Pre-employment background checks for UK employers
UK law requires very few background checks. A right to work check is needed for every hire, and some sectors and roles carry their own legal or regulatory requirements. Most other checks, such as credit, social media or adverse media searches, are optional and should only be used where a specific role justifies them.
The ICO's draft guidance describes pre-employment vetting as particularly intrusive and says you are unlikely to need it for many roles. You should vet only where the law requires it or where you can identify significant and particular risks, and you should not routinely vet all candidates. The guides below take each check in turn and say which roles justify it in each UK nation.
Which checks does this role need?
Pick a sector and a role. Each answer comes from the role matrix in our sector guide, with the legal or regulatory basis.
- Check
- Signed declaration before appointment; insolvency, disqualified director and removed trustee register searches
- Basis
- Charity Commission disqualification guidance
England and Wales unless stated.
Read the full sector guideNeed checks run? Ask for an introduction
Verification and vetting are different
The ICO separates two activities. Verification means checking the information a candidate has given you, such as qualifications or references. Pre-employment vetting means making your own enquiries from third parties about a candidate's background and circumstances, which the ICO says goes further and is more intrusive.
Both are covered by data protection law. Explain your process early, verify only the successful candidate where possible, and tell candidates what you will check, why, who will see the information and how long you will keep it.
Required, expected or optional
Every check falls into one of three groups, and the group decides how you justify it. Some are required by law for a role. Some are expected by a regulator or framework. The rest are optional and need a specific, documented reason.
| Basis | Example | Where it applies |
|---|---|---|
| Statutory excuse | Right to work check before work starts: without it you have no defence to a civil penalty | Whole UK |
| Required by law | PVG scheme membership for regulated roles with children or protected adults | Scotland |
| Required by law | Schedule 3 information, including a full employment history, for people employed for the purposes of carrying on a CQC-regulated activity | England |
| Required by FCA rules | A criminal record check before applying for a senior manager's approval, and regulatory references covering the past six years for senior manager, certification and some board roles | UK, FCA-regulated firms |
| Expected by a regulator | Checking for criminal convictions where possible for certification staff assessed under the FCA's fit and proper test | UK, FCA-regulated firms |
| Optional, if the role justifies it | Credit reference checks, which the ICO says must not be carried out routinely or without justification | Whole UK |
Deciding which checks a role justifies
Work role by role. The ICO lists examples of significant and particular risks, including employing unsuitable people to work with children or adults at risk of harm, risk of theft, and disclosure of trade secrets. The check must be proportionate to an identified risk and targeted, with no less intrusive alternative.
In practice, build a simple matrix for each role family: the risk, the check that addresses it, its basis and when it happens. The ICO's own example is a company recruiting a director that runs a bankruptcy search on the successful candidate only, not on everyone who applied.
Collect the minimum you need, and if you ask a third party for information, explain what you need and why. Where checks involve criminal offence data, the ICO says the processing will in most cases be high risk and you must carry out a data protection impact assessment.
The four UK nations
Right to work law applies across the whole of the UK. Criminal record checks do not. The ICO points employers to the Disclosure and Barring Service for jobs in England and Wales, AccessNI for Northern Ireland and Disclosure Scotland for Scotland, and the levels of check and their names differ in each.
Several sector rules apply only in England, including CQC registration requirements for health and adult social care, Keeping children safe in education for schools and colleges, and the EYFS framework for early years providers. The FCA regulates financial services firms across the UK, so its rules on fitness and propriety and regulatory references are not limited to one nation. Always check where the job is based before you decide which rule applies.
The guides in this section
Each check guide says when the check is required, when it may be justified and when it usually is not. The sector guides bring a regulated sector's rules together in one role-based matrix.
- Criminal record checks: DBS, Disclosure Scotland and AccessNI levels, eligibility and fair decisions
- Right to work checks: the three prescribed methods, follow-up checks and the October 2026 extension
- Employment references: when and what to ask, and the sector reference rules
- Social media screening: when reviewing public profiles may be justified
- Adverse media checks: searching public news coverage and handling namesakes
- Credit checks: why they need a role-specific reason
- Financial services: fitness and propriety, regulatory references and SM&CR
- Health and social care: CQC Regulation 19 and Schedule 3 in England, and professional registers
Being fair to candidates
If a check produces something that does not match what the candidate told you, the ICO says you should give them a chance to explain, take their explanation into account and keep a record of your decision. You cannot assume the candidate is being untruthful. Information found online may be inaccurate, and the ICO says a decision based on it alone is unlikely to be fair and lawful.
Do not keep vetting information longer than necessary. The ICO says this will often mean securely destroying it once the recruitment process is over, although you can keep a record of the outcome and your decision.
HRjoy is an HR consultancy. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. We can also help you decide which checks your roles justify, write the candidate notices and policies that go with them, and review your process.
Sources
- Pre-employment vetting of candidates · ICO
- Verifying candidates · ICO
- Employer's guide to right to work checks: 1 October 2026 · GOV.UK (Home Office)
- Protecting Vulnerable Groups (PVG) scheme · mygov.scot
- Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, Schedule 3 · legislation.gov.uk
- Regulation 19: Fit and proper persons employed · Care Quality Commission
- FIT 2 Main assessment criteria · FCA Handbook
- Check someone's criminal record · GOV.UK
- Types of AccessNI checks · nidirect
- About us · Care Quality Commission
- Keeping children safe in education 2026 · GOV.UK (Department for Education)
- Early years foundation stage statutory framework for group and school-based providers (from September 2026) · GOV.UK (Department for Education)
- About the FCA · FCA
- SUP 10C.10 Application for approval · FCA Handbook
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Checks
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
- BPSS checks: the Baseline Personnel Security Standard explained Who needs BPSS, the four checks in version 7.0, the three-year employment history and gaps rule, and why BPSS is not SC or DV security clearance.
- Credit checks on job candidates When a UK employer can justify a credit check on a candidate, how it differs from insolvency and director searches, and what to tell applicants.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- CV verification: checking employment history and handling discrepancies How to verify a candidate's CV and employment history fairly: gaps, HMRC records, discrepancies, the Fraud Act and what to record.
- Directorship and company checks on job candidates How to check a candidate's directorships and any disqualification on the Companies House register, what it verifies, and when the check is proportionate.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
- Financial background checks: bankruptcy, insolvency and judgments Which financial checks a role justifies, and how to use UK insolvency registers and the Register of Judgments, Orders and Fines instead of a credit report.
- Identity and address verification for employers What an employee identity check proves, how it differs from right to work, certified digital ID services, false documents and when to verify an address.
- International background checks for candidates who lived abroad Overseas criminal record certificates, references and qualifications for UK employers: when they are required, best practice, data transfers and fairness.
- Professional registration checks: which registers to check and when Which professional registers UK employers should check for nurses, dentists, teachers, solicitors and FCA roles, what each shows and where it applies.
- Qualification checks: verifying degrees and professional qualifications How UK employers can verify degrees and professional qualifications fairly, which official routes exist, and when a qualification check is required.
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- Sanctions and PEP screening of job candidates When a UK employer should check candidates against the UK Sanctions List, how to handle name matches, and why PEP status alone is no bar to a job.
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
Sectors
- Background checks for charities and volunteers Trustee disqualification, free DBS checks for volunteers, safeguarding duties, PVG in Scotland and AccessNI in Northern Ireland, role by role.
- Background checks for drivers and logistics staff DVLA licence checks with a check code, Driver CPC, tachograph cards, right to work for couriers, transport security vetting and when DBS checks fit.
- Background checks for recruitment agencies and staffing businesses What the Conduct Regulations require agencies to confirm, who does right to work and DBS checks for agency workers, and what hirers should ask for.
- Background checks for technology and cyber security roles Which checks developers, system administrators, security engineers, data and support staff justify, from identity checks to basic DBS, BPSS and credit.
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Background checks in security and facilities management SIA licensing under the Private Security Industry Act 2001, what the SIA checks, BS 7858 screening, and checks for facilities staff on sensitive sites.
- Pre-employment checks for the public sector and government suppliers BPSS, who decides on security clearance, checks for government suppliers, Civil Service nationality rules, police vetting and DBS levels for public roles.
- Pre-employment checks in childcare and nurseries EYFS suitability checks from September 2026 for nurseries and childminders in England, Ofsted disqualification, household members and the rest of the UK.
- Pre-employment checks in construction and engineering Right to work through sub-contractor chains from October 2026, competence under CDM 2015, Gas Safe registration, BPSS sites and criminal record checks.
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
- Pre-employment checks in hospitality and retail Right to work at volume, casual and gig staff from October 2026, personal licences for alcohol sales, cash-handling roles and references at scale.
- Pre-employment checks in schools and colleges KCSIE 2026 checks for schools and colleges in England, the single central record, supply staff and volunteers, and the rules in Wales, Scotland and NI.
Guides
- Employee monitoring vs candidate social media checks Why checking a candidate's public social media and monitoring an employee's are different legal activities, compared side by side for UK employers.
- False positives in online background checks: name matching and context How UK employers avoid acting on the wrong person or a misread post in online checks: namesakes, old posts, fake accounts, tags and context.
- Manual search or social media screening software? How a documented manual search compares with a specialist social media screening service on records, accuracy, privacy, automated decisions and contracts.
- Protected characteristics and social media screening: avoiding bias Why social media checks expose protected characteristics, how to keep them out of hiring decisions, and a human-review checklist for UK employers.
- What a good social media screening report looks like A fictional, annotated social media screening report for a care worker role, showing what a UK employer should record at each step and why.
- What can social media screening legitimately flag? Which social media findings can fairly reach a UK hiring decision, which must be filtered out, and an illustrative criteria list to adapt.
- Which social media platforms can employers screen? UK law does not list platforms. How public versus private information, purpose, relevance and consistency decide what an employer can look at.
- Choosing background screening software: an evaluation framework for UK employers Criteria for UK employers assessing background screening software: statutory check routes, processor contracts, data handling and automated decisions.
- Do employers need candidate consent for background checks? Why consent is rarely the right lawful basis for UK background checks, what candidates must be told, and where their permission is still needed.
- How long do pre-employment checks take? What DBS, Disclosure Scotland, AccessNI and the Home Office say about processing times, what causes delays and how to plan a start date around checks.
- How much do employment background checks cost in the UK? The official fees for DBS, Disclosure Scotland and AccessNI checks, which checks are free, and the other costs employers meet when screening candidates.
- How to write a candidate screening privacy notice What UK GDPR Articles 13 and 14 and the ICO say candidates must be told about background checks, when to tell them, and example wording to adapt.
- The UK background screening checklist for employers A stage-by-stage background screening checklist for UK employers: who owns each step, what to record, and when to delete it.
- Which pre-employment checks are mandatory, and which are optional? A role and sector matrix of UK pre-employment checks: which the law requires, which a regulator expects and which are optional.
Questions
Something else? Ask us.
Which background checks are legally required for every job?
Only the right to work check applies to every hire across the UK. Criminal record, reference and other checks become required only for particular roles or sectors, such as regulated roles with children or protected adults in Scotland or CQC-regulated care in England. For other roles they are optional and need a reason.
Can I run the same checks on every candidate?
Not as a matter of routine. The ICO's draft guidance says you should not routinely vet all candidates unless you are legally required to, and that where possible you should verify only the successful candidate. Decide by role, and check the person you intend to appoint.
Do I need a data protection impact assessment?
If your checks involve criminal offence information, the ICO says the processing will in most cases be high risk and you must carry out a DPIA. For other intrusive checks, such as social media or credit, a DPIA is a sensible way to record why the check is necessary and proportionate.