Background and reference checks in the United Kingdom
Reviewed by Mellow Editorial Team, HR & payroll content team
Conducting a background or reference check in the UK is legal, but it must follow specific rules around data protection, consent and discrimination law. Done correctly, it protects both the employer and the candidate.
What the law requires before you start
Before running any check, you need a lawful basis under UK GDPR. For most employment screening, that basis is legitimate interests or, where the law requires it (such as DBS checks), legal obligation. Either way, you must tell candidates what you are checking, why, and how you will use the information — usually in a privacy notice attached to your application form or offer letter.
Collecting information you do not genuinely need is a data protection risk. If a check is not relevant to the role, do not run it.
Step 1 — Define what checks the role actually needs
Not every role needs every check. Start by listing what is genuinely relevant:
- Identity verification — almost always required; confirms the person is who they say they are.
- Right to work — legally required for every employee before they start. Use original documents, a share code, or an Identity Service Provider for British or Irish nationals.
- Employment history — confirm dates and job titles with previous employers, typically covering the last two to five years.
- References — most employers request two: one from the most recent employer, one from an earlier role or a personal contact where work history is short.
- Criminal record checks (DBS) — required for roles working with children, vulnerable adults, or in regulated financial services. Basic, Standard and Enhanced levels exist; use only the level the role legally requires.
- Credit checks — relevant for roles with financial responsibility, but require explicit consent and must be proportionate.
- Qualification and professional registration checks — relevant for roles requiring specific credentials (nurses, solicitors, engineers and so on).
Document your rationale. If a candidate later challenges a decision, you need to show why a particular check was proportionate to the role.
Step 2 — Get written consent and issue a privacy notice
Send candidates a clear written explanation of every check you intend to run before you run it. Combine this with written consent where consent is your lawful basis — for example, credit checks or social media screening.
Keep consent records. If you later want to run an additional check, go back and seek fresh consent rather than relying on the original.
Avoid asking for information that could reveal protected characteristics (age, ethnicity, disability status, religion) at the screening stage. Gaps in employment are worth exploring in conversation, not assumed to be negative.
Step 3 — Run the checks through appropriate channels
Right to work: follow the Home Office's prescribed process. Keep a copy of the documents or the share code result. Liability for an illegal working penalty shifts to you the moment you fail to carry out a compliant check.
DBS checks: apply through the Disclosure and Barring Service directly or via an umbrella body. Standard and Enhanced checks can only be requested for roles listed in the Rehabilitation of Offenders Act 1974 (Exceptions) Order — you cannot simply request them because you would like extra reassurance.
Employment references: send a structured reference request form rather than asking open-ended questions. Ask for confirmation of employment dates, job title, and whether the referee would re-employ the person. Many employers now only confirm factual details to limit their own liability — a short factual reference is not a bad reference.
Third-party screening providers: legitimate providers are registered with the ICO and will ask for evidence of the candidate's consent before running checks. Avoid any provider that does not follow this process.
Step 4 — Assess results fairly and consistently
Apply the same criteria to every candidate for the same role. If a DBS check returns a disclosure, assess it against the specific responsibilities of the job — a historic minor offence is not automatically disqualifying. The Rehabilitation of Offenders Act 1974 means many convictions become spent after a set period and cannot be considered for most roles.
If you are minded to withdraw an offer based on a check result, tell the candidate what information you have found and give them a reasonable opportunity to respond before you make a final decision. This is good practice and reduces the risk of a discrimination or unfair treatment claim.
Step 5 — Store and dispose of data correctly
Retain background check documentation only as long as necessary. For right-to-work documents, current Home Office guidance sets a retention period of two years after employment ends. For DBS certificates, do not keep a copy without the individual's consent and a clear policy reason — record the date of the check, the level, and the disclosure status instead.
Under the Employment Rights Act 2025, day-one rights for employees are strengthened, which makes pre-employment checks even more important: once someone starts, the bar for dismissal rises. Getting checks right before the start date is materially less risky than trying to address concerns afterwards.
---
Run HR and payroll in United Kingdom with Mellow
Mellow brings HR, payroll and 12 AI agents into one platform — built to handle United Kingdom properly, with payroll included, from £4 per employee per month. The AI agents don't just answer questions; they generate contracts, run cost estimates and draft letters for you.
- United Kingdom payroll software
[Start a free trial →](/register)