Choosing background screening software: an evaluation framework for UK employers
Judge screening software against your legal duties before you look at features or price. Buying a platform does not move responsibility: the ICO says an employer is typically the controller of candidate data, and the Home Office says the employer remains responsible for a right to work check done through a digital provider.
Two criteria are pass or fail. Any digital right to work check must come from a provider on the Office for Digital Identities and Attributes (OfDIA) register that can do right to work checks. DBS checks in England and Wales must follow the routes DBS sets out: a registered body or umbrella body for standard and enhanced checks, and a Responsible Organisation or the applicant for basic checks. Then test the processor contract, transfers, security, retention, the audit trail, accessibility, disputes and any automated decisions.
Start with the checks your roles justify
Decide which checks each role needs before any demonstration. A long menu of checks makes it easy to run more than you can justify, and the ICO's draft guidance says you should not routinely vet all candidates unless the law requires it, and must collect only the minimum information you need.
Plan a data protection impact assessment at the buying stage. The ICO says you must carry out a DPIA before processing likely to result in a high risk to candidates, and that criminal offence information for vetting will in most circumstances be high risk. It gives using AI software to help make recruitment decisions as another example.
The two pass or fail tests
Right to work checks apply across the UK. Using a digital verification service provider is optional (for anyone with an eVisa you must use the Home Office online check instead), but if you use one the Home Office says the provider must be on the OfDIA register and able to provide right to work checks. If you buy through an organisation that is not itself certified, such as a screening agency, it must clearly state that it works with a certified and registered provider and identify which one. The statutory register lets anyone check whether a provider holds a valid certificate, but does not show pricing, size or experience.
For criminal record checks in England and Wales, DBS says an organisation can register if it submits more than 100 eligible applications a year and is entitled to ask exempted questions; below that, it should use an umbrella body, which is a registered body giving other organisations access to DBS checks. For a basic check, the applicant can apply directly or the employer can use a Responsible Organisation with the applicant's consent. Scotland and Northern Ireland have their own disclosure bodies and rules; see our criminal record checks guide.
| Ask the provider | What a good answer looks like |
|---|---|
| Who carries out digital right to work checks? | A named provider you can find on the OfDIA register with a valid certificate for right to work checks |
| What do we receive from each right to work check? | A clear copy of the check output, and any facial comparison, that you can keep for the employment plus two years |
| How do DBS applications reach DBS? | Through a registered body or umbrella body for standard and enhanced checks, or a Responsible Organisation for basic checks |
| What if a candidate does not want a digital check? | A manual document check route, because the Home Office says you must not treat that person less favourably |
Processor contract terms
When the provider processes candidate data on your behalf, Article 28 says you may use only processors that can show they will implement appropriate measures so the processing meets UK GDPR requirements, and the contract must be in writing. It must set out the subject matter, duration, nature and purpose of the processing, the types of data and categories of people, and your obligations and rights. Ask whether the provider acts as a controller for any data, for example under its own legal obligations, because the ICO says status can change between activities.
- Processing only on your documented instructions, including for international transfers
- Confidentiality commitments from everyone who handles the data
- The security measures Article 32 requires
- No sub-processor without your prior written authorisation, and notice of changes so you can object
- Help with candidates' rights requests and with your security, breach and DPIA obligations
- Deletion or return of all data at the end of the contract, at your choice
- Information to demonstrate compliance, and audits and inspections by you or an auditor you appoint
Transfers and security
Ask where candidate data is stored and accessed from, including by sub-processors. The ICO's recruitment guidance says the international transfer rules apply if you use a processor based outside the UK. Every restricted transfer needs UK adequacy regulations, an appropriate safeguard such as the International data transfer agreement, together with a reasonable and proportionate assessment that the transfer meets the data protection test (the ICO's guidance still calls this a transfer risk assessment), or an exception.
For security, Article 32 requires measures appropriate to the risk, including as appropriate encryption, ongoing confidentiality, integrity, availability and resilience, the ability to restore data after an incident, and regular testing. The ICO suggests Cyber Essentials as a base set of controls and says you may need to go further. Ask for evidence, and check access can be restricted to the staff who need it.
Retention, deletion and the audit trail
Vetting information should be securely and permanently destroyed as soon as reasonably practicable, which the ICO says will often mean once recruitment is over, while you keep a record of the outcome and your decision. Right to work evidence has a fixed period: the employment plus two years. Look for retention rules you can set by check type, deletion you can evidence, and a full export when you leave.
An audit trail lets you show what was checked, when, by whom and what was decided. The ICO says contract instructions must be capable of being saved, and its draft guidance on automated decisions says you should use a system that can deliver an audit trail of the key decision points. Ask to see the log for a test candidate.
Candidate experience, accessibility and disputes
The ICO's draft guidance says each stage of your recruitment process must be fully accessible for disabled people, and that where software risks discrimination you must mitigate the risk or avoid using it. The government's Responsible AI in Recruitment guide notes that reasonable adjustments are a legal obligation under section 20 of the Equality Act 2010 (in Northern Ireland the equivalent duty is in the Disability Discrimination Act 1995) and warns of digital exclusion. Try the candidate's route through the system on a phone, with assistive technology and without a passport.
Checks can be wrong. The ICO says you should give candidates a chance to explain discrepancies, consider their explanation and keep records of your decisions, and candidates can ask for inaccurate data to be corrected, with one calendar month for a response. Your processor must help you with these requests. Ask how a candidate raises a dispute, what happens to a finding while it is resolved, and how the system helps you acknowledge data protection complaints within 30 days, as section 164A of the Data Protection Act 2018 requires.
Automated decisions after the Data (Use and Access) Act 2025
Since 5 February 2026 (and for some purposes since 19 June 2025), the UK GDPR rules on solely automated decisions are in Articles 22A to 22D. A decision is solely automated if there is no meaningful human involvement, and it is significant if it has a legal or similarly significant effect. The ICO's draft guidance, updated on 31 March 2026 and still in draft, says you can carry out such decision-making subject to two restrictions: one on special category data, such as health information, and one on relying on recognised legitimate interests.
Where you make a significant decision solely by automated means, Article 22C requires safeguards that give candidates information about the decision and let them make representations, obtain human intervention and contest it. The ICO's recruitment guidance, written before these changes and now under review, treats decisions to shortlist or reject as having a legal or similarly significant effect, and says that if a human cannot overturn the system, the decision is solely automated. Ask which features score, rank, flag or reject anyone, whether a person reviews every adverse result before it affects the candidate, and whether overrides are logged.
Using the framework
Score each criterion before you compare prices, and record the answers and evidence in your DPIA. HRjoy works with screening partners and can introduce you to them; the framework applies whichever provider you choose.
Sources
- Employer's guide to right to work checks: 1 October 2026 · GOV.UK (Home Office)
- Find registered digital verification services · GOV.UK (Office for Digital Identities and Attributes)
- DBS checks guidance for employers, voluntary organisations and third parties · GOV.UK (DBS)
- UK GDPR Article 28: Processor · legislation.gov.uk
- UK GDPR Article 32: Security of processing · legislation.gov.uk
- UK GDPR Article 22A: Automated processing and significant decisions · legislation.gov.uk
- UK GDPR Article 22C: Safeguards for automated decision-making · legislation.gov.uk
- Data Protection Act 2018, section 164A: Complaints by data subjects to controllers · legislation.gov.uk
- What needs to be included in the contract? · ICO
- Responsibility for data protection compliance during the recruitment process · ICO
- Data protection and recruitment · ICO
- Pre-employment vetting of candidates · ICO
- Automated decision-making and profiling for recruitment and selection · ICO
- What does the UK GDPR say about ADM? · ICO
- What are the ADM safeguards? · ICO
- A brief guide to international transfers · ICO
- A guide to data security · ICO
- Right to rectification · ICO
- Responsible AI in Recruitment · GOV.UK (DSIT)
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Questions
Something else? Ask us.
Does using a screening provider transfer our legal responsibility?
No. For right to work checks the Home Office says the employer, not the digital provider, remains responsible for meeting the prescribed requirements. The ICO says you are accountable for the data protection compliance of any processor you engage.
Can screening software reject candidates automatically?
Under the rules in force since February 2026, the ICO's draft guidance says solely automated decisions are possible subject to restrictions, including for special category data, and you must provide the Article 22C safeguards, including human intervention and the right to contest. Our view: have a person review every adverse result before it affects a candidate.
What should happen to candidate data when we change provider?
Article 28 requires the contract to say the processor will delete or return all personal data at the end of the service, at your choice, and delete existing copies unless the law requires storage. Export the records you must keep, such as right to work evidence, first.
Related checks
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Identity and address verification for employers What an employee identity check proves, how it differs from right to work, certified digital ID services, false documents and when to verify an address.
Guides
- How to write a candidate screening privacy notice What UK GDPR Articles 13 and 14 and the ICO say candidates must be told about background checks, when to tell them, and example wording to adapt.
- The UK background screening checklist for employers A stage-by-stage background screening checklist for UK employers: who owns each step, what to record, and when to delete it.
- How long do pre-employment checks take? What DBS, Disclosure Scotland, AccessNI and the Home Office say about processing times, what causes delays and how to plan a start date around checks.
Related answers
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- How do employers carry out right to work checks? Before someone starts work, employers should carry out one of three prescribed checks: a manual check of original documents, a Home Office online check using a share code, or a check through a registered right to work digital verification service provider. Done correctly, it gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker.