DBS Checks: What UK Employers Get Wrong (And How to Get It Right)

21 January 2026.

That's when the DBS guidance changed for self-employed people and personal employees.

Since 2006, we ran screening companies and saw this confusion constantly. One update triggers panic. Employers scramble. Questions flood in.

Most of them unnecessary.

The real problem? Employers don't understand the basics in the first place.

Let's fix that.

About the Authors: Graham and Vivianne Johnson ran screening and vetting companies from 2006 to 2025. They launched Vetting Hub in 2025 to make their 19 years of operational knowledge accessible at cost-effective prices. All Vetting Hub courses are CPD Certified and VH Courses is listed on the UK Register of Learning Providers.

Read full background →

The Three Questions Employers Keep Getting Wrong

Question 1: "Do DBS certificates expire?"

No.

But here's what trips people up: the certificate shows information at the time it was issued. Nothing more.

An employee gets their Enhanced DBS on 15 March 2025. Clean. Six months later? They could have three convictions. The certificate wouldn't show it.

The certificate itself doesn't expire. But its relevance does.

Best practice: Re-check every three years. Healthcare and education sectors often require this. Your sector might not mandate it, but consider doing it anyway.

Alternative: Use the DBS Update Service (£13 per year). Employees subscribe. You check for updates. No full reapplication needed.

Question 2: "Can we keep copies of DBS certificates?"

You shouldn't.

The DBS Code of Practice is clear: destroy certificates after a maximum of six months. Usually sooner.

Here's what happened in organisations we worked with from 2006 to 2025: filing cabinets full of certificates. Some dating back years. All retention policy violations.

If you need a record, keep only:

• Date of issue

• Name of subject

• Type of certificate

• Position requested for

• Unique reference number

• Recruitment decision made

Don't keep: photocopies, scanned images, or the physical certificate itself.

Question 3: "What level of DBS check does this role need?"

This is where legal trouble starts.

Requesting an Enhanced check for a role that doesn't qualify? That's misuse. The DBS can refuse to issue certificates. In extreme cases, prosecution.

Basic DBS: Unspent convictions only. Most general roles.

Standard DBS: Spent and unspent convictions, cautions, reprimands, warnings. Certain professions (accountants, solicitors).

Enhanced DBS: Standard plus local police information. Roles involving frequent contact with vulnerable groups.

Enhanced with Barred List: Enhanced plus checks against Children's and/or Adults' Barred Lists. Only for regulated activity. Legally required.

The key phrase: regulated activity. If the role doesn't involve regulated activity with children or vulnerable adults, you cannot request a Barred List check.

Get this wrong and you're in breach.

Our Understanding DBS Checks (UK) Course (£49) breaks down eligibility requirements in detail. It's CPD Certified and designed for HR teams who need clarity fast.

What Changed on 21 January 2026?

Self-employed people and personal employees can now apply for Enhanced DBS checks themselves.

Previously, they couldn't. They needed an employer to request it for them.

What this means for you:

If you're hiring a self-employed contractor for regulated activity (childcare, personal care for vulnerable adults), they can now get their own Enhanced or Enhanced with Barred List check through an umbrella body.

You can still request the check yourself. The option exists for both routes now.

Who this applies to:

• Self-employed people in regulated activity with children and/or adults

• Personal employees carrying out activities that qualify as regulated activity

It's a small change. But it clarifies responsibility.

The Storage Mistake That Costs Organisations

We saw this repeatedly from 2006 to 2025:

Inspector arrives. Asks to see DBS handling procedures. Employer opens filing cabinet. Thirty-seven certificates. Some from 2018.

Immediate breach.

Here's what you should do:

1. Create a handling policy

The DBS Code of Practice requires a written policy. If you're a registered body, you must have one. If you use an umbrella body, they'll require you to have one.

Your policy should cover:

• Who handles certificates

• How they're stored (locked cabinet, restricted access)

• When they're destroyed (within six months maximum)

• What records you keep

• Training for staff who handle them

2. Destroy certificates properly

Shredding. Pulping. Burning.

Not: standard waste bins. Not: confidential waste sacks that sit for weeks.

Immediate, secure destruction.

3. Train your team

HR sees certificates. Hiring managers see certificates. Reception might see certificates during identity checks.

Everyone who handles them needs training on proper procedures.

Our GDPR Training Course (£45) and Data Protection Policies & Procedures UK Course (£55) both address DBS certificate handling within broader data protection frameworks. Both are CPD Certified.

Training Tip: Create a certificate log. Don't keep copies, but record: date issued, certificate number, applicant name, check level, decision made. This demonstrates compliance during audits whilst respecting the Code of Practice.

The Identity Verification Changes (If You Missed Them)

22 April 2025: DBS updated ID checking guidance.

1 November 2025: Compliance became mandatory.

If you're still using the old process, you're already non-compliant.

Key changes:

• Simplified ID routes for Standard and Enhanced checks

• Fewer proof of address requirements in many cases

• Expanded acceptance of digital ID verification

• e-visas for non-UK nationals now accepted

• Updated retention periods for identity documents

Critical rule: You cannot verify the identity of:

• A relative

• Your partner

• Anyone living in your household

• A personal friend

We launched Vetting Hub in 2025 specifically to address confusion like this. Guidance changes. Employers panic. Training helps.

Our Digital ID & GPG45 Compliance Course (£59) covers identity verification requirements in detail, including the 2025 updates. It's particularly relevant for organisations moving toward digital identity solutions.

What About Overseas Criminal Records?

DBS checks cannot access criminal records held overseas.

If your candidate lived abroad, the DBS check gives you an incomplete picture.

What to do:

For candidates who lived outside the UK, request a criminal record check from that country. The Home Office website provides guidance on obtaining overseas checks.

Don't assume: "They've been in the UK for five years, so we're fine."

Criminal history from abroad won't appear on a UK DBS check. Ever.

This is especially relevant for organisations in sectors with high proportions of overseas workers: hospitality, healthcare, construction.

Our Global Background Screening Awareness Course (£69) addresses international screening challenges, including obtaining and interpreting overseas criminal records. CPD Certified and built for UK employers hiring internationally.

The Right to Work Confusion

DBS checks do not prove right to work.

They're separate checks with separate requirements.

We saw employers conflate these constantly. One check. Two purposes. Doesn't work that way.

Right to Work checks: Immigration status. Work eligibility. Home Office guidance.

DBS checks: Criminal record. Barred list status. DBS guidance.

Both required. Both separate. Both need proper processes.

Failing Right to Work checks? Fines now reach £45,000 for first offences and £60,000 for repeat offences (as of April 2025). Between July 2024 and March 2025, the Home Office issued over 1,500 penalty notices totalling £70 million.

That's a separate compliance area entirely.

Our Right to Work Checks & Legal Requirements Course (£49) keeps these checks distinct and covers the 2025 penalty increases. Pair it with our DBS course for complete pre-employment screening knowledge.

For more on Right to Work specifically, see our guide: The Complete Guide to Employee Screening, Vetting and Training in the UK.

Quick Reference: DBS Decision Framework

Before requesting any DBS check, ask:

1. Is this role eligible for this level of check?

   • Basic: Nearly all roles

   • Standard: Specific professions listed in ROA 1974 Exceptions Order

   • Enhanced: Frequent contact with vulnerable groups

   • Enhanced with Barred List: Regulated activity only

2. Do we have a legal basis?

   • Not consent (insufficient for criminal record data)

   • Article 6(1)(f) GDPR: Legitimate interests

   • Schedule 1, Part 1, Paragraph 1 DPA 2018: Employment purposes

3. Have we documented our decision-making process?

   • Why this level of check is necessary

   • How it's relevant to the role

   • Risk assessment completed

4. Do we have proper handling procedures?

   • Written policy

   • Secure storage

   • Destruction timeline (within six months)

   • Training for staff

If you answered "no" or "I'm not sure" to any of these, don't proceed until you've resolved it.

Our Pre-Employment Screening & Vetting Essentials Course (£79) walks through this entire decision framework with practical examples. CPD Certified and UKRLP registered.

What You Actually Need to Know

DBS certificates don't expire, but their relevance does. Re-check every three years or use the Update Service.

Don't keep copies. Record key details only. Destroy certificates within six months.

Know your eligibility. Requesting checks you're not entitled to is misuse.

Identity verification changed in 2025. If you're still using the old guidance, you're already non-compliant.

Self-employed people can now apply themselves (as of 21 January 2026). But you can still request checks as the hiring organisation.

Overseas criminal records won't appear on UK DBS checks. Request separate checks for candidates who lived abroad.

DBS and Right to Work are separate checks. Both required. Both distinct processes.

The 21 January 2026 change affects relatively few organisations. Most confusion around DBS checks stems from misunderstanding the basics.

Get the basics right first.

Then updates like this one become straightforward.

Further Resources

Want comprehensive guidance? Our BS7858 Screening Standard Course (£85) covers DBS checks within the broader BS7858 framework. Ideal for security sector employers but valuable for any organisation serious about screening compliance.

Need sector-specific guidance?

• Healthcare: CQC Screening Standard Course (£79)

• Financial services: FCA Screening Standard Course (£79)

Building screening policies from scratch? Our Creating a Screening Policy & Framework Course (£89) provides templates and guidance.

All courses are CPD Certified. All include ongoing access. All built from 19 years of operational screening experience.

About Vetting Hub: We launched Vetting Hub in 2025 after nearly two decades running screening companies. We identified a persistent gap in professional training and made our operational knowledge accessible at cost-effective prices. Learn more on our About page.

Questions about DBS compliance or screening training? All our courses include professional support. We're here to help you get it right.