Criminal records—asking questions, DBS checks and data protection
Criminal records—asking questions, DBS checks and data protection

The following Employment guidance note provides comprehensive and up to date legal information covering:

  • Criminal records—asking questions, DBS checks and data protection
  • Criminal records checks and the rehabilitation provisions—an overview
  • Spent convictions
  • Effect of rehabilitation
  • Rehabilitation periods
  • Excluded sentences
  • Exceptions to the rehabilitation protections
  • Filtering of protected convictions and cautions
  • DBS checks
  • DBS checks—applying for a CRC or ECRC
  • more

Employers may wish to know whether a prospective employee has a criminal record, for example because:

  1. it reflects on the employee’s character and suitability for the position, or

  2. the information is required for regulatory purposes

Such information may be obtained by asking questions of the prospective employee or by carrying out checks with the Disclosure and Barring Service (DBS).

Employers are not generally entitled to full disclosure of all previous convictions and cautions. The Rehabilitation of Offenders Act 1974 (ROA 1974) provides for convictions to become spent, and a convicted person to become 'rehabilitated', at the end of a rehabilitation period—see: Spent convictions and Effect of rehabilitation below. However:

  1. certain sentences are excluded from rehabilitation—see: Excluded sentences below, and

  2. exceptions apply in relation to certain professions, employments and occupations—see: Exceptions to the rehabilitation protections below

The same rehabilitation protections (and exceptions) apply in respect of questions asked by the prospective employer and information provided in relation to a DBS check.

Before asking questions or carrying out DBS checks, the employer will therefore need to consider:

  1. the provisions of ROA 1974 and the exceptions to it

  2. the parallel provisions relating to the obtaining of DBS certificates in the Police Act 1997 and related regulations, and

  3. the effect of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and the Data Protection Act 2018 (DPA 2018)

For an