Adverse media checks on job candidates
An adverse media check is a search of news reports and other public sources for negative coverage of a candidate. No UK law requires it for ordinary jobs, and the Information Commission (ICO) guidance on pre-employment vetting does not mention it by name. That guidance still applies. The ICO says vetting is particularly intrusive, should only be done where you have a legal obligation or can identify significant and particular risks, and should not be applied routinely to all candidates unless the law requires it. Its rules for online checks, written about social media, are a sound pattern for any search of public information.
In practice that means a documented reason for the role, telling the candidate before you search, a reviewer who filters out irrelevant results before anything reaches the hiring manager, and a chance for the candidate to respond. Press coverage of alleged crimes is criminal offence data, and articles about someone with the same name are a common source of error. Schools and colleges in England should consider an online search of shortlisted candidates under Keeping children safe in education 2026.
What an adverse media check is, and what it is not
An adverse media check looks for public reporting such as news articles, court reports and regulatory announcements. It is not a criminal record check. The ICO points employers to the statutory routes, which depend on where the job is based: the Disclosure and Barring Service (DBS) in England and Wales, AccessNI in Northern Ireland and Disclosure Scotland in Scotland.
It is also separate from sanctions screening. Since 28 January 2026, UK sanctions designations have been detailed only in the UK Sanctions List, published by the Foreign, Commonwealth and Development Office. If a role needs sanctions screening, check against that list rather than relying on a general media search.
When the role justifies it
The ICO's guidance on pre-employment vetting is still draft and under review following the Data (Use and Access) Act 2025. It says the check must be proportionate to an identified risk and a targeted way of achieving your objective, with no less intrusive alternative.
The ICO's own example shows the targeting it expects. A company recruiting a director runs a bankruptcy search on the successful candidate, but it is not necessary to carry out these checks on all candidates. Apply the same thinking here: search for the person you intend to appoint, for the roles where you have written down why.
Allegations, old convictions and the press
Much adverse media is about alleged wrongdoing. The ICO says criminal offence data covers suspicion or allegations of criminal activity, and that unproven allegations need special protection. To process criminal conviction information, an employer without official authority must have a lawful basis and meet a specific condition under Schedule 1 of the Data Protection Act 2018. The ICO says processing criminal offence information for vetting will in most circumstances be high risk, so you must carry out a data protection impact assessment (DPIA).
Old reporting can reveal convictions that are now spent. In England, Wales and Scotland, the Rehabilitation of Offenders Act 1974 says that a spent conviction is not a proper ground for excluding a person from employment, subject to exceptions made by order. Scotland has its own exceptions order and disclosure law. Northern Ireland has the Rehabilitation of Offenders (Northern Ireland) Order 1978. A newspaper archive does not change that. Our criminal record checks page explains which roles fall within the exceptions.
Namesakes and accuracy
The ICO warns that information found online may not be accurate or properly reflect whether the candidate is suitable, and that a decision based on it alone is unlikely to be fair and lawful. Data protection law also requires you to take all reasonable steps to ensure the personal data you hold is not incorrect or misleading as to any matter of fact.
Our view: treat a matching name as unconfirmed. Before a result goes anywhere, the reviewer should confirm it relates to the candidate using details the candidate has given you, such as previous employers or places they have lived, and record how they confirmed it. If they cannot, it should not reach the decision maker.
Who searches, who decides
The ICO says staff who research a candidate's social media should not also make the recruitment decision, and in its care home example one person screens the results for relevance against the interview criteria and passes on only what is relevant. Use the same split for media searches. Set the relevance criteria before the search, tied to the risk you documented.
Results can also reveal protected characteristics such as religion or belief. In Great Britain, section 39 of the Equality Act 2010 says an employer must not discriminate in the arrangements it makes for deciding to whom to offer employment.
Giving the candidate a say
Where your findings do not match what the candidate told you, the ICO says you should follow a transparent process, give the candidate the opportunity to explain, consider their explanation and keep records of your decisions. You cannot assume the candidate is being untruthful. Where facts are unclear, make a reasonable decision based on the factual evidence.
FCA-regulated firms
The FCA's fit and proper test (FIT) says the most important considerations are honesty, integrity and reputation, competence and capability, and financial soundness. The matters a firm should consider include whether the person has been the subject of any adverse finding or settlement in civil proceedings, official investigation or public inquiry. A targeted search can help surface these for senior manager, certification and non-SMF board director roles.
FIT 1.3.20G says a firm generally need not monitor the private lives of its staff and need only look into private life if there is a good reason, for instance an allegation which, if true, would call their fitness into question. It does not expect firms to investigate allegations that are trivial or that the firm reasonably considers implausible. Our financial services page covers the wider FCA picture. If you are unsure whether a role justifies a media check, ask HRjoy.
What to tell the candidate
- That you will run a media check, why the role needs it and which kinds of sources you will use, before you search.
- Who will see the results, and how long you will keep them.
- That they can explain or challenge anything you intend to rely on, including a result about someone else with the same name.
- That they can ask for a copy of their personal information; the ICO says organisations usually have one month to respond.
- That they can ask you to correct inaccurate personal data about them.
Sources
- Pre-employment vetting of candidates · ICO
- What is criminal offence data? · ICO
- Principle (d): Accuracy · ICO
- Rehabilitation of Offenders Act 1974, section 4 · legislation.gov.uk
- Equality Act 2010, section 39 · legislation.gov.uk
- Moving to a single list for UK sanctions designations, 28 January 2026 · GOV.UK
- Keeping children safe in education 2026 · GOV.UK (Department for Education)
- FIT 1 General · FCA Handbook
- FIT 2 Main assessment criteria · FCA Handbook
- Getting copies of your information (SAR) · ICO
- Right to rectification · ICO
- The Rehabilitation of Offenders (Northern Ireland) Order 1978 · legislation.gov.uk
- What is special category data? · ICO
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
When it’s justified
Usually justified
- Shortlisted candidates at schools and colleges in England, where Keeping children safe in education 2026 says the school or college should consider an online search engine check and tell candidates it may be done.
Only if the role justifies it
- Candidates for FCA senior manager, certification or (in core and enhanced firms) non-SMF board director roles, where the firm's fitness and propriety assessment should consider honesty, integrity and reputation. A targeted search can be one input; it does not replace the checks FIT describes.
- Directors and senior appointments where you have documented a specific risk, such as fraud or the disclosure of commercially sensitive information.
- Roles working with children or adults at risk of harm, alongside, never instead of, the criminal record check the role is eligible for.
Rarely or never justified
- Routine searches on every applicant, which the ICO says you should not do unless legally required.
- Ongoing searches into the private lives of existing staff. For FCA-regulated firms, FIT 1.3.20G says a firm generally need not monitor the private lives of staff assessed under FIT.
- Searches of sources that are not publicly available, which the ICO says are unlikely to be lawful, appropriate or necessary.
Questions
Something else? Ask us.
Is an adverse media check a legal requirement?
Not for ordinary employment. The ICO says vetting should only happen where there is a legal obligation or a significant and particular risk. Schools and colleges in England should consider an online search of shortlisted candidates under Keeping children safe in education 2026, which is statutory guidance for that sector.
Can we turn a candidate down because of a news story?
Not on the story alone. The ICO says online information may not be accurate and a decision based only on it is unlikely to be fair and lawful. Confirm the story is about the candidate, check it is relevant to the risk you documented, and let the candidate respond before you decide.
What if the article is about someone else with the same name?
Then it is not about your candidate and should not reach the decision maker. Ask the reviewer to confirm identity using details the candidate has given you and to record how. If an error does slip through, the candidate can ask you to correct inaccurate personal data.
Does an adverse media check replace a DBS check?
No. Criminal record information comes through the statutory routes for where the job is based: DBS in England and Wales, AccessNI in Northern Ireland and Disclosure Scotland in Scotland. A media search can miss convictions and can surface allegations that never led to one.
How long can we keep the results?
The ICO says vetting information must be securely and permanently destroyed as soon as it is reasonably practicable, including information from your own research. You can keep a record of the outcome and your decision. Put this in your retention and disposal policy.
Related checks
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Credit checks on job candidates When a UK employer can justify a credit check on a candidate, how it differs from insolvency and director searches, and what to tell applicants.
Sector guides
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
Related answers
- Can misconduct outside work affect whether someone is fit and proper under FCA rules? Yes. FCA guidance says conduct in someone's private life can be relevant to their fitness and propriety, especially dishonesty, a lack of integrity, violence or sexual misconduct. Firms need not monitor staff's private lives or social media. They need only look into private life where there is a good reason, such as an allegation that would call someone's fitness into question if true.
- What are the protected characteristics under the Equality Act 2010? The Equality Act 2010 lists nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. In Great Britain, employers must not discriminate against job applicants, workers or former workers because of any of them.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.