Legal Obligations When Conducting Background Checks

Employers in England and Wales must navigate a range of legal obligations when carrying out background checks on job applicants and employees. These obligations arise from employment, immigration, criminal records and data protection law. Understanding the duties involved helps employers make lawful, fair and proportionate decisions, avoid discrimination and reduce the risk of claims in tribunals or courts. This article explains the key legal rules employers must follow, the rights of individuals, how checks should be conducted, risks to manage and practical guidance for compliant recruitment vetting.

What Are Background Checks?

“Background checks” is a broad term used to describe the collection and verification of information about prospective or current employees. Typical checks include:

• Right to work checks to confirm legal entitlement to work in the UK;
• Criminal record checks through the Disclosure and Barring Service (DBS) where permitted;
• Employment reference checks and qualification verification;
• Other vetting such as financial, credit or security clearance where justified.

The legal obligations depend on the type of check and the context in which it is conducted. Employers must balance obtaining accurate information with respecting legal protections such as data protection rights, anti‑discrimination duties, and statutory requirements.

Right to Work Checks: A Statutory Duty

Legal Requirement

All employers must check that job applicants have the right to work in the UK before they begin employment. This is a statutory duty under immigration laws; failure to comply can lead to civil penalties up to £60,000 per illegal worker, criminal prosecution, potentially imprisonment and licence suspension where a sponsorship licence is held.

How Checks Should Be Carried Out

Employers can perform right to work checks by:

• Checking original documents in person and retaining dated copies;
• Using Home Office online checks;
• Using a certified Identity Service Provider (ISP) to verify documents digitally.

Documents must be checked consistently for all applicants to avoid discrimination based on nationality or ethnicity, and employers should make reasonable adjustments where necessary.

Record Keeping

Employers must retain evidence of checks securely for the duration of employment and for a further two years after employment ends. Employers should be able to produce this evidence to establish a statutory excuse against liability for civil penalties.

Criminal Record Checks: Eligibility, Consent and Data Protection

Legal Context and Eligibility

Criminal record checks are governed by the Rehabilitation of Offenders Act 1974 (ROA) and DBS legislation. An employer can only request:

• A Basic DBS check (unspent convictions) for any role if the candidate consents;
• Standard or Enhanced DBS checks only where the law specifically allows it (for example, roles involving work with children or vulnerable adults).

Importantly, for most roles there is no legal obligation to ask about or check spent convictions. If an employer asks about criminal history at application stage, they must be able to justify why this is proportionate and lawful.

Data Protection and Criminal Data

Processing criminal offence data is treated as highly sensitive under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018). Employers must:

• Identify and document a lawful basis under Article 6 of UK GDPR for processing personal data;
• Meet a separate condition under Schedule 1 of the DPA 2018 (for example, where processing is necessary for employment law obligations or to prevent unlawful acts);
• Conduct a Data Protection Impact Assessment (DPIA) if the check is particularly intrusive;
• Ensure secure handling, clear retention limits and restricted access.

Employers cannot rely on consent alone for criminal conviction data because of the imbalance of power in the employment relationship.

DBS Code of Practice

Employers using DBS checks must comply with the DBS Code of Practice, which governs how DBS certificate information is handled and stored. Certificate information should be used only for the purpose obtained and usually retained no longer than necessary - typically no more than six months unless lawful justification exists.

Other Pre‑Employment Checks

Reference and Qualification Checks

Employers can lawfully request employment references and verify qualifications. References involve processing personal data and should be handled in line with data protection principles, ensuring relevance and minimal intrusion. References rarely include sensitive personal information unless voluntarily provided.

Health and Medical Checks

As part of background vetting, employers can ask successful candidates for health checks only where necessary for the role or legal requirement (for example, eyesight tests for drivers). Employers must avoid discrimination against individuals with disabilities or health conditions that do not affect their ability to perform the job.

Other Checks (Credit or Financial)

More intrusive background checks such as credit or security vetting should be justified, specific and proportionate to identified business risk. Routine vetting for all candidates without clear lawful purpose may be disproportionate and violate data protection principles.

Data Protection Principles for Background Checks

When conducting any background check that processes personal data, employers must comply with UK GDPR principles:

1. Lawfulness and Transparency

Employers must have a lawful basis for processing personal data and inform candidates in advance how their data will be used, retained and shared. Privacy notices should be clear and accessible.

2. Purpose Limitation and Data Minimisation

Only data necessary for recruitment decisions should be collected. Collecting irrelevant or excessive personal details is not compliant.

3. Accuracy and Retention

Data should be accurate and retained only for as long as necessary for hiring decisions or statutory obligations. For example, right to work documents are retained for the duration of employment and two years thereafter.

4. Security and Confidentiality

Background check data, especially criminal and sensitive information, must be stored securely, access restricted to authorised personnel, and policies should be in place for secure disposal.

Anti‑Discrimination Obligations

Employers must ensure that background checks do not result in direct or indirect discrimination under the Equality Act 2010. For example, conducting right to work checks only on certain groups could amount to discriminatory practice. Checks should be carried out consistently for all applicants with similar roles and not used to exclude individuals based on protected characteristics such as race, nationality or disability.

Practical Steps for Compliant Background Checks

1. Identify legal requirements: Determine what checks the role requires by law (e.g., DBS, right to work).
2. Document lawful bases: For all data processing involved in checks, record the lawful basis (Article 6) and, where relevant, the Schedule 1 condition under DPA 2018.
3. Provide clear privacy information: Inform candidates early about what data will be obtained, why it's needed, how it will be used and retention periods.
4. Limit scope and relevance: Conduct only necessary checks and avoid collecting unrelated personal data.
5. Maintain secure storage and retention: Keep records secure and destroy them once they are no longer needed.
6. Train staff: Ensure HR and recruitment personnel understand legal obligations, discrimination risks and data protection duties.

Common Legal Risks and Remedies

Failing to comply with legal obligations can expose employers to various risks:

• Penalties from penalties such as civil fines for failing to carry out right to work checks correctly;
• Data protection enforcement action from the Information Commissioner's Office for unlawful processing;
• Employment claims relating to discrimination or unfair treatment if checks are inconsistent or disproportionate.

Clear policies, transparency and lawful processing help mitigate these risks and ensure background vetting supports, rather than undermines, fair recruitment practices.

Conclusion

Background checks are a vital part of recruitment and employee vetting, but employers in England and Wales must conduct them lawfully. This involves understanding statutory duties such as right to work checks, eligibility rules for criminal record checks, robust compliance with data protection principles, and anti‑discrimination obligations under the Equality Act. Employers should document lawful bases, inform candidates, limit data collection to what's necessary, and secure all personal information. Taking a structured approach to background checks protects the organisation, respects candidate rights and reduces legal risk.