Can I ask all applicants to make criminal record declaration

It’s not considered good practice to ask all applicants to make criminal record declarations. If an applicant doesn’t meet your essential criteria for the role, it is very difficult to justify requesting their criminal record (personal, sensitive) information. There is huge variation in recruitment processes between organisations, so the point at which you are able to justify the collection of criminal record data will be different for organisations.

Under the General Data Protection Regulations (GDPR), you need to identify a lawful basis for collecting criminal record data. You are likely to find that the most appropriate basis to rely on is that you have a legitimate interest for collecting and processing relevant criminal record information.

Once you have established a lawful basis for collecting and processing criminal record data, one of the conditions found under Parts 1, 2, 3, of Schedule 1, Data Protection Act 18 must also be met. The condition(s) you are able to rely on will depend on the nature of your organisation and the roles and/or services you offer. Please see our data protection briefing for further details.

Regardless of the condition(s) you rely on, you must make it clear to applicants that relevant criminal record information will be sought and be transparent about how you will use the information in your decision-making process.

Can I include a criminal record declaration on an application form?

In general, criminal record declarations on application forms or online portals serve no helpful purpose for employers or applicants. Application forms rarely have the space required for an applicant to provide the level of useful details about a criminal record that will help you to make an informed, evidence-based decision.

Initially, applicants should be assessed on the basis of skills, qualifications and their ability to do the job; if they do not meet your essential criteria, you do not need information about their criminal records.

Can I ask volunteers to make a criminal record declaration?

Yes, if it is relevant to the role, you can ask volunteers to make a criminal record declaration and you can request that they undergo DBS checks. The question you ask and the level of DBS check will depend on the nature of the role (please see here for further information).

As above, you should not request criminal record declarations from all volunteer applicants, but only those you have either recruited or are seriously considering for the role. If you are going to ask for a declaration, you must have a recruitment of ex-offenders policy and process in place and make this available to applicants.

How long can I keep a DBS certificate?

There is no defined period for the retention of DBS certificates, only that you should not keep a DBS certificate for longer than is necessary. If you decide not to proceed with the recruitment of the person concerned, you may keep the certificate until the period has elapsed during which they may appeal or dispute the decision. An unsuccessful applicant has three months to lodge a claim with the employment tribunal if they feel that the decision not to recruit them was discriminatory. You might want to factor this in when determining the length of your retention period.

If you are subject to inspection by a regulating body, such as the Care Quality Commission (CQC) or Ofsted, or if you are subject to safeguarding audits, you may be entitled to keep the certificate for the purpose of such inspections or audits.

Any retention of DBS certificates must comply with the Data Protection Act, Human Rights Act, GDPR and be incorporated within the individual organisation’s policy on the correct handling and safekeeping of DBS certificate information.

How long should I keep a risk assessment?

If you have carried out a risk assessment for an applicant, but not proceeded with recruitment, keep the risk assessment for as long as the individual has to raise a dispute, appeal the decision or lodge an employment tribunal claim if they feel the decision was discriminatory.

If you have proceeded with recruitment, keep the risk assessment for as long as necessary. A risk assessment is a live document and should be kept under review until:

  • Any identified safeguards are no longer necessary or
  • The information taken into account is no longer valid (e.g. because a conviction has become spent, or filtered from the DBS certificate)

If you are subject to inspection by a regulating body, such as the Care Quality Commission (CQC) or Ofsted, or if you are subject to safeguarding audits, you should keep the risk assessment for the purpose of such inspections or audits.

Can I share criminal record details with third parties?

Information about an applicant’s or employee’s criminal record should not be disclosed to anyone else in your organisation or any other third party, apart from those who have a genuine need to know. This may include people directly responsible for the recruitment decision, or somebody identified from the risk assessment as responsible for the implementation of certain safeguards (e.g. their line manager).

The individual should be told who knows about their record, as they need to feel confident that their personal and sensitive information will not be disclosed to anyone unless there is a specific reason or doing so.

If you are a contractor, or a contracting organisation, the advice about sharing criminal record data is dependent on a number of factors. Please contact us for advice on 0845 600 3194 or employeradvice@nacro.org.uk.