Do employers need candidate consent for background checks?
Usually not as the legal basis for the check. Under UK GDPR you need a lawful basis for each check, and the ICO's draft recruitment guidance says that because there is likely to be an imbalance of power between candidate and employer, consent is unlikely to be an appropriate lawful basis at most stages of recruitment. Right to work checks rest on legal obligation, and much verification on legitimate interests. Criminal record information also needs a condition in Schedule 1 to the Data Protection Act 2018.
Two things still involve the candidate. You must be transparent: tell candidates what you will check, why, who will see it and how long you will keep it. And some processes need the candidate's own part or permission. In England and Wales, a DBS standard or enhanced application is completed by the applicant, a status check on the DBS Update Service needs the worker's permission, and Acas says you should have the applicant's permission before approaching their current employer for a reference. Treat that permission as part of the process, not as your lawful basis.
Lawful basis and permission are different things
The ICO uses the word consent in two senses. Its vetting guidance says that in many circumstances you can ask for a self-declaration or perform criminal record checks provided that you get the candidate's consent first. Its guidance on criminal offence data then gives the example of a delivery company that may require consent to carry out a DBS check, and says this does not mean it can use that consent as its lawful basis: the consent would not be freely given and could not be withdrawn.
So there are two questions for every check. Is the candidate agreeing to take part, where the process needs that? And what lawful basis, and for criminal records what Schedule 1 condition, are you actually relying on?
Why consent rarely works as the lawful basis
The ICO says you can rely on a candidate's consent only if it is freely given and unambiguous, they have complete control over their information, it involves an affirmative action, it is specific and granular, and they can withdraw it at any time without detriment. Submitting an application is not express consent. Candidates may feel they have no choice, so the ICO says consent is unlikely to be appropriate at most stages of recruitment.
The ICO's own example is a bank making a conditional offer subject to a clear criminal records check and evidence of the right to work. It is not appropriate for the bank to rely on consent, because it needs the checks before the candidate starts and would use another lawful basis even if the candidate refused. The ICO's general guidance adds that you cannot usually swap from consent to a different basis later, so do not ask for consent you would override if the candidate said no.
The lawful basis for common checks
The ICO's recruitment guidance points to these bases. It is draft and under review following the Data (Use and Access) Act 2025, and the ICO's general lawful basis guidance, updated in April 2026, now lists seven lawful bases, including recognised legitimate interest for purposes such as safeguarding vulnerable people and preventing or investigating crime.
| Check | Likely lawful basis | Note |
|---|---|---|
| Right to work | Legal obligation | The ICO's own example |
| Vetting the law requires, such as enhanced checks on social workers | Legal obligation | Not available where you have discretion over whether to process |
| Verifying candidates, including references | Legitimate interests | Carry out a legitimate interests assessment |
| Qualification evidence after an offer is accepted | Contract | Only once a conditional or unconditional offer has been accepted |
| Public social media checks | Legitimate interests | Needs a documented specific risk and notice to candidates |
| Criminal record checks | A lawful basis plus a Schedule 1 condition | The ICO says a DPIA is required in most circumstances |
Criminal record information needs a Schedule 1 condition
Section 10(5) of the Data Protection Act 2018 says that processing criminal convictions data, other than under official authority, meets the UK GDPR's requirement for authorisation by law only if it meets a condition in Part 1, 2 or 3 of Schedule 1. The ICO says the most relevant for employers are usually that processing is necessary to comply with employment law obligations, for example where you are legally required to vet for safeguarding or to comply with FCA conduct rules, or a substantial public interest condition such as safeguarding, preventing or detecting unlawful acts, or preventing fraud. The employment condition requires an appropriate policy document.
Schedule 1 does include consent as a condition (paragraph 29). But the ICO says to be particularly careful if you are in a position of power, such as the individual's employer. Some conditions, including preventing, investigating or detecting unlawful acts (paragraph 10) and safeguarding of children and individuals at risk (paragraph 18), ask you to justify why you are not relying on consent, and the ICO gives as an example that employers may not be able to show consent would be freely given.
Where the candidate's permission is part of the process
Some processes build in the candidate's own part or permission. Record each one, and describe it in your privacy notice as the candidate's agreement to take part, not as your lawful basis.
- DBS standard and enhanced checks (England and Wales): you give the candidate the application form to complete and return, and verify their identity. DBS says do not amend the form without the applicant's knowledge and agreement, as that invalidates the applicant's declaration.
- DBS basic checks (England and Wales): the candidate can apply directly, or the employer can use a Responsible Organisation if it has the applicant's consent.
- DBS Update Service: to check a certificate's status online you must be legally entitled to the check and have the worker's permission. In England's group and school-based early years settings, the EYFS framework says consent must be obtained from the member of staff before using the Update Service.
- References: Acas says that before approaching a current employer you should have made a conditional offer and have the applicant's permission.
- Personal social media: Acas advises against using it to decide whether to interview or hire, and warns you might be breaking the law if the person did not agree to that use.
What candidates must be told
Transparency applies whatever your lawful basis. The ICO says you must tell candidates if you intend to vet them, explaining what information you need, why, who will have access, the processes you will use, how long you will keep it and, where possible, the third party sources you will rely on. You must give privacy information when you collect information from the candidate, and within one month at the latest when you obtain it from other sources. Your privacy information must include your lawful basis and purposes.
For some roles the ICO says you may need to say more, for example where special checks such as safeguarding apply, or where it may be an offence for a person on the children's barred list to apply.
What to say to candidates
These illustrative statements can be adapted for a candidate privacy notice or offer letter. Keep only those that match checks the role actually needs. Our view: avoid a line saying the candidate consents to all checks, because it implies a choice the candidate does not really have. HRjoy can help you write these notices; we do not run checks ourselves, but we can introduce you to our screening partners.
- If we offer you this role, the offer will be conditional on the checks listed here.
- We check your right to work because the law requires it. We carry out [named check] because [the specific risk in this role].
- We will ask your permission before we contact your current employer for a reference.
- For the criminal record check, you will complete the application and the certificate will be sent to you. We will ask to see the original.
- If anything does not match what you told us, we will talk to you before we decide.
- We will keep [items] for [period], then delete them, keeping a record of the outcome.
Sources
- Data protection and recruitment · ICO
- Pre-employment vetting of candidates · ICO
- What are the conditions for processing? (criminal offence data) · ICO
- When is consent appropriate? · ICO
- A guide to lawful basis · ICO
- Data Protection Act 2018, section 10 · legislation.gov.uk
- Data Protection Act 2018, Schedule 1 · legislation.gov.uk
- DBS checks guidance for employers, voluntary organisations and third parties · GOV.UK (Disclosure and Barring Service)
- DBS Update Service · GOV.UK
- Early years foundation stage statutory framework for group and school-based providers (from September 2026) · GOV.UK (Department for Education)
- Job references: when an employer must give a reference · Acas
- Choosing who to interview · Acas
- Offering someone a job · Acas
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Can a candidate refuse a background check?
Yes, but it has consequences. If your offer is conditional on the check, Acas says you can withdraw it if a condition is not met, and you should give your reasons. Where you did rely on consent, the ICO says that withdrawing consent also means withdrawing from the recruitment process, which it regards as a reasonable outcome.
Is the candidate's signature on a DBS application their consent?
It is the applicant's declaration on the form, and it shows they are taking part. It is not a sound lawful basis for your own processing. The ICO's example says an organisation may require consent to carry out a DBS check without being able to use that consent as its condition for processing.
Do we need consent to take up a reference?
Not as a lawful basis: the ICO lists verifying candidates among the activities where legitimate interests is likely to be relevant. But Acas says you should have the applicant's permission before approaching their current employer, and should say at the application stage whether you need a work or character reference.
Related checks
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
Sector guides
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
Also covered in our guides for Recruitment agencies.
Guides
- How to write a candidate screening privacy notice What UK GDPR Articles 13 and 14 and the ICO say candidates must be told about background checks, when to tell them, and example wording to adapt.
- The UK background screening checklist for employers A stage-by-stage background screening checklist for UK employers: who owns each step, what to record, and when to delete it.
- Which pre-employment checks are mandatory, and which are optional? A role and sector matrix of UK pre-employment checks: which the law requires, which a regulator expects and which are optional.
Related answers
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.