Background checks for technology and cyber security roles
No law sets background checks for technology jobs as a class. Apart from the right to work check, which applies to every hire, the checks you run on developers, engineers and support staff are your choice, unless a client contract, such as government work needing BPSS, sets them. The Information Commission's (ICO) draft guidance on pre-employment vetting sets the test: vet only where the law requires it or the role carries significant and particular risks, such as theft or disclosure of trade secrets or commercially sensitive information, and only where there is no less intrusive alternative.
For most technology roles that means verifying identity and the employment history and qualifications the candidate gives you. Privileged access, such as system administration, is where a case for a basic criminal record check can arise, though NCSC guidance on privileged accounts concentrates on technical controls such as least privilege. Government contracts usually bring BPSS, and credit checks need a reason specific to the role.
Start with the risk, not the job title
The ICO describes pre-employment vetting as particularly intrusive and says you are unlikely to need it for many roles. Its examples of significant and particular risks include breaches of national security, risk of theft and disclosure of trade secrets or other commercially sensitive information, which is where technology roles usually sit. You should not routinely vet all candidates unless you are legally required to. The guidance is draft and under review following the Data (Use and Access) Act 2025.
Job titles in technology say little about access. A developer may have no route to production data, while a support analyst can reset any customer's password. Our view: write down what each role can reach (production systems, customer or personal data, payment systems, source code, security tooling) and choose checks for that access.
Identity and employment verification
Verification, in the ICO's terms, checks the information the candidate has given you, which is less intrusive than vetting. You must only obtain the minimum information you need: to verify identity, a passport or driving licence, but unlikely both. Where possible, verify only successful candidates, and explain the methods, the information you will check, how long you will keep it and any external sources early in the process.
Remote hiring makes the identity step matter. For right to work, the Home Office says documents must be genuine, original, unchanged and belong to the person. Our identity verification, employment references, CV verification and qualification verification pages explain each check.
Privileged access roles
NCSC guidance on identity and access management asks organisations to use a tiered model for administrative accounts, use full privileges only when absolutely necessary, enable multi-factor authentication for administrative accounts, give administrators separate accounts for day-to-day work, and regularly review and revoke unnecessary privileges. It also asks for a joiners, movers and leavers policy. Its secure system administration guidance says administrators do not have to be your staff, since system administration is often carried out by a third party supplier, and that administrators should have least privilege.
Screening adds assurance about the person; it does not replace those controls. For government services, the Government Digital Service's data security principles include a control to require regular vetting and background checks, particularly for people with privileged access to personal data. The National Protective Security Authority (NPSA), part of the Security Service, is the UK's National Technical Authority for physical and personnel protective security. Our view: its published personnel security advice is worth reading alongside this page if insider risk is a concern.
Our view: for a privileged role outside government, verification plus a basic criminal record check can be proportionate where you can name the risk, such as theft or disclosure of commercially sensitive data. Record that reasoning before you ask for the check.
Criminal record and credit checks
DBS says a basic check can be used for any position or purpose and shows unspent convictions and cautions. It is for jobs in England and Wales; Disclosure Scotland and AccessNI cover Scotland and Northern Ireland. Standard and enhanced checks depend on duties meeting the legislation, and most technology roles do not. One exception is moderating a public online interactive service likely to be used mainly by children, which can be regulated activity and eligible for an enhanced check with the children's barred list.
The ICO says processing criminal offence information for vetting will in most circumstances be high risk, so a data protection impact assessment is needed, and that you must only obtain disclosure for the person you intend to appoint. You must not carry out credit reference checks routinely or without justification. Our criminal record checks and credit checks pages go further.
Government contracts and BPSS
BPSS applies to everyone working within and for government, including contractors and suppliers, while any clearance above it is set by the department responsible for the post, and you do not need clearance to bid. Our BPSS and public sector pages explain more, including why advertising only for candidates who already hold clearance is discouraged.
Right to work for technology hires
A right to work check is the one check UK law expects for every hire, and since 1 October 2026 the scheme also covers some workers and individual sub-contractors, which matters where technology teams use contractors. The Home Office says you must not discriminate against anyone because of where they are from. Our right to work checks page explains the methods and the statutory excuse.
Role-based check matrix
A starting point. Adjust for what each role can actually access.
| Role or activity | Check | Basis |
|---|---|---|
| Every new hire | Right to work check before employment starts | Home Office guidance on checking a job applicant's right to work |
| Software developer without production or customer data access | Identity, employment history and qualification verification | ICO verification guidance (minimum information) |
| System administrator with privileged access | Verification; basic DBS where you can name the risk | ICO vetting guidance (risk of theft, commercially sensitive information); DBS basic check for any position |
| Security engineer with access to security tooling or incident data | Verification; basic DBS where you can name the risk | ICO vetting guidance; DBS basic check for any position |
| Data engineer or analyst with access to large volumes of personal data | Verification; basic DBS only for a named risk; regular vetting in government services | ICO vetting guidance; GDS principles for securing personal data |
| IT or customer support | Identity and employment verification | ICO verification guidance |
| Moderator of an online service mainly for children, more than 3 days in 30 | Enhanced DBS with children's barred list (England and Wales) | DBS eligibility guidance for regulated activity with children |
| Staff working on a government contract | BPSS; national security vetting only if the department sets it | BPSS Version 7.0; UKSV clearance levels guidance |
| Role controlling payments or financial systems | Credit reference check, only if justified and notified early | ICO vetting guidance on credit checks |
What to tell the candidate
- Tell candidates early which checks you will run, the methods, what you will verify, how long you will keep it and any external sources.
- Ask for criminal record information only for the person you intend to appoint, and only at the level the role justifies.
- Tell candidates as early as possible if you will run a credit check and what it involves.
- Give candidates the chance to explain any discrepancy, and consider their explanation before you decide.
- Never make a candidate obtain their own criminal record through a subject access request.
Sources
- Pre-employment vetting of candidates · ICO
- Verifying candidates · ICO
- 10 Steps to Cyber Security: Identity and access management · National Cyber Security Centre
- Secure system administration · National Cyber Security Centre
- About us: National Protective Security Authority · GOV.UK
- Principles for securing personal data in government services · GOV.UK (Government Digital Service)
- DBS checks guidance for employers, voluntary organisations and third parties · GOV.UK (Disclosure and Barring Service)
- Request a basic DBS check · GOV.UK
- Eligibility for roles not working specifically with adults or children · GOV.UK (Disclosure and Barring Service)
- Eligibility for Enhanced with Barred List DBS checks with children · GOV.UK (Disclosure and Barring Service)
- UK Government Baseline Personnel Security Standard, Version 7.0, June 2024 · GOV.UK (Cabinet Office)
- National security vetting: clearance levels · GOV.UK (United Kingdom Security Vetting)
- UKSV: Referee, Supervisor, Hiring Managers and Contractors · GOV.UK (United Kingdom Security Vetting)
- Checking a job applicant's right to work · GOV.UK
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
Checks by role
Required or expected
- Every new hire: a right to work check before employment starts.
- Most roles: verification of identity and of the employment history and qualifications the candidate gives you, for the successful candidate.
- Staff working within or for government, including contractors and suppliers: BPSS.
- People who moderate an online service used wholly or mainly by children on more than 3 days in 30: an enhanced DBS check with the children's barred list check (England and Wales).
Depends on the role
- System administrators, security engineers and others with privileged access to sensitive systems or data: a basic criminal record check, where you can name the risk.
- Roles with control over payments or financial systems: a credit reference check, if you can justify it for the role and tell candidates early.
- Posts the responsible government department says need clearance: national security vetting through UKSV.
Rarely justified
- Blanket criminal record or credit checks on all technology staff.
- Standard or enhanced DBS checks for developers or engineers with no eligible duties: they are not eligible, and knowingly requesting one is unlawful.
- Advertising only for candidates who already hold security clearance.
- Reviewing candidates' social media without a documented, role-specific risk.
Questions
Something else? Ask us.
Can we run a DBS check on every developer we hire?
Usually only a basic check, and only if the role justifies it. Developers rarely meet the criteria for standard or enhanced checks. The ICO says you should not routinely vet all candidates unless the law requires it, so tie any criminal record check to a named risk such as access to production systems or commercially sensitive data.
Do system administrators need more checks than other IT staff?
Often they justify more, because privileged access raises the risk of theft or disclosure. NCSC guidance for privileged accounts concentrates on controls: least privilege, separate admin accounts, multi-factor authentication and regular reviews. Screening sits alongside those controls, and a basic criminal record check can be proportionate where you have recorded the risk.
Do we need security clearance to bid for a government IT contract?
No. UKSV says you do not need national security clearance to bid for UK Government work and that requests for clearances must be raised during the contractual process. Staff working on the contract will usually need BPSS, which the employing organisation or its supplier completes.
Are content moderators eligible for an enhanced DBS check?
Sometimes. DBS says people who moderate a public online interactive service likely to be used mainly by children, such as a chatroom or forum, and who have access to the content and contact with users, can be in regulated activity if they do it on more than 3 days in a 30-day period. Moderating a general service does not make a role eligible on this ground.
Related checks
- Identity and address verification for employers What an employee identity check proves, how it differs from right to work, certified digital ID services, false documents and when to verify an address.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
- CV verification: checking employment history and handling discrepancies How to verify a candidate's CV and employment history fairly: gaps, HMRC records, discrepancies, the Fraud Act and what to record.
- Qualification checks: verifying degrees and professional qualifications How UK employers can verify degrees and professional qualifications fairly, which official routes exist, and when a qualification check is required.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- Credit checks on job candidates When a UK employer can justify a credit check on a candidate, how it differs from insolvency and director searches, and what to tell applicants.
- BPSS checks: the Baseline Personnel Security Standard explained Who needs BPSS, the four checks in version 7.0, the three-year employment history and gaps rule, and why BPSS is not SC or DV security clearance.
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- Social media checks on job candidates When a UK employer can review a candidate's public social media, what to tell them, who should look, and what to do with what you find.
Sector guides
- Pre-employment checks for the public sector and government suppliers BPSS, who decides on security clearance, checks for government suppliers, Civil Service nationality rules, police vetting and DBS levels for public roles.
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
- Background checks in security and facilities management SIA licensing under the Private Security Industry Act 2001, what the SIA checks, BS 7858 screening, and checks for facilities staff on sensitive sites.
Related answers
- How do employers carry out right to work checks? Before someone starts work, employers should carry out one of three prescribed checks: a manual check of original documents, a Home Office online check using a share code, or a check through a registered right to work digital verification service provider. Done correctly, it gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.
- Can employers monitor their staff? Yes, but the ICO says monitoring must be lawful, fair and transparent under data protection law. Employers need a clear purpose, a lawful basis, the least intrusive method that achieves it, and must tell workers about it. A data protection impact assessment is required for high-risk monitoring, and covert monitoring is justified only in exceptional circumstances.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.