When it comes to DBS checks, employers handle some of the most sensitive personal data available — including criminal record information. Under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, UK employers have strict responsibilities to ensure this data is stored, used, and deleted correctly. Mishandling such information can lead to legal penalties and damage to trust.

This article explains how employers can remain compliant when dealing with GDPR & DBS Data, ensuring fair treatment and lawful processing.Understanding the Link Between GDPR and DBS Data

The Disclosure and Barring Service (DBS) provides criminal record information to help employers make safer recruitment decisions. However, because DBS certificates contain personal and sometimes sensitive details, they fall under special category data in GDPR terms.

Employers must therefore:

Process DBS data lawfully and fairly.
Store it securely and confidentially.
Keep it only for as long as necessary.

Every stage of handling DBS data — from receiving results to storage and disposal — must comply with the GDPR principles of data minimisation, accuracy, and integrity.

How Employers Should Store DBS Information

Once a DBS certificate is received, employers should store it securely and restrict access only to authorised staff involved in recruitment or safeguarding. Best practices include:

Keeping DBS certificates in locked cabinets or encrypted digital storage.
Ensuring limited access controls — only HR or compliance officers should handle them.
Avoiding unauthorised copying or scanning unless absolutely necessary.

Employers should never store DBS data indefinitely. The DBS Code of Practice advises that a copy or note of a DBS certificate should be kept no longer than six months, unless there is a valid legal reason to retain it for longer.

Using DBS Data Responsibly

DBS information should only be used for the specific purpose it was obtained — usually for assessing suitability for employment or voluntary work.

Employers must never use DBS data for unrelated activities, marketing, or internal profiling. Additionally, decisions based on DBS results should always be proportionate and fair, taking into account the nature of the role and any spent convictions under the Rehabilitation of Offenders Act 1974.

Transparency is essential. Candidates should be informed about:

Why their data is being collected.
How it will be used.
How long it will be retained.

Deleting and Disposing of DBS Data

When DBS data is no longer needed, it must be securely destroyed to prevent unauthorised access or misuse. Employers should:

Use cross-cut shredders for paper copies.
Employ secure digital deletion tools for electronic files.
Record the deletion date and method for audit purposes.

Under GDPR, individuals have the right to request deletion of their personal data, which employers must comply with unless there is a legal obligation to retain it.

Why GDPR Compliance Matters

Failure to comply with GDPR & DBS Data rules can result in substantial fines from the Information Commissioner’s Office (ICO) and reputational harm. More importantly, maintaining compliance shows a commitment to safeguarding and respect for employee privacy.

For more information or to start a DBS check process, visit CRBDirect.org.uk.

FAQs

1. Can employers keep copies of DBS certificates?
Employers can keep a copy for up to six months but should destroy it once the retention period expires unless there’s a justified reason to retain it longer.

2. Is consent required to process DBS data?
Yes. Employers must inform candidates and obtain consent before processing their DBS information.

3. How should digital DBS data be stored?
It should be stored in encrypted formats with restricted access and proper cybersecurity measures.

4. What happens if DBS data is breached?
A data breach involving DBS information must be reported to the ICO within 72 hours and to the affected individuals if there’s a high risk to their rights.

Properly handling GDPR & DBS Data is not just a legal requirement — it’s a sign of professionalism and trustworthiness in any UK organisation.