DBS Checks: What UK Employers Need to Know

DBS checks sit in that awkward corner of hiring where most UK employers know they probably need them for some roles, rarely know which level applies, and often ask for the wrong one out of caution. Get it wrong and you either breach data protection law by running a check you were not entitled to, or you miss something material about a candidate and find yourself explaining it to a regulator later.

This guide walks through what the Disclosure and Barring Service actually does, when you are legally allowed to request a check, how to pick the right level, how to handle the results, and what has changed for 2026. It is written for HR managers, office managers, and SME owners in England and Wales. If you hire in Scotland or Northern Ireland the equivalent bodies are Disclosure Scotland and AccessNI, and the rules are similar but not identical.

What a DBS check actually is

The Disclosure and Barring Service is the executive agency of the Home Office that processes criminal record checks for employers and licensing bodies. A DBS check returns information about a candidate's criminal history, and in some cases whether they are barred from working with children or vulnerable adults.

There are four levels of check. You do not get to pick freely. The level you are allowed to request depends on the role, and eligibility is set by law under the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 and the Police Act 1997.

The four levels

Basic DBS check. Shows unspent convictions and conditional cautions only. Any employer can request this for any role, with the candidate's consent. Costs 21.50 pounds as of 2026.

Standard DBS check. Shows spent and unspent convictions, cautions, reprimands and warnings, subject to the filtering rules. Only available for specific roles listed in the Exceptions Order, typically roles involving significant trust such as solicitors, accountants, and some financial services positions. Costs 21.50 pounds.

Enhanced DBS check. Same as standard, plus any additional information held by local police that is considered relevant. Available for roles working with children or adults at risk, or certain licensing and regulated activities. Costs 49.50 pounds.

Enhanced with barred lists check. Enhanced check plus a search of the children's barred list, the adults' barred list, or both. Only available for roles that involve regulated activity as defined by the Safeguarding Vulnerable Groups Act 2006. Costs 49.50 pounds.

The fees are set by the DBS and reviewed periodically. Volunteers can receive free checks for enhanced and standard levels where the role meets the definition of a volunteer under DBS rules.

When you can legally request a DBS check

This is where most employers trip up. You cannot request a standard or enhanced check just because you feel safer doing so. The role itself must be eligible. Running a check for an ineligible role is a criminal offence under section 123 of the Police Act 1997 and a breach of Article 10 of the UK GDPR on processing criminal offence data.

Use the DBS eligibility tool on gov.uk before you decide. As a rough guide:

• Basic: any role, any time, with consent.
• Standard: regulated professions, financial services with specific responsibilities, certain legal and accountancy roles.
• Enhanced: teachers, social workers, healthcare professionals, care workers, childminders, taxi and private hire drivers, some security roles.
• Enhanced with barred lists: anyone in regulated activity with children or adults at risk, including unsupervised work in schools, care homes, and healthcare settings.

If you hire into the care sector, most frontline roles will need enhanced with adults' barred list at a minimum. Our guide to employment law for UK care sector employers covers the wider regulatory framework you will need to meet alongside the DBS requirement.

How to request a check

You have two routes.

Direct through DBS (basic only)

For basic checks you can ask the individual to apply directly through the DBS website, or you can apply on their behalf as a registered body. Most SMEs do the former and ask the candidate to share their certificate.

Through a Registered Body or Umbrella Body

For standard and enhanced checks you must go through a Registered Body. Small employers typically use an umbrella body, which is a commercial organisation that processes checks on your behalf. There are dozens of providers. Look for one that supports online ID verification, has fast turnaround times, and offers batch processing if you hire in volume.

The application process

1. Confirm the role is eligible for the level of check you want. Document this decision.
2. Obtain written consent from the candidate on the appropriate DBS application form.
3. Verify the candidate's identity against the required documents, usually three documents including one photo ID and one proof of address.
4. Submit the application via your Registered Body or umbrella body.
5. Wait for the certificate, usually 5 to 14 days for basic and standard, longer for enhanced.

The certificate is issued to the applicant, not to you. You will need to see the original or a verified digital copy. Do not accept a photocopy alone, as it tells you nothing about whether information has been redacted.

When to run the check

Timing matters. The Rehabilitation of Offenders Act 1974 restricts how and when you can ask about criminal records. For most employers, the practical rule is:

• Do not ask about criminal convictions on application forms for roles outside the Exceptions Order.
• Make any offer of employment conditional on a satisfactory DBS check where the role requires one.
• Run the check after offer, before start date where practical.
• For existing staff, run checks at role change, at regulator-mandated renewal intervals, or where you have reasonable grounds.

Do not start someone in a regulated activity role before the enhanced check returns clean. In sectors like care and education, starting an employee before the check is complete can breach your sector regulator's fit and proper person rules and, in the worst case, invalidate your registration.

Handling the results

Most checks return clean. When they do not, the response has to be proportionate and documented.

Clean certificate

Record that you have seen the certificate, note the reference number and date, and retain evidence that the check was completed. Do not keep the certificate itself beyond the six month retention period recommended by the DBS Code of Practice, unless there is a specific regulatory reason to do so.

Certificate with content

You are required to consider the information in light of the role. The DBS Code of Practice requires you to have a written policy on the recruitment of ex-offenders and to follow it. A blanket rule that any conviction disqualifies any candidate is not defensible.

Ask yourself:

• Is the offence relevant to the role?
• How long ago did it happen?
• Has there been a pattern of behaviour or a single incident?
• What explanation does the candidate offer?

Give the candidate the opportunity to discuss the disclosure before making a final decision. Document your reasoning, because if you withdraw a conditional offer you may need to defend the decision in a tribunal claim for discrimination or breach of contract.

Disputed information

If the candidate believes the certificate is wrong, they have the right to dispute it with the DBS. Do not make a final decision until that dispute is resolved, provided the timeline is reasonable.

The DBS Update Service

The Update Service is a subscription that allows individuals to keep their certificate current. They pay 16 pounds a year (13 pounds for standard, free for volunteers), and employers can check the status online with the candidate's consent rather than running a fresh check every time.

For employers who hire the same people repeatedly (supply teachers, locum care workers, contractors) the Update Service is a no-brainer. It reduces admin, reduces cost, and means you can verify status in minutes rather than weeks.

To check an Update Service status you need:

• The candidate's consent.
• Their full name as it appears on the certificate.
• Their date of birth.
• Their certificate number.

Run the check on the DBS website. It returns one of three results: no change, new information, or certificate no longer valid. Act accordingly.

Data protection and retention

A DBS certificate is criminal offence data under Article 10 UK GDPR and section 10 of the Data Protection Act 2018. You must have a lawful basis to process it, meet one of the conditions in Schedule 1 DPA 2018, and have an appropriate policy document in place setting out your retention and handling arrangements.

Practical rules:

• Store certificates securely, restrict access to those who need it.
• Do not copy or scan the certificate unless your retention policy allows it.
• Destroy records once the retention period has ended, usually six months.
• Include DBS handling in your privacy notice to employees.

The ICO takes a dim view of employers who hold DBS information longer than necessary, and has issued fines for poor handling. Treat it the same way you treat payroll data.

What has changed in 2026

Two practical shifts matter this year.

Digital ID verification is now the default. Most umbrella bodies offer IDSP (Identity Service Provider) integration, which allows candidates to verify identity on their phone using facial recognition against a passport or driving licence. Turnaround times have dropped as a result. If your provider still requires in-person document checks, ask why.

Barred list scope is under review. The government consulted in late 2025 on widening the definition of regulated activity to include some roles currently outside the barred list check, particularly in private tuition and sports coaching. No changes have taken effect yet, but watch for statutory instruments later in 2026.

The Employment Rights Act 2025 did not directly change DBS rules, but the broader framework for fair treatment at work has tightened. Decisions to withdraw offers based on disclosed convictions will face more scrutiny under the enhanced protections coming in from April 2026 onwards. Our ERA 2025 employer guide covers the wider context.

Common mistakes UK employers make

From the cases that reach tribunals and ICO investigations, a few patterns come up repeatedly.

1. Running the wrong level. Requesting enhanced when only basic is lawful. This is the most common breach.
2. Running checks too early. Asking about criminal history before offer, outside Exceptions Order roles.
3. Blanket disqualification. Rejecting any candidate with any conviction without individual consideration.
4. Retaining certificates indefinitely. Stuck in a filing cabinet five years after the person started.
5. No written policy. No policy on recruitment of ex-offenders, no documented decision-making, no defence when a claim lands.
6. Not verifying ID properly. Accepting photocopies or rushed verification, which undermines the integrity of the whole check.

Tighten your employment contract and onboarding process so DBS handling is built in from the start, rather than bolted on after offer.

Pulling it together

A DBS check is a small part of a larger hiring compliance picture. You also need right to work checks, referencing, and where relevant professional registration checks. Our right to work checks guide covers the parallel Home Office process, and our employer reference guide walks through referencing obligations.

If you want a view of your whole hiring compliance position, not just DBS, run our free EmployerKit audit. It flags gaps in your onboarding process, documentation, and policy framework in about five minutes. Useful before you hire your next person, and essential if you have not reviewed your process since the ERA 2025 changes landed.

Frequently asked questions

Q: Can I ask a candidate about their criminal record on the application form?

A: Only if the role sits within the Exceptions Order. For all other roles, the Ban the Box principle applies in practice: do not ask at application stage, and only ask after conditional offer where the role justifies it. A blanket question at application stage risks indirect discrimination claims.

Q: How long does a DBS check last?

A: A DBS certificate has no formal expiry date. The information is accurate on the day it is issued. Most employers treat a certificate as current for three years for lower risk roles, and renew annually or subscribe to the Update Service for regulated activity roles. Check your sector regulator's rules, as care, education, and taxi licensing all have specific renewal requirements.

Q: Can I run a DBS check on an existing employee?

A: Yes, but only with their consent, and only if the role is eligible. You cannot force an existing employee to consent. If the role moves into regulated activity (for example, following a restructure) a refusal to consent may give you grounds for action, but take advice before you go there.

Q: What do I do if a DBS certificate shows a conviction?

A: Consider the nature of the offence, the time elapsed, and the relevance to the role. Discuss it with the candidate. Decide in line with your policy on recruitment of ex-offenders. Document your reasoning. Do not automatically withdraw the offer. Be aware that discrimination protections and data protection rules both apply.

Q: Do I need to run a DBS check on agency workers or contractors?

A: The legal duty sits with the employer of record, usually the agency or the contractor's own company. That said, if the role involves regulated activity you should ask for confirmation that a check has been done at the correct level, and see the certificate or Update Service confirmation. Relying on an agency's assurance without evidence is a weak position if something goes wrong.

Q: Is it worth signing staff up to the DBS Update Service?

A: For roles with recurring or renewing DBS requirements, yes. The subscription is cheap, status checks are instant, and you avoid the pain of running fresh enhanced checks every year or two. For one-off roles with no expected renewal, a single certificate is usually enough.