Key takeaways
- Agree what is restricted, who may access it and which details the client genuinely needs.
- Replacing a source name with a code does not guarantee that the person cannot be identified.
- An NDA, confidentiality label or involvement of a lawyer does not automatically make a report privileged.
What does HUMINT confidentiality actually cover?
The subject of a HUMINT enquiry may be sensitive before any interview takes place. A client could reveal an unannounced transaction, a disputed allegation or a planned management change simply by circulating an overly detailed brief. Source identities, interview records and draft assessments create additional exposure as the assignment develops.
Separate these information types in the engagement discussion. A source may allow their account to inform an assessment but have concerns about their name appearing in a client-wide report. A client may need an evidence summary without every identifying detail. Agree how the provider will handle such differences and what limits it can honestly communicate.
When choosing commercial HUMINT services, ask for an explanation of access, disclosure and report handling in the proposed assignment. A general statement that all work is confidential does not answer who will read a sensitive account or what happens if circumstances change. The HUMINT provider selection guide adds questions about team responsibilities.
How do confidentiality and data protection differ?
Confidentiality restricts disclosure or use in an agreed relationship. Data protection addresses the handling of personal information more broadly. A signed NDA does not by itself explain the lawful basis for processing details about a source, the subject or other people discussed during an enquiry.
The ICO’s lawful-basis guidance, updated in April 2026, requires a documented basis before personal information is used. The appropriate basis depends on the purpose and circumstances; additional conditions can apply to special category or criminal offence information. Treat those issues as questions to resolve for the actual assignment, not assumptions covered by the word intelligence.
Ask the provider to explain its role and the client’s role, applicable privacy information, escalation of unexpected sensitive material and restrictions on further use. If an exemption is proposed, it needs an applicable explanation. Do not assume that commercial confidentiality creates a general exemption from people’s rights.
Which protections should be specified?
A confidentiality schedule can turn broad assurances into reviewable commitments. The following is a practical discussion framework rather than a universal contract template. Each control should reflect the sensitivity of the information and the actual workflow.
| Information | Decision to record | Question for the provider |
|---|---|---|
| Client brief | Approved recipients and what partners may receive | Can the assignment be scoped without circulating all sensitive background? |
| Source identity | Who needs access and how attribution is handled | What could identify a person indirectly? |
| Interview records | Storage, access and use in the report | Who reviews raw material? |
| Client report | Distribution, versions and permitted onward use | What is suitable for a wider audience? |
| Working files | Retention review and secure disposal responsibilities | What remains after closeout, and why? |
Also identify the contact who can approve exceptions and the person to notify if a delivery or access error occurs. A control that no one owns is difficult to apply when an urgent commercial decision creates pressure to circulate the report.
Can a source remain anonymous in the client report?
A report can describe a source by a broad relevant role instead of a name, while explaining their basis of knowledge. However, combinations of details may still reveal a person: a unique job, a distinctive incident or a narrow employment period can be identifying to a reader familiar with the organisation.
The ICO explains that pseudonymised information remains personal data for someone holding the additional information that reconnects it to an individual. Source codes are therefore a control, not a blanket declaration of anonymity. Consider the recipient’s existing knowledge when reviewing a source description.
Fictional example: a report describes “the only regional project director who left after the May review”. Removing the name has not meaningfully reduced identifiability for colleagues. A more general description may reduce exposure, but may also limit how confidently the reader can assess the account. Explain that trade-off. The HUMINT sources guide considers relevant access and first-hand knowledge.
How should reports and working material be handled?
Ask for a proportionate explanation of the systems used to exchange briefs, store notes and deliver reports. Relevant questions include access permissions, recipient verification, partner access and incident escalation. Request enough detail to assess the proposal without asking the provider to disclose sensitive security configurations.
The ICO’s data security guidance expects technical and organisational measures appropriate to the risks of personal-information processing. For the buyer, the important point is the connection between the risks and the controls, rather than the presence of one fashionable security feature.
Set clear expectations for subcontractors, external review and any proposed use of translation or AI tools. Ask whether material will leave the agreed environment and who approves that change. A client should also control its own copies: forwarding a report, copying passages into a board pack or uploading it to another service changes the audience and handling context. Plan the report’s useful life rather than treating delivery as the end of responsibility.
What cannot be promised, and what should buyers check?
Do not accept automatic legal privilege as a sales claim. Confidentiality and legal professional privilege are different issues. The SRA’s in-house privilege guidance discusses confidentiality as a precondition, not as sufficient by itself; the page also carries a notice about ongoing review following a September 2026 decision. Seek matter-specific legal advice where privilege is important rather than relying on a report label.
- Agree approved recipients for the brief, raw material and final report.
- Record how direct and indirect source identification will be reviewed.
- Clarify subcontractor access and any external processing tools.
- Ask how mandatory disclosure requests and incidents are escalated.
- Agree a retention review and the purpose of any material kept.
- Obtain legal advice if court use or privilege affects commissioning.
Absolute anonymity and indefinite secrecy are not credible universal guarantees. A careful engagement explains practical protections and the circumstances in which disclosure may need legal consideration. Our HUMINT report guide explains how to preserve useful evidence context while keeping the audience and purpose clear.