An Employer’s Complete Guide to DBS Checks in the UK: the 2026 update

DBS checks remain one of the clearest ways for UK employers to make safer hiring decisions. The basics have not changed: employers must choose the right level of check, only ask for information they are legally entitled to see, and handle certificate information carefully.

What has changed is the detail. In 2025 and 2026, employers need to pay closer attention to identity-checking rules, Update Service time limits, self-employed applicants, disclosure boundaries, and how long DBS-related information can be kept.

What does DBS mean?

DBS stands for Disclosure and Barring Service. It is the public body that processes criminal record checks for England, Wales, the Channel Islands and the Isle of Man. DBS checks help employers assess whether a person is suitable for a role, especially where the work involves children, vulnerable adults, regulated settings, security, finance, or positions of trust.

A DBS check is one part of safer hiring. It should sit alongside identity verification, right to work checks, employment history checks, reference checks, and a clear decision-making process. Veremark’s criminal record checks can be used as part of a wider screening programme, with checks managed through one platform.

The four levels of DBS check

There are still four main levels of DBS check in 2026.

Basic DBS check

A basic DBS check shows unspent convictions and conditional cautions. It can be requested for any role, and individuals can apply for one themselves.

Basic checks are often used for roles that do not qualify for a standard or enhanced check, but where the employer still needs proportionate criminal record information. Current DBS guidance says a basic check costs £21.50 and, on average, takes three days to process, although some applications take longer.

Standard DBS check

A standard check can only be requested where the role is eligible under the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975. It may show spent and unspent convictions, cautions, reprimands and warnings, subject to filtering rules.

Employers must not request a standard check simply because a role is senior or sensitive. DBS guidance is clear that knowingly requesting a higher-level check than the law allows is unlawful and may breach the Data Protection Act 2018.

Enhanced DBS check

An enhanced check includes the same Police National Computer information as a standard check, plus any relevant information held by local police that a chief officer considers relevant to the role. This can include non-conviction information where the legal test is met.

Enhanced checks are used for eligible roles involving work with children or adults, as well as certain regulated professions.

Enhanced DBS check with barred list check

This is the highest level of DBS check. It includes an enhanced check and a check of the relevant barred list, either children, adults, or both.

Employers should only request a barred list check where the role involves regulated activity. For work with children, regulated activity can include teaching, training, caring for, supervising, advising or driving children on more than three days in a 30-day period, or once overnight between 2am and 6am where there is an opportunity for face-to-face contact. Healthcare or personal care with children can qualify even once.

What is new for 2026?

The biggest 2026 change affects self-employed workers and personal employees. From 21 January 2026, eligible self-employed people and personal employees can apply for enhanced DBS checks, including enhanced checks with barred list checks, through an umbrella body.

This matters for tutors, carers, sports coaches, therapists and other professionals who work directly with families or clients without a traditional employer. It gives clients a clearer route to appropriate safeguarding checks, while still keeping the eligibility test in place.

Employers and hiring teams should not treat this as a reason to request enhanced checks for every contractor. The same legal test applies. The role must be eligible.

Update Service time limits

The DBS Update Service allows individuals to keep standard and enhanced certificates up to date and lets employers check whether new information has been added.

The key 2026 point is the joining window. Individuals must subscribe within 30 days of the certificate issue date. If a certificate is reprinted, the 30-day window still runs from the original certificate date, not the reprint date.

This is a practical issue for onboarding. Employers that rely on portability should tell candidates about the deadline early, rather than raising it after the certificate arrives.

Identity-checking changes from 2025

DBS identity-checking guidance was updated for standard and enhanced applications from 22 April 2025. Employers and registered bodies must keep a record of the documents used to validate identity for at least two years. This applies whether the ID check is completed in person, by video link with the original documents held by the checker, or through the limited video-link route where documents are shown remotely and then checked physically before employment starts.

The guidance also makes clear that physical documents are generally required, except for specific digital evidence such as an eVisa viewed through the Home Office service or an eligible digital PASS card with QR code. Photocopies and scanned documents are not acceptable for standard ID checks.

This creates a clear split for HR teams: certificate information should usually be kept only for a short period, while ID validation records must be kept for at least two years.

What information can employers ask candidates to disclose?

Employers can only ask about convictions and cautions they are legally entitled to know about.

For standard and enhanced checks, certain cautions and convictions are filtered. Protected cautions and convictions do not automatically appear on certificates, and employers cannot take them into account if disclosed. Youth cautions, reprimands and warnings are excluded from automatic disclosure on standard and enhanced certificates.

For basic checks, the position is simpler: only unspent convictions and conditional cautions are disclosed. The rehabilitation periods were updated in line with legislation that came into force on 28 October 2023, so employers should avoid using old internal tables or outdated candidate questions.

The safest approach is to ask role-specific questions. For a basic check, ask only about unspent convictions and conditional cautions. For standard or enhanced checks, ask only about convictions and cautions that are not protected and that the role is legally entitled to consider.

GDPR and DBS checks

DBS certificate information is highly sensitive. Employers must have a written policy for handling, storing, using, retaining and disposing of certificate information. Access should be restricted to people who need it for their role.

DBS guidance says certificate information should usually be destroyed after a suitable period, generally no longer than six months. Once the recruitment decision has been made, employers should not keep certificate information for longer than necessary, except where retention is needed for disputes, complaints or safeguarding audits.

Employers should not keep photocopies, images or written copies of certificate contents. They may keep a record of the certificate issue date, applicant name, certificate type, role, certificate number and recruitment decision.

For GDPR purposes, the point is simple: collect the right level of DBS information, use it only for the hiring decision or safeguarding purpose, restrict access, and delete it when the retention reason ends.

DBS checks for overseas candidates

A UK DBS check does not give a full picture of someone’s criminal record overseas. DBS guidance confirms that it cannot access criminal records held overseas, although some overseas records may appear on the Police National Computer. Employers hiring internationally should consider overseas criminal record checks, certificates of good conduct, or local equivalents where available.

This is especially relevant for remote and cross-border hiring. Veremark can help employers run global background checks and combine them with other screening steps such as employment history checks.

Making DBS checks fair and useful

DBS checks in the UK are there to help employers make safer decisions. They are not a shortcut for blanket rejection.

Where a certificate discloses information, the employer should assess relevance to the role, the nature of the offence, the time that has passed, the candidate’s explanation, and the risk involved in the work. DBS guidance expects employers to consider disclosed convictions and cautions case by case.

A fair DBS process does three things well. It asks for the right level of check, explains clearly what the candidate must disclose, and records the decision without keeping more sensitive data than necessary.

That is the standard employers should meet in 2026.

Order DBS checks and all other pre-screening checks through Veremark.