DBS record keeping

Certificate information is criminal-offence data, and the code of practice governs it

Every organisation that receives certificate information from the Disclosure and Barring Service (DBS) must comply with the DBS code of practice on handling certificate information. The code binds registered bodies, the organisations that submit and countersign applications, and every employer that receives certificate information through one; handling DBS certificate information correctly is a condition of being allowed to receive it at all. Its rules are short and specific: certificate information "should be kept securely, in lockable, non-portable, storage containers with access strictly controlled and limited to those who are entitled to see it as part of their duties"; once a recruitment or other relevant decision has been made, it is not kept "for any longer than is necessary"; and when it goes, it "is immediately destroyed by secure means, for example by shredding, pulping or burning".

The data protection rules sit on top. Keeping children safe in education 2026 states that copies of DBS certificates and records of criminal information disclosed by a candidate "are covered by UK GDPR/DPA 2018 Article 10". Under the UK General Data Protection Regulation and the Data Protection Act 2018, criminal-offence data can only be processed under a condition in the Data Protection Act 2018, most organisations need an appropriate policy document to rely on the employment condition, and the ordinary principles of storage limitation and security apply with more force, not less. The ICO's UK GDPR guidance is the place to check the conditions.

The DBS also expects organisations that use its checks to have a written policy on the recruitment of ex-offenders and to use the information fairly: a conviction is considered for the purpose the certificate was obtained for, and a decision is about relevance to the role, not the existence of a record. Assurance checks by the DBS test whether you are following the code, so the record you keep has to show that you did. A breach of the code can cost a registered body its ability to obtain certificates, and a lost or leaked copy of a certificate is a personal data breach that may have to be reported to the ICO. The relevant legislation sits behind both: certificates are issued under Part V of the Police Act 1997, and the data protection rules govern everything you do with them afterwards.

Two facts organise everything below. First, the certificate is issued to the applicant, and they may show it to you; you are handling their document. Second, the register your organisation is required to keep is a record of checks, not a store of certificates. Once those are separated in your mind, most of the difficult questions answer themselves.

What you may record once the certificate has gone

The code of practice lists what an organisation may keep after the certificate information has been destroyed: "the date of issue of a certificate, the name of the subject, the type of certificate requested, the position for which the certificate was requested, the unique reference number of the certificates and the details of the recruitment decision taken". It is explicit that a photocopy or image of a certificate, or of its contents, is not on that list.

For schools and colleges in England, Keeping children safe in education adds the register itself. Part 3 requires every school and college to "maintain a single central record of pre-appointment checks", and it says what the record must indicate: whether each of the following checks has been carried out or certificates obtained, and the date on which each check was completed or certificate obtained.

• An identity check.
• A standalone children's barred list check, where one was needed before an enhanced certificate arrived.
• An enhanced DBS check with children's barred list check, requested or certificate provided.
• A prohibition from teaching check for anyone employed to carry out teaching work.
• Further checks on people who have lived or worked outside the UK.
• A check of professional qualifications, where the role requires one.
• A check of the person's right to work in the United Kingdom.
• In addition, colleges must record whether the position involves relevant activity with under-18s, and independent schools, academies and free schools must record the section 128 checks carried out for people in management positions.

Keep a record, in other words, of the check and the decision, for a specific purpose. The record must cover all staff, including salaried teacher trainees and agency or third-party supply staff "even if they work for one day", and a multi-academy trust must maintain it for each academy. It "can be kept in paper or electronic form", and the guidance is clear that schools and colleges "do not have to keep copies of DBS certificates, in order to fulfil the duty of maintaining the single central record". When a person leaves, their details come off the register.

Notice what the register does not hold. It does not hold what the certificate said. It records that the check was made, when, and, in the case of the DBS check, that a certificate was seen and a decision was taken. The reasoning behind a decision where a certificate disclosed something belongs in a restricted file with a named owner, and only the outcome reaches the register.

Outside education the register is not statutory, but the same shape is the right one. A care provider registered with the CQC has to be able to show that the information Regulation 19 asks for about fitness was obtained; a charity has to be able to show a trustee that its safer recruitment policy was followed. In every case the evidence is a dated line saying what was checked, by whom and what was decided, not a drawer of certificates.

Copies, and the six months

You do not need a copy of the certificate at all. If you choose to keep one, Keeping children safe in education says "there should be a valid reason for doing so and it should not be kept for longer than six months". The Department for Education's record-keeping guidance for schools puts the same limit as six months from the date of recruitment, then secure disposal. The DBS employer guidance describes the code's expectation in the same terms: information "should be destroyed after a suitable period has passed – usually no longer than 6 months".

The code allows retention beyond the decision in narrow cases: to resolve a dispute or complaint, to complete a safeguarding audit, and, for organisations inspected by the CQC, Ofsted or the Welsh inspectorate, for inspection purposes. Each of those is a reason you can write down beside the copy, with a date on which the reason expires. "In case" is not one of them.

Retention and disposal are one decision, made at the start. A copy is a copy wherever it lives. The scan attached to the recruitment email, the PDF in the shared HR folder, the photograph a manager took of the certificate on their phone and the image forwarded into a staff group are all certificate information under the code, and none of them is in a lockable, non-portable container with access limited to people who need it. The six months apply to them too, and they are far harder to find and destroy than the paper.

Disposal has to be secure and it has to be recorded. Shred or pulp paper, delete digital copies from every location including email and backups you control, and note the date and the person who did it. A disposal log is short: reference, category, date, method, name. It is the evidence that the six months meant something.

The person's own certificate is theirs. Do not retain it "for them", do not keep it because they might apply again, and do not ask for it back after they leave. If they subscribed to the Update Service you can ask them to share their status the next time it matters.

Which check the role needs, and what an Update Service status check tells you

A DBS check is a criminal record check, and recording the right one starts with requesting the right one. The DBS check process differs by level, and standard and enhanced DBS checks are only available for eligible roles. The DBS guidance for employers describes four levels. A basic certificate shows unspent convictions and cautions. A standard certificate shows spent and unspent convictions and adult cautions that have not been filtered. An enhanced certificate adds information held by police forces. An enhanced certificate with barred list check adds a check against the children's or adults' barred list, and is for people carrying out regulated activity.

Anyone may be asked for a basic check. Standard and enhanced checks can only be requested where the role is eligible under the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975, which is why the register records the position the certificate was requested for. A volunteer application for a standard or enhanced check is free of charge if the person is genuinely unpaid and does not benefit from the position; a basic check for a volunteer is not. Our volunteer records guide covers how a charity records eligibility decisions without keeping certificate images.

The DBS Update Service lets an applicant keep a standard or enhanced certificate current, provided they subscribe within 30 days of its issue. With their consent an employer can then run a status check, which tells you whether anything has changed since the certificate was issued. For schools and colleges, KCSIE is explicit that when using the Update Service "you still need to obtain the original physical certificate". A status check is a check like any other: record the date, who carried it out, the certificate it relates to and the result, and treat any change as a new decision to be reasoned and recorded.

Where someone must start work in regulated activity before an enhanced certificate arrives, KCSIE requires a separate children's barred list check first; the register records that standalone check and its date, and then the certificate when it comes. Where a person has lived or worked outside the UK, the further checks are recorded as their own line, not folded into the DBS entry.

Care providers registered with the Care Quality Commission should read this alongside our CQC record-keeping guide: the checks are the same, the register is not called the single central record, and the inspector will still ask to see it.

Who may see it, and where it lives

The code's phrase is "entitled to see it as part of their duties". In a small organisation that is the person making the recruitment decision, the person maintaining the register and, where a certificate discloses something, the person who assesses relevance. It is not the rota editor, the line manager who is curious, or the whole office because the HR folder is shared with everyone.

Safe handling of DBS certificates and certificate information means keeping three things apart. The register, which the people who administer recruitment need and an inspector will ask for. The restricted file, holding the reasoning behind any decision where a certificate disclosed information, with a named owner and a short access list. And the certificate copy, if you have one at all, in the lockable, non-portable place the code describes, with its disposal date already written down.

Tell candidates how their information will be handled. A short statement in the recruitment pack that says who will see the certificate, that a copy will not be kept beyond six months without a stated reason, and that any information will be considered only for its relevance to the role, is both the code's expectation and the fair thing to do. Your policy on the recruitment of ex-offenders should be available to applicants.

Review access when roles change and when people leave. The former deputy who kept the register does not need to keep the login, and the certificate copy that was retained for an inspection last spring has probably passed its date.

"Has her DBS come back yet?" – the question that ends up in a chat

Most DBS record-keeping failures do not happen in the register. They happen in the conversation around it. A manager asks in the staff group whether a new starter's check has come back. Someone replies with a photograph of the certificate. A decision to let a volunteer start on the basis of a standalone barred list check is taken in a direct message and never reaches the register. Each of those is now certificate information, or a recruitment decision, held in a place the code never contemplated and your organisation cannot police.

The fix is not to stop people asking. It is to give the answer somewhere to land. The register line is the answer to "has it come back": a date and a yes. The restricted file is the answer to "was there anything on it": a reasoned decision by a named person. A message can say "the register is updated, she can start Monday"; it should never carry the certificate.

ComplyChat provides a channel for the work conversations around recruitment and safeguarding. On paid plans, the lasting record files into the organisation's own Microsoft 365 once the archive is connected and filing, so the decision to let someone start is producible later without anyone searching a personal phone. It is not a DBS checking service, it does not verify certificates and it is not the place to store them. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive or Replay; upgrading cannot restore expired history. It is a way to explore the messaging experience, not a record system.

A useful question for the next leadership meeting: if the DBS asked to see how we handled the last certificate that disclosed something, could we show the register line, the reasoned decision and the disposal date, without asking anyone to scroll back through their messages?

Official guidance and your next step

The primary sources are the DBS code of practice on handling certificate information, the DBS guidance for employers, Part 3 and Annex B of Keeping children safe in education 2026 and the DfE's record-keeping guidance for schools. Quotations in this guide are from those documents as published on 12 September 2026; check the current versions before relying on a figure.

This guide is a practical starting point for organisations in England, not legal advice about an individual, a certificate or a disputed decision. Have the people responsible for safer recruitment and data protection review the parts that apply to your roles.

Then do one thing: open your register, pick five recent starters, and for each ask whether the row shows every check KCSIE or your policy requires, whether any certificate copy still exists, and whether you could say where the reasoning for the decision is held. Fix what you find before adding fields.