# Legal and ethical basics

Source: https://otinstaller.com/guides/osintverse-community/osint-fundamentals/03-legal-and-ethics (page 4 of 5 of osintverse-community/osint-fundamentals)

Public does not mean free to use for anything. The rules depend on where you are, where the person is, and why you
are looking, so treat this page as a checklist of questions, not answers.

## Purpose and lawful basis

Have a reason you could explain to the person's face. Journalism, an employer's fraud investigation, due diligence,
a security assessment you were hired for and research each have their own rules and exemptions. If you are not sure
yours applies, ask before you collect.

## Personal data

Information about an identifiable person is personal data in most jurisdictions (the GDPR in the EU and the UK, and
privacy laws in many other places). In practice:

- **Collect only what answers your question.** A full profile "just in case" is the thing to avoid.
- **Keep it secure and for as long as the case needs**, then delete it.
- **Take extra care** with health, religion, politics, sexuality, children and anyone who may be at risk if found.

## The services you use

- Use the access any member of the public has. No fake accounts to see more, no logins you are not entitled to, no
  getting round paywalls or access controls.
- Read a service's terms before you automate requests against it, and respect rate limits.

## Where to stop

- Never use what you find to contact, harass, stalk, threaten or expose anyone.
- Stop when the next step would need more than public information, or when the person's safety could suffer from
  what you publish.
- The registry's [acceptable use policy](https://otinstaller.com/policy/acceptable-use) applies to every tool and
  guide in it.

Next: https://otinstaller.com/guides/osintverse-community/osint-fundamentals/04-record-and-report.md