NON-PUBLIC WHOIS DATA REQUEST PROCESS

Last updated October 28, 2026

1. Background

Under ICANN’s registration data policy for gTLDs and applicable domain registration requirements, MarkScout is required to provide reasonable access to non-public WHOIS information (“WHOIS data”) when we receive an adequate request based on a lawful basis, including but not limited to a legitimate interest stated by the requestor.

This policy does not apply to requests for WHOIS data made by the person to whom that information relates. It only applies where the person or organisation requesting the WHOIS data is a third party. Requests from data subjects exercising rights in their own data (e.g. right to rectification, right to erasure) should be made to your MarkScout account representative and/or [email protected].

2. Policy

We will provide the requestor with non-public WHOIS data only if all of the following conditions are met. If a request does not meet them, please see Section 4 below. Requests are reviewed by our Privacy Team, made up of MarkScout Legal, our Director of Policy and our designated Privacy Contact (together, the “Privacy Team”).

1. Requests must be sent via email to the address published in our WHOIS output ([email protected]). You can use the request form below to prepare the email.
2. The domain name in question must be a gTLD. ICANN’s rules, and our obligations under its registration data policy, only apply to gTLDs.
3. The requestor must state with specificity what WHOIS information is being requested and must state the lawful purpose for which it is being requested (see F below).
4. The requestor must identify themselves with at least a name. This can be a natural person’s name (e.g. Jane Smith) or an organization name (e.g. “Example Corp. brand protection department”). We will verify the requestor’s identity based on the requestor’s email address and any additional information in the request. The request should connect the identity of the requestor to the lawful basis for requesting the data (e.g. “Example Corp. is the legal owner of the EXAMPLE trademark”); see F below. If the requestor is an attorney, a service provider (e.g. a brand protection agency) or otherwise an agent of the entity with the lawful basis, the request should be accompanied by a Letter of Authority or representation confirming the requestor is authorized to act on behalf of that entity.
5. The WHOIS data must actually be redacted. We will not reply to a request where the full unredacted WHOIS is already published (i.e. non-EEA data or data relating to a legal person only).
6. The request must state a lawful basis for requesting the data, including but not limited to “legitimate interests.” Lawful bases include, among other stated purposes: (i) to name the registrant as a defendant in a complaint under the URS or UDRP, or as a defendant in intellectual property litigation; (ii) to notify the registrant of alleged trademark infringement, piracy, or counterfeit violation relating to the domain, or to correspond with the registrant in relation to such alleged infringement or violation; and (iii) to identify the registrant to take measures in relation to suspected fraud, phishing, or malware attacks. For requests based on “legitimate interests” under Article 6, Section 1(f) of the GDPR, the stated purpose must be weighed against the interests or fundamental rights and freedoms of the data subject, and these requests are reviewed by the Privacy Team before we respond.
7. The request must show that the data is necessary for the stated purpose.

3. How we respond

We aim to respond within five business days. When we provide non-public WHOIS data, our reply begins with the disclaimer below, followed by the non-public WHOIS data (“WHOIS Data”) for which the requestor has a lawful basis, and no more than is necessary for the stated purpose:

“MarkScout takes our clients’ privacy, and global privacy laws, very seriously. By processing the WHOIS Data we disclose to you, you understand and agree that you: do so as a separate (and not joint) data controller with respect to such WHOIS Data, and as a result are responsible for determining the lawful ground under the General Data Protection Regulation applicable to your processing of this data. You further agree to process and safeguard the WHOIS Data we supply to you in accordance with all applicable laws at all times.”

1. Unless the request includes a court order preventing us from disclosing it, we will forward the request to the registrant, copying their MarkScout account representative, with a notice along these lines: “Dear [client name], Pursuant to ICANN’s registration data policy for gTLDs, applicable domain registration requirements, your domain name registration agreement with us including our privacy policy, and our legal obligations under the European Union’s General Data Protection Regulation (“GDPR”), MarkScout is required to provide reasonable access to non-public WHOIS information when we receive adequate requests based on a lawful basis stated by the requestor. We have received such a request from [requestor’s name] pertaining to your [domain name], and must provide the requestor with the non-public WHOIS information, according to ICANN’s registration data policy, our legal obligations under the GDPR, and your domain name registration agreement with us. Please let us know if you have any questions.”
2. We log each instance where we provide non-public WHOIS data, including the request, our response and our decision-making rationale.

4. Insufficient requests

To ensure compliance with data privacy laws, MarkScout will not process requests for WHOIS Data that do not meet all the requirements in Section 2 above. If a request is missing one or more of them, we may reply with language similar to the below, and may give the requestor specific instructions to amend and correct the request, at MarkScout’s discretion:

“We are in receipt of your request. Unfortunately, your request has been preliminarily deemed insufficient as lacking one or more of the following MarkScout requirements for providing non-public WHOIS information under ICANN’s registration data policy: requests must be sent to the MarkScout email address established for this purpose, which is listed in MarkScout’s WHOIS output; the domain name in question must be a gTLD; the requestor must explicitly identify themselves (and if they act on behalf of another person, provide a Letter of Authority or representation confirming the requestor is authorized to act); the WHOIS output for the domain must not already be public (please check whether the WHOIS output for this domain is already publicly available); and the request must state a sufficient legal basis and a sufficient lawful purpose (e.g. a “legitimate interest”) for requesting the data, showing that the data is necessary for the stated purpose.”

Questions

Questions about this process can be sent to [email protected], or by post to MarkScout LLC, 50 California St., Suite 200, San Francisco, CA 94111, United States.