DBS record keeping

Certificate information is criminal-offence data, and the code of practice governs it

Every organisation that receives certificate information from the Disclosure and Barring Service (DBS) must comply with the DBS code of practice, and the DBS's guidance on handling certificate information gives a sample policy for meeting it. The code binds registered bodies, the organisations that submit and countersign applications, and every employer that receives certificate information through one; handling DBS certificate information correctly is a condition of being allowed to receive it at all. The sample policy is short and specific: certificate information "should be kept securely, in lockable, non-portable, storage containers with access strictly controlled and limited to those who are entitled to see it as part of their duties"; once a recruitment or other relevant decision has been made, it is not kept "for any longer than is necessary"; and when it goes, it "is immediately destroyed by secure means, for example by shredding, pulping or burning".

The data protection rules sit on top. Keeping children safe in education 2026 states that copies of DBS certificates and records of criminal information disclosed by a candidate "are covered by UK GDPR/DPA 2018 Article 10". Under the UK General Data Protection Regulation and the Data Protection Act 2018, criminal-offence data can only be processed under a condition in the Data Protection Act 2018, most organisations need an appropriate policy document to rely on the employment condition, and the ordinary principles of storage limitation and security apply with more force, not less. The ICO's UK GDPR guidance is the place to check the conditions.

The DBS also expects organisations that use its checks to have a written policy on the recruitment of ex-offenders and to use the information fairly: a conviction is considered for the purpose the certificate was obtained for, and a decision is about relevance to the role, not the existence of a record. Assurance checks by the DBS test whether you are following the code, so the record you keep has to show that you did. A breach of the code can cost a registered body its ability to obtain certificates, and a lost or leaked copy of a certificate is a personal data breach that may have to be reported to the ICO. The relevant legislation sits behind both: certificates are issued under Part V of the Police Act 1997, and the data protection rules govern everything you do with them afterwards.

Two facts organise everything below. First, the certificate is issued to the applicant, and they may show it to you; you are handling their document. Second, the register your organisation is required to keep is a record of checks, not a store of certificates. Once those are separated in your mind, most of the difficult questions answer themselves.

What you may record once the certificate has gone

The DBS sample policy lists what an organisation may keep after the certificate information has been destroyed: "the date of issue of a certificate, the name of the subject, the type of certificate requested, the position for which the certificate was requested, the unique reference number of the certificates and the details of the recruitment decision taken". It is explicit that a photocopy or image of a certificate, or of its contents, is not on that list.

For schools and colleges in England, Keeping children safe in education adds the register itself. Part 3 requires every school and college to "maintain a single central record of pre-appointment checks", and it says what the record must indicate: whether each of the following checks has been carried out or certificates obtained, and the date on which each check was completed or certificate obtained.

• An identity check.
• A standalone children's barred list check, where one was needed before an enhanced certificate arrived.
• An enhanced DBS check with children's barred list check, requested or certificate provided.
• A prohibition from teaching check for anyone employed to carry out teaching work.
• Further checks on people who have lived or worked outside the UK.
• A check of professional qualifications, where the role requires one.
• A check of the person's right to work in the United Kingdom.
• In addition, colleges must record whether the position involves relevant activity with under-18s, and independent schools, academies and free schools must record the section 128 checks carried out for people in management positions.

Keep a record, in other words, of the check and the decision, for a specific purpose. The record must cover all staff, including salaried teacher trainees and agency or third-party supply staff "even if they work for one day", and a multi-academy trust must maintain it for each academy. It "can be kept in paper or electronic form", and the guidance is clear that schools and colleges "do not have to keep copies of DBS certificates, in order to fulfil the duty of maintaining the single central record". When a person leaves, their details come off the register.

Notice what the register does not hold. It does not hold what the certificate said. It records that the check was made, when, and, in the case of the DBS check, that a certificate was seen and a decision was taken. The reasoning behind a decision where a certificate disclosed something belongs in a restricted file with a named owner, and only the outcome reaches the register.

Outside education the register is not statutory, but the same shape is the right one. A care provider registered with the CQC has to be able to show that the information Regulation 19 asks for about fitness was obtained; a charity has to be able to show a trustee that its safer recruitment policy was followed. In every case the evidence is a dated line saying what was checked, by whom and what was decided, not a drawer of certificates.

Copies, and the six months

You do not need a copy of the certificate at all. If you choose to keep one, Keeping children safe in education says "there should be a valid reason for doing so and it should not be kept for longer than six months". The Department for Education's record-keeping guidance for schools puts the same limit as six months from the date of recruitment, then secure disposal. The DBS employer guidance describes the code's expectation in the same terms: information "should be destroyed after a suitable period has passed – usually no longer than 6 months".

The sample policy allows retention beyond the decision in narrow cases: to resolve a dispute or complaint, to complete a safeguarding audit, and, for organisations inspected by the CQC, Ofsted or the Welsh inspectorate, for inspection purposes. Each of those is a reason you can write down beside the copy, with a date on which the reason expires. "In case" is not one of them.

Retention and disposal are one decision, made at the start. A copy is a copy wherever it lives. The scan attached to the recruitment email, the PDF in the shared HR folder, the photograph a manager took of the certificate on their phone and the image forwarded into a staff group are all certificate information under the code, and none of them is in a lockable, non-portable container with access limited to people who need it. The six months apply to them too, and they are far harder to find and destroy than the paper.

Disposal has to be secure and it has to be recorded. Shred or pulp paper, delete digital copies from every location including email and backups you control, and note the date and the person who did it. A disposal log is short: reference, category, date, method, name. It is the evidence that the six months meant something.

The person's own certificate is theirs. Do not retain it "for them", do not keep it because they might apply again, and do not ask for it back after they leave. If they subscribed to the Update Service you can ask them to share their status the next time it matters.

Which check the role needs, and what an Update Service status check tells you

A DBS check is a criminal record check, and recording the right one starts with requesting the right one. The DBS check process differs by level, and standard and enhanced DBS checks are only available for eligible roles. The DBS guidance for employers describes four levels. A basic certificate shows unspent convictions and cautions. A standard certificate shows spent and unspent convictions and adult cautions that have not been filtered. An enhanced certificate adds information held by police forces. An enhanced certificate with barred list check adds a check against the children's or adults' barred list, and is for people carrying out regulated activity.

Anyone may be asked for a basic check. Standard and enhanced checks can only be requested where the role is eligible under the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975, which is why the register records the position the certificate was requested for. A volunteer application for a standard or enhanced check is free of charge if the person is genuinely unpaid and does not benefit from the position; a basic check for a volunteer is not. Our volunteer records guide covers how a charity records eligibility decisions without keeping certificate images.

The DBS Update Service lets an applicant keep a standard or enhanced certificate current, provided they subscribe within 30 days of its issue. With their consent an employer can then run a status check, which tells you whether anything has changed since the certificate was issued. For schools and colleges, KCSIE is explicit that when using the Update Service "you still need to obtain the original physical certificate". A status check is a check like any other: record the date, who carried it out, the certificate it relates to and the result, and treat any change as a new decision to be reasoned and recorded.

The Disclosure and Barring Service Update Service is, in the words of the DBS’s Update Service employer guide, “an online subscription service for individuals who hold Standard or Enhanced DBS checks that lets organisations and employers carry out a free, instant online check to view the status of an existing Standard or Enhanced DBS certificate.” The subscription belongs to the applicant, costs £15 a year and is free to volunteers, and it does not cover basic checks. An employer may run a status check only with the person’s consent, where it could legally request a new check of the same level for the role, and for the same workforce (child, adult or other). Before running a status check the employer must have seen the original paper certificate – the guide says “Copies or viewing the certificate over video link is not enough” – and checked the person’s identity.

The DBS does not tell an employer when something changes: “DBS won’t inform you if a status changes”. The guide sets “no prescribed frequency” for status checks and asks organisations to “determine an appropriate risk-based schedule”. A status check returns one of four results: the certificate was blank and remains current; it disclosed information and remains current; it “is no longer current”, meaning new information would appear on a new check, which then has to be applied for; or the details entered do not match, usually because the person has not subscribed or has removed the certificate. When the person leaves, moves to a role without the same entitlement or withdraws consent, the checks must stop. The DBS says “You can print and keep a copy of status checks, as long as you protect the information in line with the DBS code of practice” and data protection law.

Where someone must start work in regulated activity before an enhanced certificate arrives, KCSIE requires a separate children's barred list check first; the register records that standalone check and its date, and then the certificate when it comes. Where a person has lived or worked outside the UK, the further checks are recorded as their own line, not folded into the DBS entry.

Care providers registered with the Care Quality Commission should read this alongside our CQC record-keeping guide: the checks are the same, the register is not called the single central record, and the inspector will still ask to see it.

Who may see it, and where it lives

The sample policy's phrase is "entitled to see it as part of their duties". In a small organisation that is the person making the recruitment decision, the person maintaining the register and, where a certificate discloses something, the person who assesses relevance. It is not the rota editor, the line manager who is curious, or the whole office because the HR folder is shared with everyone.

Safe handling of DBS certificates and certificate information means keeping three things apart. The register, which the people who administer recruitment need and an inspector will ask for. The restricted file, holding the reasoning behind any decision where a certificate disclosed information, with a named owner and a short access list. And the certificate copy, if you have one at all, in the lockable, non-portable place the sample policy describes, with its disposal date already written down.

Tell candidates how their information will be handled. A short statement in the recruitment pack that says who will see the certificate, that a copy will not be kept beyond six months without a stated reason, and that any information will be considered only for its relevance to the role, is both the code's expectation and the fair thing to do. Your policy on the recruitment of ex-offenders should be available to applicants.

Review access when roles change and when people leave. The former deputy who kept the register does not need to keep the login, and the certificate copy that was retained for an inspection last spring has probably passed its date.

"Has her DBS come back yet?" – the question that ends up in a chat

Most DBS record-keeping failures do not happen in the register. They happen in the conversation around it. A manager asks in the staff group whether a new starter's check has come back. Someone replies with a photograph of the certificate. A decision to let a volunteer start on the basis of a standalone barred list check is taken in a direct message and never reaches the register. Each of those is now certificate information, or a recruitment decision, held in a place the code never contemplated and your organisation cannot police.

The fix is not to stop people asking. It is to give the answer somewhere to land. The register line is the answer to "has it come back": a date and a yes. The restricted file is the answer to "was there anything on it": a reasoned decision by a named person. A message can say "the register is updated, she can start Monday"; it should never carry the certificate.

ComplyChat provides a channel for the work conversations around recruitment and safeguarding. On paid plans, the lasting record files into the organisation's own Microsoft 365 once the archive is connected and filing, so the decision to let someone start is producible later without anyone searching a personal phone. It is not a DBS checking service, it does not verify certificates and it is not the place to store them. ComplyChat Free is personal messaging with one private group, direct messages and three calendar months of recent history, with no Microsoft 365 archive or Replay; upgrading cannot restore expired history. It is a way to explore the messaging experience, not a record system.

A useful question for the next leadership meeting: if the DBS asked to see how we handled the last certificate that disclosed something, could we show the register line, the reasoned decision and the disposal date, without asking anyone to scroll back through their messages?

Questions people ask

How long should DBS records be kept?

Certificate information should be kept no longer than necessary after the recruitment decision, which the DBS guidance for employers puts at "usually no longer than 6 months", and then destroyed by secure means. After that, the DBS sample policy allows a record of the date of issue, the subject's name, the certificate type, the position, the unique reference number and the recruitment decision.

What is the 3 month rule for DBS?

The DBS sets no three-month limit on a certificate: its guidance for employers says "There is no official expiry date for a criminal record check issued by DBS", and it is for the employer to decide whether a newer check is needed. Any three-month limit is an employer's own policy; the DBS says only that in certain employment sectors a new check may be required periodically. Separately, some types of caution are spent after 3 months and no longer show on a basic check.

Can I use a DBS from 3 years ago?

Only if the new employer agrees: the DBS says "It's the employers' decision to decide whether to accept a previously-issued DBS check". It asks employers to consider that the person's criminal record may have changed since the certificate was issued and that the level of check may not be right for the new role. If the person joined the Update Service within 30 days of the certificate's issue, a status check shows whether anything has changed since.

Can I check my own DBS record?

Yes, at basic level: anyone aged 16 or over working in England and Wales can apply online for a basic DBS check "to get a copy of your criminal record", which costs £21.50 (Request a basic DBS check). It shows only convictions and cautions that are not spent; standard and enhanced checks can only be requested for an eligible role.

Do I need to keep old DBS certificates?

No. Keeping children safe in education 2026 says schools and colleges "do not have to keep copies of DBS certificates, in order to fulfil the duty of maintaining the single central record", and the DBS sample policy says an organisation will not keep "any photocopy or other image of the certificate". Keep the record of the check and the decision instead.

Can I keep a copy of a DBS certificate?

Only with a valid reason and for a limited time: Keeping children safe in education 2026 says that when a school or college keeps a copy, "there should be a valid reason for doing so and it should not be kept for longer than six months". The DfE's record-keeping guidance for schools gives the same six months from the date of recruitment, then secure disposal.

Official guidance and your next step

The primary sources are the DBS code of practice, the DBS's guidance on handling certificate information, the DBS guidance for employers, Part 3 of Keeping children safe in education 2026 and the DfE's record-keeping guidance for schools. Quotations in this guide are from those documents as published on 12 September 2026; check the current versions before relying on a figure.

This guide is a practical starting point for organisations in England, not legal advice about an individual, a certificate or a disputed decision. Have the people responsible for safer recruitment and data protection review the parts that apply to your roles.

Then do one thing: open your register, pick five recent starters, and for each ask whether the row shows every check KCSIE or your policy requires, whether any certificate copy still exists, and whether you could say where the reasoning for the decision is held. Fix what you find before adding fields.