DBS Checks: Why the Level You Request Is a Legal Question, Not a Judgment Call

When an HR manager decides to run a criminal record check on a new hire, the instinct is usually the same: the more information, the safer the decision. A senior role, a position of trust, a team working near vulnerable people reach for the Enhanced check. It feels diligent. It feels responsible.  

 In most cases, it is also unlawful.

This is not a technicality. The level of DBS check an employer can legally request is determined entirely by the role’s duties, governed by specific legislation, and non-negotiable. Understanding why requires looking at how the framework is actually built, because most HR professionals have never been shown the full picture.

Three Laws, Not One

Most people think of DBS checks as a single system with different levels of depth. In reality, each level is governed by a distinct legal instrument, and the conditions for accessing each one are cumulative.

The Rehabilitation of Offenders Act 1974 is the foundation. Its core principle is straightforward: after a set period of time without reoffending, a conviction becomes “spent” and the individual is legally treated as if it never happened. For most jobs, employers cannot ask about spent convictions, and candidates are under no obligation to disclose them.

The Exceptions Order 1975 carves out a defined list of roles where spent convictions remain relevant, typically those involving children, vulnerable adults, or positions of significant public trust. Only roles that appear on this list are eligible for a Standard DBS check, which discloses both spent and unspent convictions.

The Police Act 1997 adds a second gateway, required specifically for Enhanced checks. A role must appear in both the Exceptions Order and the regulations under the Police Act to qualify. Enhanced checks additionally draw on locally held police intelligence, information that may never have resulted in a conviction but that a chief officer considers relevant to the role.

The result is a tiered legal architecture, which can be summarised as follows:

• Basic: no eligibility threshold, available for any role, discloses unspent convictions only
• Standard: requires the role to appear in the Exceptions Order 1975, discloses spent and unspent convictions
• Enhanced: requires the role to appear in both the Exceptions Order 1975 and the Police Act 1997, additionally draws on local police intelligence

Requesting a higher level than the role qualifies for is not an administrative error. It is a breach of the Data Protection Act 2018 and, where done knowingly, a criminal offence.

The Scale Problem: 7.3 Million Certificates, No Eligibility Gate

The DBS issued 7.3 million certificates in 2024/25. That volume might suggest a system with robust checks on eligibility. It does not. The DBS assumes that every application submitted is eligible for the level requested. There is no automatic filter, no eligibility gate, no mechanism to flag potentially ineligible checks before they are processed.

The responsibility sits entirely with the employer. And the evidence suggests that responsibility is frequently mishandled, not out of bad faith, but out of genuine misunderstanding of how the framework works.

Unlock, the national charity that supports people with criminal records, has submitted evidence to Parliament documenting repeated cases of ineligible checks, including delivery drivers asked for Enhanced checks on the basis that their routes include schools and care homes. The job title triggered the assumption. The actual legal test, which concerns the specific duties of the role and not its setting or title, was never applied.

What Basic Actually Covers

The Basic DBS check discloses unspent convictions only. No spent convictions, no cautions subject to filtering, no police intelligence. For many employers, this sounds like the minimum: a starting point before requesting something more complete.

It is more accurate to think of it differently. Basic is the universally available check precisely because it is calibrated to what most employment decisions legitimately require. An unspent conviction is, by definition, one that the law has not yet considered rehabilitated. It is current, relevant, and appropriate to disclose. A spent conviction, by contrast, is one the law has determined should no longer define a person’s employability in most contexts.

Requesting more than Basic for a role that does not meet the eligibility threshold does not make the hiring decision safer. It makes the employer liable for processing information they were never legally entitled to see.

The GDPR Layer Most Employers Overlook

The legal exposure from overchecking does not stop at DBS legislation. Criminal offence data is classified as special category data under Article 10 of UK GDPR and Section 10 of the Data Protection Act 2018. It cannot be processed on the basis of consent alone. It must be legally necessary, proportionate to the role, and supported by documented justification.

This has direct consequences for blanket screening policies, a common practice where all new hires undergo the same level of check regardless of role. The ICO is explicit on this point: vetting must be proportionate to an identified risk, targeted to the specific role, and justified. The ICO’s own guidance states that employers should not routinely vet all candidates unless legally required to do so, and that standard practice or internal procedure is not sufficient justification for processing criminal offence data.

A Standard or Enhanced check requested for an ineligible role therefore creates two simultaneous legal problems: a breach of DBS eligibility rules, and a failure to meet the lawful basis requirements under UK GDPR. The employer has not just requested the wrong check. They have unlawfully processed special category data.

The Filtering Rules and Why They Matter Here

Since 2013, the DBS applies filtering rules that automatically remove certain old and minor convictions from Standard and Enhanced certificates. Approximately 45,000 people per year benefit from these rules, meaning their records are cleaner on a Standard or Enhanced check than legislation originally provided for.

The consequence for overchecking is significant. When an employer requests a Standard or Enhanced check for a role that only qualifies for Basic, they may access conviction data that filtering rules were designed to protect information a candidate had every legal right to keep private. The employer is then in the position of making a hiring decision on the basis of information they were not entitled to hold, let alone act on.

This is not a grey area. Using that information in a recruitment decision, even implicitly, compounds the original eligibility breach into something considerably more serious.

What Correct Practice Looks Like

Correct practice starts before the application is submitted, with a clear eligibility assessment based on the actual duties of the role, not its title, seniority, or setting.

The GOV.UK eligibility tool provides structured guidance, though it does not cover every role and does not constitute legal advice. For roles close to the eligibility boundary, the DBS customer services team can advise, and legal counsel is appropriate where doubt remains.

Beyond eligibility, employers should have:

• A written policy documenting which roles require which level of check and why
• A documented lawful basis under the Data Protection Act 2018 for processing criminal record data
• Role-specific risk assessments rather than blanket screening policies
• Clear privacy notices for candidates explaining the basis and scope of any check

A Final Thought

The instinct to request more information is understandable. In hiring, thoroughness feels like protection. But in the context of DBS checks, thoroughness is not defined by the level of check requested. It is defined by the accuracy of the eligibility assessment that precedes it.

A Basic check requested for the right reasons, on the right role, with the right documentation, is a compliant and defensible hiring decision. An Enhanced check requested for a role that does not qualify is none of those things, regardless of how responsible it was intended to be.

Getting the level right is not a compliance exercise. It is the point.

Sources:

• GOV.UK — DBS employer guidance 
• GOV.UK — Guidance on the Rehabilitation of Offenders Act 1974 and the Exceptions Order 1975
• Hansard — Parliamentary debate on the ROA and Police Act amendments, September 2020
• Wikipedia — Disclosure and Barring Service
• Unlock — Parliamentary written evidence on ineligible DBS checks
• Unlock — Ineligible checks archive
• uCheck — What is a DBS check (citing DBS Annual Report 2024/25)
• ICO — Criminal offence data: what are the rules
• ICO — Criminal offence data: conditions for processing
• ICO — Pre-employment vetting of candidates
• Veremark — Basic, Standard or Enhanced DBS: what is the difference
• Veremark — What criminal record checks can UK employers legally request
• WageKit — UK employee background checks guide
• DPO Centre — DBS checks and UK GDPR compliance
• RWK Goodman — Criminal record checks and GDPR
• RecruitUnlock — DBS legislation guide

ICO = Information Commissioner’s Offices