Handling of DBS certificate information
Updated 4 July 2018
© Crown copyright 2018
This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.
Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.
This publication is available at https://www.gov.uk/government/publications/handling-of-dbs-certificate-information/handling-of-dbs-certificate-information
1. Introduction
This guidance is in regards to the secure storage, handling, use, retention and disposal of Disclosure and Barring Service (DBS) certificates and certificate information.
The code of practice states that all registered bodies must have a written policy on the correct handling and safekeeping of DBS certificate information.
It also obliges registered bodies to make sure that a body or individual, on whose behalf they are countersigning applications, has a written policy.
To help you meet this requirement, the DBS has produced the following sample policy statement which can be used or adapted for this purpose.
2. Sample policy statement
2.1 General principles
As an organisation using the Disclosure and Barring Service (DBS) checking service to help assess the suitability of applicants for positions of trust, [Organisation Name] complies fully with the code of practice regarding the correct handling, use, storage, retention and disposal of certificates and certificate information.
It also complies fully with its obligations under the General Data Protection Regulation (GDPR), Data Protection Act 2018 and other relevant legislation pertaining to the safe handling, use, storage, retention and disposal of certificate information and has a written policy on these matters, which is available to those who wish to see it on request.
2.2 Storage and access
Certificate information should be kept securely, in lockable, non-portable, storage containers with access strictly controlled and limited to those who are entitled to see it as part of their duties.
2.3 Handling
In accordance with section 124 of the Police Act 1997, certificate information is only passed to those who are authorised to receive it in the course of their duties. We maintain a record of all those to whom certificates or certificate information has been revealed and it is a criminal offence to pass this information to anyone who is not entitled to receive it.
To note: organisations which are inspected by the Care Quality Commission (CQC) or Ofsted, and those establishments which are inspected by the Care and Social Services Inspectorate for Wales (CSSIW ) may be legally entitled to retain the certificate for the purposes of inspection.
In addition, organisations that require retention of certificates in order to demonstrate ‘safer recruitment’ practice for the purpose of safeguarding audits may be legally entitled to retain the certificate. This practice will need to be compliant with the Data Protection Act, Human Rights Act, General Data Protection Regulation (GDPR), and incorporated within the individual organisation’s policy on the correct handling and safekeeping of DBS certificate information.
2.4 Usage
Certificate information is only used for the specific purpose for which it was requested and for which the applicant’s full consent has been given.
2.5 Retention
Once a recruitment (or other relevant) decision has been made, we do not keep certificate information for any longer than is necessary. This retention will allow for the consideration and resolution of any disputes or complaints, or be for the purpose of completing safeguarding audits.
Throughout this time, the usual conditions regarding the safe storage and strictly controlled access will prevail.
2.6 Disposal
Once the retention period has elapsed, we will ensure that any DBS certificate information is immediately destroyed by secure means, for example by shredding, pulping or burning. While awaiting destruction, certificate information will not be kept in any insecure receptacle (e.g. waste bin or confidential waste sack).
We will not keep any photocopy or other image of the certificate or any copy or representation of the contents of a certificate. However, not withstanding the above, we may keep a record of the date of issue of a certificate, the name of the subject, the type of certificate requested, the position for which the certificate was requested, the unique reference number of the certificates and the details of the recruitment decision taken.
2.7 Acting as an umbrella body
Before acting as an umbrella body (an umbrella body being a registered body which countersigns applications and receives certificate information on behalf of other employers or recruiting organisations), we will take all reasonable steps to satisfy ourselves that they will handle, use, store, retain and dispose of certificate information in full compliance with the code of practice and in full accordance with this policy.
We will also ensure that any body or individual, at whose request applications for DBS certificates are countersigned, has such a written policy and, if necessary, will provide a model policy for that body or individual to use or adapt for this purpose.
3. DBS logo
The DBS logo is protected by crown copyright, the copying and use of the DBS logo is not permitted without prior approval of the DBS.