DBS checks for employers: which check, who is eligible, and how to handle the result

A DBS check is a criminal record check from the Disclosure and Barring Service for jobs in England and Wales. There are four levels: a basic check (unspent convictions and cautions, available for any job), a standard check (spent and unspent records, subject to filtering), an enhanced check (the standard content plus relevant local police information) and an enhanced check with a search of the children's or adults' barred lists. Only roles named in law can have the higher levels. As of October 2026, GOV.UK lists the fees as £20, £20, £41 and £41, and Scotland and Northern Ireland use their own disclosure bodies.

This page complements UK right to work checks, which is about immigration status rather than criminal records, and the US FCRA background check process, which works very differently.

What are the four levels of DBS check?

Source: DBS's guidance for employers, last updated 5 October 2026 with the latest fee change. DBS also offers an Adult First check (£6), a fast search of the Adults' Barred List that can let someone start work with vulnerable adults under supervision while the full certificate is pending.

Which roles are eligible for a standard or enhanced check?

Higher-level checks depend on the employer being entitled to ask "an exempted question", meaning the law lets it ask about spent convictions. GOV.UK puts it this way: access is "only available to employers who are entitled by law to ask an individual to reveal their full criminal history", for roles covered by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975, and for enhanced checks also the Police Act 1997 criminal records regulations. The same guidance warns that "knowingly requesting a higher-level check than the legislation allows is unlawful and could be a breach of the Data Protection Act 2018".

In the Police Act itself, a standard certificate application must be countersigned by a registered person with a statement "that the certificate is required for the purposes of an exempted question" (section 113A). That is why standard and enhanced checks run through a DBS-registered body or an umbrella body, while a basic check can be requested by the candidate directly. Other rules from the guidance:

• The minimum age to be asked to apply is 16.
• For a basic check, the employer can ask the candidate to apply to DBS (England and Wales) or Disclosure Scotland, or use a Responsible Organisation with the candidate's consent. The basic check service says processing usually takes up to 3 days and a paper certificate is posted.
• DBS cannot see criminal records held overseas, so a check may be incomplete for anyone who has lived outside the UK.

What are the barred lists, and what happens if I use a barred person?

The Children's and Adults' Barred Lists name people barred from "regulated activity" with those groups. Under section 9 of the Safeguarding Vulnerable Groups Act 2006 it is an offence to permit someone to engage in regulated activity from which they are barred, knowing or having reason to believe they are barred. Section 9(2) creates a separate offence for a "personnel supplier", such as a staffing agency, that supplies a person knowing or having reason to believe they are barred and will be placed in that activity. The maximum penalty on indictment is five years' imprisonment, a fine, or both.

Regulated activity providers also have a duty to refer: if they withdraw permission for someone to do regulated activity because they think the person has harmed or poses a risk of harm to a child or vulnerable adult, or would have done so had the person not left, they must give DBS the prescribed information (section 35). Both sections extend to England and Wales.

What gets filtered from a standard or enhanced certificate?

For certificates issued from 28 October 2023, DBS's filtering rules say standard and enhanced certificates always include:

• all convictions for specified offences;
• adult cautions for specified offences;
• all convictions that resulted in a custodial sentence.

Other records are included only if recent:

Anything still unspent also appears. Everything else is "protected" and does not appear automatically, though an enhanced certificate may include protected information if the police consider it relevant to the workforce, under statutory guidance. A candidate answering an exempted question does not have to disclose protected cautions or convictions either, so ask questions that match the filtering rules.

Does a DBS certificate expire, and how does the Update Service work?

The employer guidance is direct: "There is no official expiry date for a criminal record check issued by DBS." The certificate is accurate on its date of issue, some sectors require periodic re-checks, and the employer decides whether to accept a previously issued certificate, checking that its level and workforce (child, adult, both or other) fit the new role and that the identity details match.

The DBS Update Service, as of October 2026:

• covers standard and enhanced certificates only;
• costs the applicant £15 a year (free for volunteers);
• must be joined within 30 days of the certificate being issued;
• lets an employer run a free online status check, if it is legally entitled to that level of check and has the worker's permission, and see the result straight away.

For agencies that redeploy the same temps across clients, this is the main way to avoid paying for a new enhanced check every assignment, provided the workforce and level match.

How should employers store and use DBS information?

Registered bodies must follow the DBS code of practice issued under section 122(2) of the Police Act 1997. According to the employer guidance, certificate information should be "considered only for the purpose for which it was obtained, and should be destroyed after a suitable period has passed - usually no longer than 6 months", and should be used only in the context of a policy on recruiting ex-offenders. Refusing to employ someone because of a spent conviction is unlawful under the Rehabilitation of Offenders Act 1974 unless the role is exempt.

Under UK GDPR, criminal record information is "criminal offence data". The ICO's guidance says a private employer needs a lawful basis under Article 6 and a specific condition in Schedule 1 of the Data Protection Act 2018 (employment is one), often an "appropriate policy document", is more likely to need a data protection impact assessment, and specific wording in its privacy information. Our GDPR checklist for recruiters covers the rest of the candidate data lifecycle.

What about jobs in Scotland and Northern Ireland?

GOV.UK notes that someone living in Scotland or Northern Ireland can still get a basic DBS check if the job is in England or Wales; the location of the job decides which body you use.

A DBS checklist for recruiters and agencies

1. Decide the level from the role's duties, not the job title: basic unless the role is in the Exceptions Order; barred lists only for regulated activity.
2. Use a registered or umbrella body for standard and enhanced checks; verify the candidate's identity documents as the application requires.
3. Tell candidates in your privacy notice what you check, why, and how long you keep it.
4. Ask the candidate whether they subscribe to the Update Service before ordering a new check, and record their permission for the status check.
5. Assess any disclosure against your ex-offender policy and the actual job, give the candidate a chance to explain, and record the decision rather than the certificate.
6. For agency placements with vulnerable people, pair the check with the two references required by regulation 22 of the Conduct Regulations; our reference check template helps.
7. Destroy certificate information once the decision is made, usually within six months.

Temps placed through an agency also gain equal treatment rights after 12 weeks with a hirer; see the Agency Workers Regulations guide.