessity, proportionality, context and relevance rather than unlimited investigation.
More information is not automatically better due diligence; the work should be sufficient and proportionate to the question being answered.
This is one reason Integri does not describe reputational due diligence as an exhaustive search of a person's complete digital history.
An assessment is made as at a stated date
Public information changes.
New material appears. Existing material is removed or corrected. Proceedings conclude. Roles change. Organisations dissolve, merge or reorganise. Statements that were current when published become historical.
A reputational assessment therefore needs an assessment date.
That date tells the reader when the evidence was examined and provides the boundary for what the report can properly claim.
Integri reports are point-in-time assessments. Across its three reputational due-diligence routes, a report should not be relied upon for a decision or engagement taken more than 90 days after issue without further assessment.
That 90-day period is Integri's own reliance rule. It is not presented as a statutory requirement or as a universal industry standard.
Technology can assist discovery; judgement remains human
Research tools can make public-source work faster and more systematic.
They can help locate sources, identify possible connections, surface older material and point a researcher towards matters that warrant examination.
But a search result is not a conclusion, and an automated output does not determine whether something is materially relevant to a particular appointment or engagement.
The underlying evidence still has to be examined in context.
Questions of attribution, corroboration, chronology, relevance, proportionality and significance require judgement. Integri therefore treats discovery technology as an aid to research rather than as a substitute for the assessment itself.
Every issued Integri assessment is reviewed and authorised by Integri before release. In Public Profile Readiness, substantive assessment and the overall conclusion are expressly human judgements.
How these principles apply across Integri's three routes
The same high-level disciplines apply across Integri's reputational due-diligence work, but the purpose and commissioning relationship differ.
Verify
Verify is commissioned by an organisation before an appointment or selection decision. It examines publicly accessible material within a scope agreed at commissioning and a stated assessment period.
Pre-Engagement Due Diligence
Pre-Engagement Due Diligence is commissioned by an organisation considering a genuine prospective engagement with a counterparty. It works from publicly or legitimately accessible information and, where agreed, relevant client-supplied material. That client-supplied material is a starting point for assessment rather than established fact merely because the client provided it.
Public Profile Readiness
Public Profile Readiness is commissioned by an individual in respect of themselves. It examines publicly accessible and reasonably discoverable material within the recorded scope so that the client can understand what may warrant preparation before entering greater professional or public scrutiny.
The routes therefore do not produce identical reports or answer identical questions. What they share is the requirement that an assessment be bounded, evidence-based, attributable, contextual and proportionate to its purpose.
For the distinction between reputational due diligence and background checks, social-media screening and adverse-media screening, see Reputational Due Diligence vs Background Checks, Social Media Screening and Adverse Media Checks.
Sources and further reading
- Information Commissioner's Office — Data minimisation
Guidance on ensuring personal information is adequate, relevant and limited to what is necessary for its purpose. The ICO currently marks this guidance as under review following changes made by the Data (Use and Access) Act. - Information Commissioner's Office — Accuracy
Guidance on source and status, factual accuracy, opinion, historical records and the need to avoid misleading records. The ICO's wider data-protection-principles guidance is currently marked as under review following the Data (Use and Access) Act. - Information Commissioner's Office — Right to be informed
Includes specific guidance for personal data obtained from publicly accessible sources and the circumstances in which privacy information remains required. The ICO currently marks this guidance as under review following the Data (Use and Access) Act. - UK Government — Guidance on how to apply the UK government's engagement standards
Public-sector guidance addressing scope, source reliability, source limitations, recency, relevance, proportionality and exculpatory material in its own due-diligence context.