Background checks: what a UK employer may lawfully check, and when

Most background check problems do not start with a bad candidate. They start with a form. Somebody built a pre-employment checklist years ago, every new hire now goes through all of it, and nobody can say which job requirement each item is attached to. That is the condition in which an employer asks for a criminal record check the role does not qualify for, reads a candidate's holiday photographs, and keeps the results on file indefinitely.

This article sets out what a UK employer may lawfully check before and after an offer, the three levels of criminal record check and who is eligible for each, which convictions a candidate never has to disclose, how to handle social media screening without creating a discrimination claim, what a previous employer may say in a reference, and what an employment verification or proof of employment letter should contain. Every rule is quoted from GOV.UK, the ICO or Acas and linked where it is used.

If you want the checks, the offer conditions and the start date sitting on one visible path rather than in three inboxes, see how New Dynamics onboarding handles a task that has to be finished before somebody starts.

The principle that governs all of it

There is one test that decides whether a check is defensible, and it is not whether the information was easy to get.

The ICO's guidance on pre-employment vetting of candidates puts it as a threshold question. You "should only do pre-employment vetting where you are under a legal obligation (eg to perform right to work checks), or you can identify significant and particular risks". The examples it gives of such risks are serious: breaches of national security, unsuitable people working with vulnerable groups, danger to others, theft, or the disclosure of trade secrets.

Then it closes the obvious loophole. "You should not routinely vet all candidates, unless you are legally required to do so." And where you do vet, "you must ensure that it's justified in the circumstances and there are no less intrusive alternatives".

Read those three sentences together and a background check stops being a stage of recruitment and becomes a decision you have to justify per role. A finance controller who authorises payments and a weekend warehouse picker do not get the same screening, because the risks attached to the two jobs are not the same. Curiosity about a candidate, or a vague wish to "know who we are hiring", is not a risk connected to a job.

Transparency is not optional either. "You must inform candidates if you intend to use pre-employment vetting as part of your recruitment process", and the ICO expects that to cover what information you need, why, who will see it, how long you will keep it and, where possible, the third party sources you will rely on.

Before the offer and after it

Two checks sit before everything else because they are duties rather than choices.

Right to work. This one applies to every worker you employ, not to the candidates whose names prompted a second thought. It has to be completed before employment begins, and the method depends on the person's status. Our guide to the share code right to work check covers the three prescribed check types, the 90-day code validity and the records that give you a statutory excuse.

Identity. You cannot sensibly verify anything else about a person until you are satisfied they are the person in front of you.

Almost everything else belongs after a conditional offer. The reason is practical as much as legal: screening earlier means collecting information about people you are not going to hire, which the ICO's necessity test makes hard to justify, and it lets irrelevant facts reach the people making the selection decision. Acas takes the same line on references, advising that it is "best to ask for a reference at the final stage of the recruitment process when making a job offer".

Medical and health questions deserve a separate mention. Treat questions about health as something you ask once a job offer is on the table and only where there is a genuine need connected to the role, such as a statutory fitness requirement or a reasonable adjustment to put in place.

DBS checks: three levels, and who may ask for which

In England and Wales, criminal record checks go through the Disclosure and Barring Service. GOV.UK's page on checking someone's criminal record as an employer describes what each level shows.

Basic

A basic check "shows unspent convictions and conditional cautions". This is the level nearly every ordinary job qualifies for. The DBS guidance for employers is unambiguous about its scope: "The Basic check can be used for any position or purpose."

Standard

A standard check "shows spent and unspent convictions and cautions". Eligibility is narrow. GOV.UK's guidance on DBS check requests for employers says the standard check "is available for duties, positions and licences included in the Rehabilitation of Offenders Act (ROA) 1974 (Exceptions) Order 1975, for example, court officers, employment within a prison, and Security Industry Authority (SIA) licences".

Enhanced

An enhanced check "shows the same as a standard check plus any information held by local police". It is available only for specific duties and positions listed in both the Exceptions Order and the Police Act 1997 regulations, "for example, regularly caring for, training, supervising or being solely in charge of children". Where a barred list check applies, an enhanced check with barred lists also shows "whether the applicant is on the list of people barred from doing the role".

Now the part that catches employers out. Access to the higher levels is restricted by law, not by preference. The same guidance states that access to standard, enhanced and enhanced with barred list checks "is only available to employers who are entitled by law to ask an individual to reveal their full criminal history", and then says what happens if you reach past that entitlement: "Knowingly requesting a higher-level check than the legislation allows is unlawful and could be a breach of the Data Protection Act 2018 and other relevant legislation."

So an enhanced check is not an upgrade you buy for peace of mind on an office role. If the position is not in the legislation, the basic check is your ceiling.

Two more points from the same GOV.UK pages are easy to miss. If you run criminal record checks at all, "you must have a policy on employing ex-offenders and show it to any applicant who asks for it". And if you are "hiring a self-employed person or 'personal employee' to deliver services to you or a member of your family, you cannot request a DBS check for them".

The ICO adds a data protection step on top. Criminal offence information is sensitive, and in most circumstances processing it for vetting "will be high risk", which means "you must carry out a data protection impact assessment (DPIA) in these circumstances". It also says you should only obtain a criminal records disclosure for the person you intend to appoint, not for a shortlist.

Spent, filtered and protected: what a candidate need not tell you

A criminal record is not a permanent disclosure obligation, and an employer who treats it as one is asking questions it is not entitled to ask.

GOV.UK's guidance on telling an employer about a criminal record explains the two gates. On unspent records: "You only need to tell an organisation about an unspent conviction or caution if they ask you to." On spent records, a candidate has to disclose only where all three of these apply: the employer asks, the employer tells them the role needs a standard or enhanced DBS check, and the record has not been removed, which the guidance calls being "filtered".

That is because a spent conviction or caution "will only show up on a more detailed DBS check known as 'standard' or 'enhanced', unless it's removed ('filtered')". Filtering removes older and less serious records from standard and enhanced certificates altogether. The DBS filtering guide sets out the rules, including that youth cautions, warnings and reprimands "will not be disclosed automatically", with youth conditional cautions excepted.

There is a hard limit on filtering. The guide notes that there is "a list of offences that will always be disclosed on a Standard or Enhanced DBS certificate (unless they relate to a youth caution)", and that these are "usually of a serious violent or sexual nature, or are relevant for safeguarding children and vulnerable adults". Custodial sentences are also always disclosed.

The practical consequence for an employer is that a filtered or protected conviction is one you are not entitled to know about and must not take into account. The filtering guidance is clear that an employer who takes account of a conviction or caution that would not have been disclosed is acting unlawfully. So blanket application questions of the "have you ever been convicted of anything" variety are a liability, and should be replaced with a question scoped to the check the role actually qualifies for.

Social media screening: the part most employers get wrong

This is the check with the widest gap between common practice and the published guidance.

Acas is direct. Its page on using information on someone's social media profile when hiring advises employers to "avoid using information that's on someone's personal social media profile to decide whether you interview or hire them". It then names the two circumstances that turn it into a legal problem: you might be breaking the law "particularly if either of the following points apply: they did not agree to you using the information in this way" or "you looked at some applicants' social media profiles, but not others".

That second point is the one that undoes an informal process. Searching for the candidates whose names or photographs prompted a look, and not the others, is inconsistent treatment on the face of it.

Acas does draw a line between personal and professional platforms. "You can usually use information that someone puts on a jobs website. You can also use information from a business and employment social networking site such as LinkedIn", because "users will be aware that the purpose of these sites is to show their work experience and professionalism". Even there, it adds, "you must still make sure that you use this information in a way that does not discriminate".

The ICO sets out how to do it properly where you can justify it at all. If you want to check public social media profiles, "you must be able to justify why this is necessary", and "as your vetting processes must be transparent, you must inform candidates if you intend to use social media". It then separates the roles: "the staff members who research the candidate's social media profiles should not also make the recruitment decisions about them."

It also names the real risk, which is not what you went looking for but what you cannot help seeing. "In doing these checks, you are also likely to find information that is not relevant to the role. It's important that you carry out these checks fairly." A personal profile tends to reveal age, ethnicity, religion, relationship status, pregnancy, disability, political opinions and sexual orientation. Several of those are protected characteristics under the Equality Act 2010. Once a decision maker has seen them, you have lost the ability to show that they played no part in the decision, which is exactly the position you do not want to be in at a tribunal.

Two further ICO rules close the loop. Intrusive and covert searching is out: "it's unlikely to be lawful, appropriate or necessary to conduct intrusive or targeted checks of candidates on social media or online (eg by using specialist software to check information that is not publicly available)." And a candidate gets a say: "you should give the candidate an opportunity to provide further information or comment on the accuracy of the information you have obtained", because "it is unlikely to be fair and lawful to make a decision about the candidate based on this information alone".

So, to answer the question people actually search for: a formal background check does not pull your social media accounts. A human being in the hiring team might look at them anyway, and that look is the part that needs a justification, a disclosure and a separation of duties.

References: what the previous employer may say

References are the check employers rely on most and understand least, largely because the duty to give one barely exists.

Acas's guidance on what employers can say in a reference explains that an employer "does not have to give a reference by law" unless it is "in writing that the employer will provide one", for example in an employment contract, or the role is one of certain financial services jobs regulated by the Financial Conduct Authority or the Prudential Regulation Authority, or it has been agreed in some other way such as a settlement agreement.

What you will usually get is a basic reference, which Acas describes as "a short summary of employment", sometimes called "a factual reference". It confirms job title and dates and little else.

A detailed reference may go further. Acas says it can include job title and dates of employment, "details about their skills, ability and experience", any current and relevant disciplinary records, and the reasons for leaving. The constraints matter as much as the contents. "If an employer gives a reference it must be accurate and fair." A reference must not "be misleading" or "include irrelevant personal information", and where opinions are given "there should be evidence to support the opinion". It must not reveal absences related to disability or to parental rights such as maternity or paternity leave, and the employer giving it "should not include any information that could be used in a discriminatory way".

If you are on the receiving end, treat a bare factual reference as normal rather than as a signal. For what a useful reference actually looks like, see our job reference examples.

Employment verification and proof of employment letters

The same conversation runs in the other direction several times a year. A mortgage lender, a letting agent, a visa application, a loan provider or a prospective employer asks you to confirm that one of your people works for you.

A letter of employment, also called an employment verification letter, a proof of employment letter or an employment verification statement, is a short written confirmation of the facts of someone's employment. It typically contains your organisation's name and letterhead, the employee's name and job title, their start date and whether employment is continuing, the type of contract such as permanent or fixed term, and the name, role and contact details of the person signing. Where income has been asked for and the employee has agreed to it, an employee income verification letter adds the current salary or the pay basis, and sometimes a statement of whether pay is likely to continue. Keep it factual. A verification letter is not a reference and should not contain an opinion about performance.

Two points that cause most of the trouble.

You are generally not obliged to provide one. The reference position carries across: unless a contract, a settlement agreement or a sector regulator requires it, confirming employment to a third party is a courtesy you choose to give. Many employers decide to give a basic confirmation to everyone, on request, and nothing more. Writing that down as a policy is better than deciding case by case, because case by case is how one employee gets a warm letter and another gets a terse one.

The request is a data protection event. A third party asking about your employee is asking you to disclose that person's personal data. Before you answer, confirm who is actually asking, confirm that the employee has asked you to respond or has otherwise consented, send only the fields that were needed for the stated purpose, and send it to an address you have verified rather than the one in the incoming email. Income is the field to be most careful with. If the employee asked only for confirmation of employment, do not volunteer their salary.

A simple rule works: the employee requests the letter, you write it, and you give it to the employee to pass on. That removes most of the risk of disclosing to someone who had no right to ask.

Timing, and writing a conditional offer that holds

Checks and offers have to be sequenced deliberately, because an offer made in the wrong form cannot be unwound when a check comes back badly.

Acas's guidance on offering someone a job sets out the mechanism. A job offer letter should say "whether it's a 'conditional job offer'" and what conditions the candidate must meet, for example suitable references or criminal record checks. If the conditions are there, "you can withdraw the job offer if the applicant did not meet the offer's conditions". If they are not, you are in a different position entirely: "if you did not include any conditions as part of the job offer, it's known as an unconditional job offer. Withdrawing it could be against the law." Either way, "you should tell them the reasons you're withdrawing the offer".

An offer that says "subject to satisfactory background checks" is doing far less work than the person who wrote it assumes. Name the checks instead. List each one, say who arranges it, say what the role actually requires, and say what will happen if a check returns something adverse: that you will put it to the candidate, consider their explanation, and take a decision on relevance to the job rather than treating any record as automatically disqualifying. That last sentence is what turns an adverse result into a conversation rather than a withdrawn offer and a tribunal claim.

Also tell candidates how long it will take. Checks run on other organisations' timetables, and a start date that quietly depends on a check nobody has chased is the most common way an onboarding plan slips.

Record keeping: hold the decision, not the dossier

The ICO is firmer on deletion than most retention schedules are. Vetting information "must not" be retained "for longer than is necessary", and the guidance says that will often mean you "should securely and permanently destroy personal information obtained for vetting purposes once the recruitment process has taken place". Where something has been obtained and is no longer needed, "you must securely and permanently destroy it as soon as it is reasonably practicable to do so".

In practice that gives you three different retention answers for one hire. Right to work evidence has its own prescribed period, employment plus two years, and that period ends in deletion rather than in indefinite storage. Criminal record certificate content should not be copied into your HR system at all in most cases; record that the check was done, at what level, on what date, by whom, and the outcome you acted on. Everything gathered about candidates you did not hire should go shortly after the process closes.

Write those periods down and make them fire. Our post on employee records retention sets out how to build a schedule that actually deletes, and which periods are fixed by statute rather than by judgement.

Jurisdiction and limits

This article covers the United Kingdom. The Disclosure and Barring Service covers England and Wales. Criminal record checks in Scotland go through Disclosure Scotland, and in Northern Ireland through AccessNI, and both have their own levels, eligibility rules and application routes, so a policy written around DBS terminology will not transfer unchanged to a Scottish or Northern Irish site. GOV.UK notes that there are different rules for getting criminal record checks in Scotland and in Northern Ireland.

This is general information rather than legal advice. Vetting touches data protection law, the Rehabilitation of Offenders Act, the Equality Act and sector regulation at the same time, and the right answer depends on the role and your circumstances. Take advice before you withdraw an offer on the strength of a check, before you build criminal record questions into an application form, and before you introduce any screening of candidates' online activity. Work from the current GOV.UK, ICO and Acas pages rather than from a saved copy or an internal wiki.

Frequently asked questions

What is a background screen, and what can an employer check?

A background screen is the set of checks an employer runs to confirm that a candidate is suitable for a particular role, which can cover identity, right to work, employment history, qualifications, professional registration, criminal records and, for some roles, financial history. What you may check is not a fixed list. The ICO says you should only vet where you are under a legal obligation or "you can identify significant and particular risks", and that you "should not routinely vet all candidates, unless you are legally required to do so". Our wider explainer on background screening covers the categories in more detail.

What is a DBS check for employees, and which level do we need?

A DBS check is a criminal record check in England and Wales, at one of three levels. GOV.UK describes a basic check as showing "unspent convictions and conditional cautions", a standard check as showing "spent and unspent convictions and cautions", and an enhanced check as showing the same as a standard check "plus any information held by local police". Most roles qualify only for a basic check, which "can be used for any position or purpose". Standard and enhanced checks are limited to positions listed in legislation, and GOV.UK states that "knowingly requesting a higher-level check than the legislation allows is unlawful".

Do background checks show social media?

No. A formal background check does not search a candidate's social media accounts. What happens instead is that somebody in the hiring team looks, and that look is what needs controlling. The ICO says that if you want to check public profiles you "must be able to justify why this is necessary" and "must inform candidates if you intend to use social media", and that whoever researches the profiles "should not also make the recruitment decisions about them". Acas advises employers to avoid using a personal profile to decide who to interview or hire.

What does 'consider' mean on a background check?

It is a status used by some commercial screening providers, mostly in the United States, and it is not a term used by the Disclosure and Barring Service or in UK law. It means the report has returned something that a human being needs to look at against the employer's own criteria, rather than a clear result. It is not a rejection and it is not a finding of unsuitability. If you see it, the next step is to look at what the record actually is, how old it is and whether it has any bearing on the job, and to put it to the candidate before you decide anything.

What is a letter of employment, and do we have to provide one?

A letter of employment, also called a proof of employment or employment verification letter, is a short factual confirmation that someone works for you. It normally gives the employee's name, job title, start date, whether employment is continuing, the contract type and a named contact, and it adds salary only where income verification was requested and the employee has agreed to that. You are generally not obliged to provide one, in the same way that Acas says an employer "does not have to give a reference by law" unless a contract, a regulator or an agreement requires it. The safer route is to give the letter to the employee to pass on, rather than sending it to a third party yourself.

Can we withdraw a job offer after an adverse check?

It depends on how the offer was written. Acas says "you can withdraw the job offer if the applicant did not meet the offer's conditions", but warns that where no conditions were set, "it's known as an unconditional job offer" and "withdrawing it could be against the law". Either way "you should tell them the reasons you're withdrawing the offer". Name each check in the offer letter, and before acting on an adverse result, put it to the candidate and consider its relevance to this particular job rather than treating any record as automatic grounds for withdrawal.

Your next step: one screening standard per role family

1. List every check you currently run, and write the job requirement each one is attached to. Delete any check with no requirement beside it.
2. Group your roles into families, and set one screening standard per family rather than per hire.
3. Confirm the DBS level each family is actually eligible for, and reduce anything that was set higher than the legislation allows.
4. Rewrite your application form's criminal record question so it is scoped to the check the role qualifies for, and publish your policy on employing ex-offenders.
5. Decide in writing whether you screen social media at all. If you do, disclose it to candidates, apply it to everyone in the role and keep the searcher out of the decision.
6. Replace "subject to satisfactory background checks" in your offer template with the named checks, the timescales and what happens if one comes back adverse.
7. Set a retention period and a deletion owner for each category of check evidence, and put a standard proof of employment letter in your templates so nobody improvises one.

For the wider process these checks sit inside, including shortlisting, interviewing and consistent decision records, read our recruitment and selection guide.

Want the offer conditions, the named checks, the chaser and the deletion date on one path, so no start date depends on a check nobody has looked at? Book a New Dynamics demo and bring your current pre-employment checklist. You can also email contact@new-dynamics.com.