Due 31 OctUKPaper Self Assessment Return Deadline NewUSSales Tax Economic Nexus Check for Online Sellers See deadlines ›
Due 31 OctPaper Self Assessment Return Deadline NewSelf-Employed National Insurance Check (Class 2 & 4) See deadlines ›
Due 2 NovForm 941 Quarterly Payroll Tax Return Due (Q3) NewSales Tax Economic Nexus Check for Online Sellers See deadlines ›
Due 31 OctEU One Stop Shop (OSS) VAT Return — July to September NewEuropean Accessibility Act (EAA) Compliance Check See deadlines ›
Due 31 OctIndividual Tax Return Lodgement Deadline (Self-Lodgers) NewDirector ID & ASIC Company Obligations Check (AU) See deadlines ›

Data & Privacy United Kingdom For businesses

DBS & Criminal Record Checks Compliance Check

DBS check compliance for UK employers: the right check level, spent convictions, criminal offence data under UK GDPR, retention and barred list duties.

Start free check 12 questions · 7 minutes · No signup
Trending now

Did you know? The numbers behind this check.

  • Basic, standard, enhanced (+ barred lists)Check levels
  • Any roleBasic check eligibility
  • UK GDPR Art 10 + DPA 2018 Sch 1Lawful basis needed
  • DPA 2018 s.184Enforced SAR offence

Why this matters.

Criminal record checks in England and Wales are run by the Disclosure and Barring Service under Part V of the Police Act 1997. Any employer can ask for a basic check (section 112), but standard and enhanced checks (sections 113A and 113B), and checks of the children’s and adults’ barred lists, are only allowed for roles that fall within the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 or the Safeguarding Vulnerable Groups Act 2006. Under the Rehabilitation of Offenders Act 1974, once a conviction is spent the person is normally treated as never having committed it, and section 4(3) makes it unlawful to refuse or dismiss someone because of a spent conviction for a role that is not exempt. Registered bodies must also follow the DBS Code of Practice issued under section 122 of the Police Act 1997, including having a policy on recruiting ex-offenders.

Criminal record information is also criminal offence data. Article 10 of the UK GDPR and section 10(5) of the Data Protection Act 2018 mean you can only process it where a Schedule 1 condition applies, usually employment obligations or safeguarding, and most of those conditions require an appropriate policy document. You should keep DBS certificate details only as long as you need them, and section 184 of the Data Protection Act 2018 makes it an offence to make someone obtain their own records through a subject access request as a condition of a job. Employers in regulated activity have a separate legal duty to refer to the DBS when they remove someone for harming, or risking harm to, children or vulnerable adults (section 35 of the 2006 Act). Asking for the wrong check, keeping certificates indefinitely or rejecting candidates for old spent offences can lead to ICO enforcement, discrimination or unfair dismissal claims and reputational damage.

Have these to hand.

  • A list of roles you currently run criminal record checks for, and at what level
  • Your recruitment policy and any policy on recruiting ex-offenders
  • Where and how long you store DBS certificate details
  • Whether you use an umbrella body or are a DBS registered body yourself

What you’ll get.

  • 1A score out of 100Where you stand today, at a glance.
  • 2Findings ranked by riskWhat could cost you, highest risk first.
  • 3A plan with timeframesWhat to fix first and by when.

Use this free DBS check compliance tool to see whether you are asking for the right level of criminal record check, handling spent convictions lawfully and storing the results correctly.

More in Data & Privacy. Checks people run next.

General guidance only, not legal advice. Consult a qualified solicitor or adviser in your jurisdiction for specific issues.