BPSS checks: the Baseline Personnel Security Standard explained
The Baseline Personnel Security Standard (BPSS) is the Cabinet Office's pre-employment screening standard for people working within and for government: civil servants, members of the armed forces, temporary staff, contractors and suppliers. The current version on GOV.UK, checked on 28 October 2026, is Version 7.0, June 2024.
BPSS has four checks: identity, right to work in the UK, employment history and criminal record (unspent convictions). The checks start once the person accepts a provisional offer, and the formal offer is made only once BPSS is passed. Employment history is verified for at least three years.
BPSS is not a security clearance. Counter Terrorist Check, Security Check and Developed Vetting are national security vetting, set by the departmental authority responsible for the post and carried out by United Kingdom Security Vetting. BPSS underpins them.
Who BPSS applies to
BPSS applies to all individuals working within and for the government, irrespective of employment type. The guidance is written for government organisations and for third parties (suppliers) carrying out BPSS checks. Its purpose is to make sure people are entitled to work, to protect the government estate and its assets, and to provide a basis for national security vetting.
HR teams generally administer BPSS. Organisations may outsource part or all of the process to a supplier, including the decision to grant BPSS, and must agree each party's role, updating contracts or signed agreements as necessary. Civil servants are also subject to the Civil Service Nationality Rules, which do not apply to other employment groups.
The four checks in Version 7.0
The standard uses "shall" for mandatory elements and "should" for recommendations. Organisations can add further checks in line with their risk appetite, after confirming with security, HR, legal and data protection teams that they are proportionate and lawful.
| Check | What the standard asks for |
|---|---|
| Identity | Verify documents showing full name, date of birth and full current or permanent address, plus photo ID, by a physical check or an identity document validation technology provider. Keep a copy. See our identity verification page |
| Right to work | The legal right to work check, by physical document check, digital service or Home Office online check, using the Employer Checking Service where status cannot be verified. See our right to work checks page |
| Employment history | Verify employment, academic history or qualifications for at least three years, through HMRC PAYE records or employer references |
| Criminal record | An unspent criminal record check with DBS, Disclosure Scotland or AccessNI |
Employment history and the gaps rule
The organisation shall verify disclosed employment, academic history or qualifications for a minimum of three years before the BPSS checks, and can accept an HMRC PAYE records PDF from the individual as proof of employment. For self-employment, it verifies the dates and the status of the business, for example through HMRC, an accountant or client references.
On gaps, the standard says organisations should obtain references or evidence from the individual for gaps of six months or more, continuous or cumulative, within the previous three years. It is a recommendation rather than a mandatory element, and organisations can look at shorter gaps if their risk threshold requires it. Individuals must be told that giving referee contact details means consenting to those referees being contacted.
Time abroad has its own rule. If someone has lived overseas for six months or more in the last three years, organisations shall assure themselves with documents such as proof of overseas residence, overseas employee or academic references, or official overseas police certificates where available. Our international background checks page covers these steps.
How BPSS uses a basic criminal record check
BPSS looks at unspent convictions only. The standard notes that the Rehabilitation of Offenders Act 1974 lets employers ask about unspent convictions in England, Wales and Scotland, and that rehabilitation periods differ in Scotland and Northern Ireland. Full disclosure of all convictions and cautions is required only for exceptions, such as national security or law enforcement roles.
The check comes from the body for the relevant part of the UK: a basic DBS check in England and Wales, which shows only unspent convictions; a Level 1 disclosure from Disclosure Scotland, which has replaced the basic disclosure; or a basic AccessNI check in Northern Ireland. Our criminal record checks page explains these.
An existing basic certificate older than 90 days can be accepted in line with the organisation's risk appetite: a DBS certificate has no official expiry date but is a snapshot in time. UK bodies cannot access overseas criminal records, so where that leaves insufficient evidence, the standard says organisations shall obtain an overseas police record check.
When a check raises a concern
Version 7.0 says a criminal conviction should not be an automatic barrier to employment and shall be assessed case by case, weighing factors such as relevance to the post, seriousness, the time since the offence and any pattern. Record the assessment, and offer the individual an opportunity to explain any disclosure or discrepancy.
If BPSS cannot be completed or finds an adverse concern, the organisation either risk-manages and onboards the person, for example where they have limited UK residency, or does not employ them. If an application is rejected, it shall record its decisions and tell the individual the outcome.
BPSS is not security clearance
National security vetting has five main levels: Accreditation Check, Counter Terrorist Check, Level 1B, Security Check and Developed Vetting. The requirement for any level is set by the departmental authority responsible for the post, and United Kingdom Security Vetting, part of the Cabinet Office, is the single government provider. A supplier cannot decide for itself that a candidate should have SC: the requirement comes from the government department responsible for the post.
The higher levels go much further than BPSS. CTC, SC and DV each include a security questionnaire, a check of spent and unspent criminal records and a check of Security Service records. SC adds a credit and financial history check, and DV adds a full review of personal finances and an interview with a trained Investigating Officer.
BPSS gives access to UK OFFICIAL information; regular access to SECRET material needs vetting. Where a role needs both, identity and right to work checks must be completed before the vetting application starts, and the other two BPSS checks before clearance is granted.
Timing, records and reviews
If a person has already passed BPSS elsewhere, the new organisation can onboard them once identity and right to work checks are done and complete the other checks in post, which the standard says should be done within three months, and must make clear that continued employment depends on passing them. The result goes on the BPSS Verification Record at Annex B.
BPSS has no validity period. The standard says a review should not be needed unless the person transfers, returns after a break of more than 12 months, has limited leave to remain or reports a change in circumstances. HRjoy does not run BPSS checks. We can help you write the process and privacy notice, and introduce you to our screening partners.
What to tell the candidate
- The organisation's privacy notice must explain how personal information is used for BPSS, including any supplier arrangements.
- Candidates must be told that refusing to undergo BPSS will lead to the offer being withdrawn.
- Candidates must be told that giving referee contact details means consenting to those referees being contacted.
- Candidates should get an opportunity to explain any disclosure or discrepancy, with supporting evidence.
- If the application is rejected, the organisation must tell the candidate the outcome.
Sources
- Government baseline personnel security standard · GOV.UK (Cabinet Office)
- UK Government Baseline Personnel Security Standard, Version 7.0, June 2024 (HTML) · GOV.UK (Cabinet Office)
- National security vetting: clearance levels · GOV.UK (United Kingdom Security Vetting)
- United Kingdom Security Vetting: clearance levels · GOV.UK (United Kingdom Security Vetting)
- United Kingdom Security Vetting · GOV.UK
- Request a basic DBS check · GOV.UK
- Apply for a Level 1 disclosure · mygov.scot
- Disclosure levels · mygov.scot
- Types of AccessNI checks · nidirect
- Pre-employment vetting of candidates · ICO
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
When it’s justified
Usually justified
- Civil servants, members of the armed forces, temporary staff, contractors and suppliers working within or for government
- Anyone who will need national security vetting, because CTC and above require BPSS to be completed
- A review when someone transfers, returns after a break in service of over 12 months, has limited leave to remain or reports a change in circumstances
Only if the role justifies it
- Checks beyond the four elements, where the organisation's risk appetite justifies them and they are confirmed as proportionate and lawful
- Looking at employment gaps shorter than six months, where the organisation's risk threshold calls for it
- Using BPSS as a benchmark outside government, for a role with a specific risk you can name, applying the ICO's proportionality test
Rarely or never justified
- Using BPSS to sift or shortlist candidates: the standard says it shall not be used that way
- Describing BPSS as security clearance or relying on it for regular access to SECRET material
- Repeating full BPSS on a timetable: it has no validity period
Questions
Something else? Ask us.
What is the current version of BPSS?
When we checked GOV.UK on 28 October 2026, the current standard was the UK Government Baseline Personnel Security Standard, Version 7.0, June 2024, with Annex A (acceptable identity documents) and Annex B (the verification record). The GOV.UK page was last updated on 28 June 2024.
Is a BPSS check the same as a DBS check?
No. A basic criminal record check is one of the four BPSS elements. BPSS also covers identity, right to work and at least three years of employment history, and it decides whether someone can start, not whether they can hold a security clearance.
Does BPSS expire?
No. BPSS has no validity period. The standard says checks should not need reviewing unless the person transfers to another organisation, returns after a break in service of more than 12 months, has limited leave to remain, or reports a change in circumstances.
Can we get SC clearance for our staff because a client asks?
Not on your own initiative. The requirement for national security vetting at any level is set by the departmental authority responsible for the post, and United Kingdom Security Vetting carries out the vetting. The government body responsible for the post decides whether a role needs it; BPSS must be completed for CTC and above.
Related checks
- Identity and address verification for employers What an employee identity check proves, how it differs from right to work, certified digital ID services, false documents and when to verify an address.
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
- International background checks for candidates who lived abroad Overseas criminal record certificates, references and qualifications for UK employers: when they are required, best practice, data transfers and fairness.
- Credit checks on job candidates When a UK employer can justify a credit check on a candidate, how it differs from insolvency and director searches, and what to tell applicants.
Sector guides
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
Also covered in our guides for Construction and engineering, Logistics and transport, Public sector, Security and facilities and Technology.
Related answers
- How do employers carry out right to work checks? Before someone starts work, employers should carry out one of three prescribed checks: a manual check of original documents, a Home Office online check using a share code, or a check through a registered right to work digital verification service provider. Done correctly, it gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker.
- What are the protected characteristics under the Equality Act 2010? The Equality Act 2010 lists nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. In Great Britain, employers must not discriminate against job applicants, workers or former workers because of any of them.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.