The UK background screening checklist for employers
A screening process holds up when each check is chosen before you advertise, explained to candidates early, run on the person you intend to appoint and deleted once it has done its job. Very little is required of every employer: a right to work check before employment starts applies across the whole UK. Other checks are required only for particular roles, sectors and nations, and the ICO's draft guidance says you should not routinely vet all candidates unless you are legally required to.
This checklist follows one hire from planning to deletion, with who usually owns each step and what to record. The ownership suggestions are our view for a typical small or mid-sized employer.
Before advertising: decide the checks for each role
Start with the role, not the candidate. The ICO says you should only vet where you are under a legal obligation, such as right to work checks, or can identify significant and particular risks to the employer, clients, customers or others, and the check must be proportionate with no less intrusive alternative. Our guide to mandatory and optional checks shows which roles carry a legal requirement.
Determine and document your lawful basis before processing begins. If the role needs criminal record information, the ICO says that processing will in most circumstances be high risk, so you must carry out a data protection impact assessment (DPIA). In England and Wales, DBS says knowingly requesting a higher-level check than the legislation allows is unlawful.
Our view: HR should own a written record for each role family, with the hiring manager describing the duties. Record:
- the role and the specific risk, or the law that requires the check
- each check, its basis (required by law, expected by a regulator, or optional) and the UK nation where the job is based
- the level of criminal record check the duties make the role eligible for, if any
- the lawful basis and, for criminal record information, the Schedule 1 condition you rely on
- the stage at which each check happens and how long each result is kept
Advert and application
Acas says you should tell applicants what else you will need from them, such as proof of their right to work, a reference or a health check. The ICO says you must tell candidates if you intend to vet them: what information you need, why, who will have access, the processes, how long you will keep it and, where possible, the third party sources you will use.
Give this privacy information when you collect the information, for example in the advert or application form. In general the ICO says you should not ask for a criminal records declaration on the application form; explain that you will ask for one at conditional offer, on a detachable form. In England, for school and college roles involving regulated activity with children, Keeping children safe in education 2026 (KCSIE) says applicants should be told it is an offence to apply if they are barred.
HR usually owns this stage. Keep a record of which version of the notice each candidate saw.
Shortlisting and interview
For most roles the ICO says it will usually be appropriate to shortlist on the information candidates provide, not on references or public social media. Have a designated person remove irrelevant information before applications reach the decision makers. Acas says ideally 2 or more people should choose who to interview.
Some sectors move checks earlier. In England, KCSIE says schools and colleges should ask shortlisted candidates for a self-declaration of their criminal record and should consider an online search of shortlisted candidates, telling them it may be done. If you verify information earlier than the offer, the ICO says you must be able to justify why.
The shortlisting panel owns this stage. Record the criteria, the scores and who took part.
Conditional offer
The ICO says that in most circumstances it is only appropriate to vet the candidate who is offered the job, and that as far as possible you must only obtain criminal records disclosure for the person you intend to appoint. Acas says the offer letter should state whether it is conditional, for example on suitable references or a health check. Before approaching a current employer for a reference, you should have made a conditional offer and have the applicant's permission.
The hiring manager usually owns the offer, with HR drafting the letter. Record each condition, the candidate's written acceptance and their permission to contact referees.
Running the checks
Use the same process for everyone appointed to the same role. The Home Office says employers should be consistent in how they conduct right to work checks on all workers, including British citizens.
HRjoy does not run checks itself. If you need checks run, we can introduce you to our screening partners.
| Check | Who usually does it | What to record |
|---|---|---|
| Right to work (whole UK) | The employer or staff it delegates to; the employer remains liable if the check was not done as prescribed | A copy of each document or the online check result, and a dated declaration or record of when the check was made |
| DBS standard or enhanced check (England and Wales) | The candidate completes the application form; the employer or registered body checks it and verifies identity | The level requested and why, the date, and that you saw the original certificate |
| DBS Update Service status check | The employer, if legally entitled to the check and with the worker's permission | The date and the result of the status check |
| References | HR, asking referees only for the information you require | What you asked for and why, and the reply |
| Checks done by an agency or other third party | The third party; in England, CQC-registered providers must still assure themselves all checks are complete and satisfactory | The evidence received against each item you require |
Handling results
If a check does not match what the candidate told you, the ICO says you should follow a transparent written process, give the candidate an opportunity to explain, take the explanation into account and keep records of your decisions. You cannot assume the candidate is being untruthful.
In England and Wales, if you carry out DBS checks you must have a policy on employing ex-offenders and show it to any applicant who asks. In England and Wales, an employer can appeal a DBS check if it has spoken to the applicant first. If a condition is not met, Acas says you can withdraw the offer and should give your reasons.
The hiring manager decides, with HR. Record the finding, the candidate's explanation, the decision and who made it.
Before the start date
Some checks must be complete before the person starts. Build these in as hard stops.
- Whole UK: do the right to work check before employment commences to establish a statutory excuse, and diary a follow-up check if permission is time-limited.
- England, group and school-based early years: the EYFS framework says providers must not allow individuals to begin working until they have received the enhanced criminal records and barred list check.
- England, CQC-registered services: CQC says Schedule 3 information must be confirmed before people are employed.
- England, schools and colleges: KCSIE says schools and colleges must obtain a separate children's barred list check if someone will start regulated activity with children before the DBS certificate is available; settings under the EYFS framework cannot do this and must wait for the certificate.
- Scotland: it is an offence to offer a regulated role without first receiving a Level 2 disclosure confirming PVG scheme membership, although an offer made subject to receiving it is allowed.
- FCA-regulated firms: criminal record information for a candidate for an FCA-designated senior management function must be obtained before the application for approval, and for a non-SMF board director in core and enhanced firms before appointment, so far as reasonably able no older than 6 months.
Retention and deletion
The ICO says data protection law sets no timescales for recruitment records, so set and document your own. Destroy vetting information securely as soon as reasonably practicable, keeping a record of the outcome and your decision.
- Right to work copies: keep for the duration of employment and two years afterwards, then destroy securely.
- DBS certificate information (England and Wales): the code of practice says destroy after a suitable period, usually no longer than 6 months.
- Unsuccessful candidates: the ICO's example is not to keep records beyond the statutory period for bringing a claim unless there is a clear business reason.
- England, CQC-registered services: regulation 19 requires the Schedule 3 information to be available for each person employed.
Sources
- Pre-employment vetting of candidates · ICO
- Verifying candidates · ICO
- Data protection and recruitment · ICO
- Information provided by candidates · ICO
- Shortlisting, testing, and interviewing candidates · ICO
- Keeping recruitment records · ICO
- Employer's guide to right to work checks: 1 October 2026 · GOV.UK (Home Office)
- DBS checks guidance for employers, voluntary organisations and third parties · GOV.UK (Disclosure and Barring Service)
- Check someone's criminal record · GOV.UK
- DBS Update Service · GOV.UK
- Advertising a job · Acas
- Choosing who to interview · Acas
- Offering someone a job · Acas
- Job references: when an employer must give a reference · Acas
- Keeping children safe in education 2026 · GOV.UK (Department for Education)
- Early years foundation stage statutory framework for group and school-based providers (from September 2026) · GOV.UK (Department for Education)
- Regulation 19: Fit and proper persons employed · Care Quality Commission
- Disclosure (Scotland) Act 2020, section 73 · legislation.gov.uk
- SUP 10C.10 Application for approval · FCA Handbook
- SYSC 23 Senior managers and certification regime: Introduction and classification · FCA Handbook
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Who should own background screening in a small organisation?
In our view one named person, usually whoever leads on HR, should own the role records and retention schedule, with hiring managers describing duties. Tasks can be delegated but liability may not move with them: the Home Office says the employer remains liable for a civil penalty if a delegated right to work check was not done as prescribed.
Can someone start before all the checks are back?
It depends on the check. To have a statutory excuse, the right to work check must be done before employment starts. Group and school-based early years providers in England must wait for the enhanced and barred list check, and CQC-registered providers must confirm Schedule 3 information first. For other roles it is your decision; record your reasoning.
Should we check every applicant?
No. The ICO says that where possible you should verify only successful candidates, and that you should not routinely vet all candidates unless you are legally required to. Apply the same checks to everyone you appoint to the same role, so your process is consistent and defensible.
Related checks
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
Sector guides
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
Also covered in our guides for Childcare, Construction and engineering, Education, Hospitality and retail, Logistics and transport and Recruitment agencies.
Guides
- Which pre-employment checks are mandatory, and which are optional? A role and sector matrix of UK pre-employment checks: which the law requires, which a regulator expects and which are optional.
- Do employers need candidate consent for background checks? Why consent is rarely the right lawful basis for UK background checks, what candidates must be told, and where their permission is still needed.
- How to write a candidate screening privacy notice What UK GDPR Articles 13 and 14 and the ICO say candidates must be told about background checks, when to tell them, and example wording to adapt.
- How long do pre-employment checks take? What DBS, Disclosure Scotland, AccessNI and the Home Office say about processing times, what causes delays and how to plan a start date around checks.
Related answers
- How do employers carry out right to work checks? Before someone starts work, employers should carry out one of three prescribed checks: a manual check of original documents, a Home Office online check using a share code, or a check through a registered right to work digital verification service provider. Done correctly, it gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- How should probation periods work? There is no legal requirement to have a probation period, and it can be any length. Acas recommends clear written expectations, regular reviews, support to improve, extension where appropriate, and a fair procedure before any dismissal. Day-one rights such as protection from discrimination apply throughout, and the unfair dismissal qualifying period falls to 6 months from 1 January 2027.