What a good social media screening report looks like
A good social media screening report shows its working. It records why the role justified a check before anyone searched, which public sources were used, how each account was matched to the candidate, what was found against criteria set in advance, what was left out, what the candidate said, who decided and when the raw results were deleted.
The example below is fictional and illustrative: the employer, candidate and findings are invented. It is not legal advice, and copying its format does not make a check lawful. It follows the Information Commission (ICO) draft guidance on pre-employment vetting, which is under review following the Data (Use and Access) Act 2025. Whether a role justifies a check at all is covered on our main social media screening page.
About the example
A fictional home care provider in England is recruiting a care worker to visit older people at home. It has documented a risk the ICO lists as a possible reason for vetting: employing unsuitable people to work with adults at risk of harm. Following the ICO's care home example, it checks only the successful candidate, who was told in advance. Entries marked "employer's choice" are this employer's decisions, not legal rules.
Our view: checking only the successful candidate is consistent if every successful candidate for this role is checked the same way, at the same stage. Acas advises avoiding personal social media in hiring decisions, so this employer limits the check to its documented risk.
Part 1: scope and lawful basis, written before the search
| Field | Entry |
|---|---|
| Role and risk | Care worker, home visits, England. Risk: someone unsuitable working with adults at risk of harm. Signed off before the vacancy opened. |
| Why less intrusive steps fall short | References cover conduct at work. The DBS check the role is eligible for covers recorded criminal and barring information. Neither shows public conduct towards people receiving care. |
| Relevance criteria | C1: public content mocking or demeaning people who receive care. C2: public content disclosing identifiable information about people receiving care. C3: public threats of violence. Nothing else is in scope. |
| Time window | Last five years (employer's choice) |
| Lawful basis | Legitimate interests. Basis, justification and assessment on file (ref LIA-07, fictional). |
| Special category and criminal offence data | Special category data: not sought. Criminal offence data: material meeting C3 may be criminal offence data, so the employer documented its criminal offence data condition before searching (fictional reference). Nothing else suggesting criminal activity is recorded here. |
| Candidate told | In the application pack and offer letter: what is checked, which public sources, why, who sees it, how the check is done, when, and how long it is kept |
| Researcher and decision maker | HR adviser (not on the panel) researches. Panel chair decides. |
| Planned deletion | Raw results destroyed once the decision is final |
Part 2: sources searched
| Source | Searched | Note |
|---|---|---|
| Search engine: name and home town from the application | Yes | First three pages of results (employer's choice) |
| Public posts on accounts confirmed in part 3 | Yes | Within the time window |
| Business networking profile | Yes | Compared with the stated work history only |
| Private, friends-only or closed group content | No | Not public. No follow or friend requests |
| Tools reaching information that is not public | No | The ICO says this is unlikely to be lawful |
Part 3: identity matching
Not used to match: assumptions about nationality, ethnic origin or religion drawn from the candidate's name or photographs.
| Account | Evidence for | Evidence against | Result |
|---|---|---|---|
| Account A, photo sharing site | Name and home town match the application. Links to the networking profile below. | None found | Confirmed |
| Account B, short post site | Same name | Different location and work history from the application | Name match only. Not used. Details deleted. |
| Networking profile | Name, employers and dates match the application | None found | Confirmed |
Part 4: findings passed to the panel
Confidence is the reviewer's opinion, recorded with their name, job title and the date.
| Ref | Posted | Where and link type | Criterion | Confidence | Panel received |
|---|---|---|---|---|---|
| F1 | March 2024 (fictional) | Account A, candidate's own public post | C2 | Identity confirmed. Meaning uncertain: a photo in what looks like a care setting shows a name label on a door. | A written description and why it may meet C2. No screenshot. |
| None | n/a | n/a | C1, C3 | n/a | Nothing met C1 or C3 |
Part 5: material excluded as irrelevant
| What the reviewer saw | Why excluded |
|---|---|
| Holiday, family and sports posts | Not relevant to C1 to C3 |
| Content revealing protected characteristics or special category data (the report does not say which) | Not relevant. Not described, saved or passed on. |
| Posts by others tagging the candidate | Not the candidate's content. None met the criteria. |
| Account B | Not the candidate's account. Only a note that a namesake was excluded is kept. |
Part 6: candidate comment, decision and retention
| Step | Record |
|---|---|
| Candidate's comment | Shown the F1 description and invited to comment within five working days (employer's choice). Said the photo was from a training event at a previous employer and the label was a prop. |
| Further step | With the candidate's agreement, the HR adviser asked that employer only whether the room was a training suite (employer's choice) |
| Decision | F1 does not meet C2. No weight given. Offer confirmed by the panel chair, who never saw the raw results. |
| Raw results | Screenshots and notes securely deleted the day the offer was confirmed |
| Kept | This summary, with F1 reduced to "one item resolved after candidate comment; no concern" |
| Rights | Candidate told they can ask for a copy of their information and for inaccurate information to be corrected |
Why each part matters
- Parts 1, 2 and 6 put into practice the ICO rules set out on our main social media screening page: document the risk first, keep to public material, let the candidate comment and destroy the raw results as soon as reasonably practicable.
- Part 3 applies the accuracy principle: take all reasonable steps to ensure the data is not incorrect or misleading as to any matter of fact, with more effort where a decision significantly affects the person.
- Parts 4 and 5 apply data minimisation: data must be adequate, relevant and limited to what is necessary, which the ICO says matters particularly for special category and criminal offence data.
- Recording confidence as a named opinion follows the ICO's accuracy guidance: a record of an opinion must make clear that it is an opinion and, where appropriate, whose.
Write it as if the candidate will read it
The candidate can ask for a copy of their personal information, including this report, and the ICO says you must respond without undue delay and within one month of receipt, extendable by up to two further months for complex requests. You do not have to provide information that would reveal another person unless they consent or disclosure without consent is reasonable: one more reason to keep other people's posts out of the report.
Our view: describe what a post shows separately from what the reviewer thinks it means. If you would not read a line aloud to the candidate, it probably fails the relevance test. To design the process before you use it, ask HRjoy.
Sources
- Pre-employment vetting of candidates · ICO
- Principle (d): Accuracy · ICO
- Principle (c): Data minimisation · ICO
- A guide to lawful basis · ICO
- A guide to subject access · ICO
- Right to rectification · ICO
- Choosing who to interview · Acas
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Should the report include screenshots?
In our view, describe findings in words and keep any screenshots with the raw results, which the ICO says must be destroyed as soon as reasonably practicable. Whole-profile screenshots capture irrelevant and special category information the decision maker should not see.
What if nothing relevant is found?
In our view, record the same things: the risk, the criteria, the sources, how identity was confirmed, and a line confirming nothing met the criteria. Destroy the raw results once the decision is made.
We are a small employer. Can the hiring manager do the search?
The ICO says staff who research a candidate's social media should not also make the recruitment decision. In our view, if you have no separate HR function, ask a manager who is not involved in the appointment, or an outside adviser, to review against your written criteria.
Related checks
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
- Adverse media checks on job candidates When a UK employer can search the press and online sources for negative coverage of a candidate, and how to handle namesakes and allegations.
Sector guides
Guides
- False positives in online background checks: name matching and context How UK employers avoid acting on the wrong person or a misread post in online checks: namesakes, old posts, fake accounts, tags and context.
- What can social media screening legitimately flag? Which social media findings can fairly reach a UK hiring decision, which must be filtered out, and an illustrative criteria list to adapt.
- Protected characteristics and social media screening: avoiding bias Why social media checks expose protected characteristics, how to keep them out of hiring decisions, and a human-review checklist for UK employers.
- How to write a candidate screening privacy notice What UK GDPR Articles 13 and 14 and the ICO say candidates must be told about background checks, when to tell them, and example wording to adapt.
- Do employers need candidate consent for background checks? Why consent is rarely the right lawful basis for UK background checks, what candidates must be told, and where their permission is still needed.
Related answers
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- What are the protected characteristics under the Equality Act 2010? The Equality Act 2010 lists nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. In Great Britain, employers must not discriminate against job applicants, workers or former workers because of any of them.