When Peter Humphrey was convicted of illegally obtaining the personal information of Chinese citizens, it ended a case that was closely watched for clues about doing due diligence in China.

Humphrey, a Briton who co-owned a risk advisory firm in China with his wife, was arrested in 2013 in Shanghai. His detention shocked multinationals and financial groups – and their lawyers and private investigators – who had to ask themselves if China was tightening its vague rules on private investigations.

As foreign companies have intensified their focus on China, they have relied on corporate risk firms such as Kroll and Control Risks and smaller boutique firms such as Humphrey’s ChinaWhys, to conduct due diligence before advising on Chinese initial public offerings or investing in China.

Humphrey’s arrest sparked concern because for months the Shanghai police provided no explanation.

Velisarios Kattoulas, chief executive of Poseidon Research, a corporate risk consultancy firm, said risk consultancies with a big presence in China were pulling punches in client reports because they felt “very vulnerable”. Many due diligence firms changed their practices after the Humphrey case to avoid being caught buying government records that might be considered illegal to obtain.

“This happened quickly. A lot of people spent time with shredders,” Mr Kattoulas said.

A head lawyer at one private equity group said his firm had frequently obtained police files from risk firms before the Humphrey case. It has since stopped accepting such information, which sometimes includes a hukou – a household registration document that helps identify people.

Several people said the Humphrey case had not had a huge impact on the way large firms operate. One person with extensive China experience said US companies had long been more cautious because of concerns about breaching the Foreign Corrupt Practices Act, which outlaws bribing government officials.

But the person said some boutique firms that carried out China investigations for US firms were still taking risky steps because they wanted to “please their clients”.

When Humphrey was detained, companies were worried about the implications for risk analysis. But several people said investigators and lawyers became less concerned when it appeared that his case was related to an investigation into GlaxoSmithKline, which had hired him to investigate a whistleblower who sparked a government probe into the UK pharmaceutical company.

One senior western investigator with significant China experience said part of the problem was that the offence Humphrey was convicted of occupies a grey zone in China, where a number of privacy and security laws contain a clause that essentially says “what we think is sensitive is sensitive”.

“Private investigators cannot touch political areas,” said one Chinese investigator. “They need to use careful judgment when they find themselves in the grey area between commerce and politics.”

They need to use careful judgment when they find themselves in the grey area between commerce and politics - Chinese investigator

While Humphrey’s case cast a spotlight on the due diligence industry in China, many experts said it had already become more difficult to conduct certain kinds of investigations.

Steve Vickers, a corporate risk expert, said China started to tighten rules on obtaining information after reports by Muddy Waters – a research firm, attached to a short seller – which raised questions about several Chinese companies, including Sino Forest.

While China tightened its privacy laws in 2009, bringing it more in line with data protection practices in other countries, three years later investigators and researchers were still able to obtain copies of people’s identity cards by paying lawyers who could access records at the State Administration of Industry and Commerce.

But after Bloomberg and The New York Times ran stories about the wealth of the families of Chinese leaders that relied on SAIC filings in 2012, China clamped down. In 2012, it also jailed four employees of a Chinese subsidiary of Dun & Bradsheet for illegally obtaining personal information.

While several factors have combined with the Humphrey case to make due diligence a tougher business, the investigator with extensive China experience said there were other problems in the industry. For example, some banks allow bankers to communicate with outside risk advisers without input from internal compliance and legal teams. He said some bankers working on deals steered away from tough due diligence to help complete deals and receive higher performance bonuses.

The investigator said another problem was that some due diligence firms used “expert networks” – large numbers of people across various industries whose knowledge can be tapped for a fee. But he said there was a danger that the buyer of the information would have no idea where it originated, raising the chances that companies might be inadvertently obtaining inside information.

“The level of due diligence [in China] is a really mixed bag. I would still say ‘investor beware,’” he said.