Why this matters.
Criminal record checks in England and Wales are run by the Disclosure and Barring Service under Part V of the Police Act 1997. Any employer can ask for a basic check (section 112), but standard and enhanced checks (sections 113A and 113B), and checks of the children’s and adults’ barred lists, are only allowed for roles that fall within the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 or the Safeguarding Vulnerable Groups Act 2006. Under the Rehabilitation of Offenders Act 1974, once a conviction is spent the person is normally treated as never having committed it, and section 4(3) makes it unlawful to refuse or dismiss someone because of a spent conviction for a role that is not exempt. Registered bodies must also follow the DBS Code of Practice issued under section 122 of the Police Act 1997, including having a policy on recruiting ex-offenders.
Criminal record information is also criminal offence data. Article 10 of the UK GDPR and section 10(5) of the Data Protection Act 2018 mean you can only process it where a Schedule 1 condition applies, usually employment obligations or safeguarding, and most of those conditions require an appropriate policy document. You should keep DBS certificate details only as long as you need them, and section 184 of the Data Protection Act 2018 makes it an offence to make someone obtain their own records through a subject access request as a condition of a job. Employers in regulated activity have a separate legal duty to refer to the DBS when they remove someone for harming, or risking harm to, children or vulnerable adults (section 35 of the 2006 Act). Asking for the wrong check, keeping certificates indefinitely or rejecting candidates for old spent offences can lead to ICO enforcement, discrimination or unfair dismissal claims and reputational damage.