OSINT is completely legal because it only uses information that is available through “open sources”. This means that it doesn't include information that is kept within your organisation's database, but rather just information available from public sources.