How to Run a Background Check in the UK
Running a background check can help you make an informed decision when hiring someone, choosing a business partner or verifying information. The checks available depend on why you need them and your relationship with the person. In the UK, privacy and data protection laws set important limits on what you can collect and how you can use it.
Start with a clear, lawful reason
Before you run a background check, decide what information is genuinely relevant and why you need it. Checks should be proportionate to the decision being made. For example, confirming a candidate’s qualifications may be appropriate for a role that requires specific credentials, while gathering unrelated personal information is unlikely to be justified.
If you are checking someone as part of a business process, explain what you intend to check, why you need it and how the information will be used. You will usually need to identify a lawful basis for processing personal data under UK data protection law, and keep the information secure and only for as long as necessary.
Choose the right type of check
A background check may involve one or more of the following:
- Identity and address checks: Verify details using documents or reputable verification services.
- Employment and education checks: Confirm relevant work history, references, qualifications or professional registrations. Ask for the person’s permission before contacting referees or institutions.
- Right to work checks: Employers must carry out the prescribed checks to establish a person’s right to work in the UK. Follow current Home Office guidance.
- Criminal record checks: In England and Wales, eligible employers can request the appropriate level of DBS check. Basic checks are available more widely, while Standard and Enhanced checks are restricted to roles that meet legal eligibility rules. Different arrangements apply in Scotland and Northern Ireland.
- Financial checks: Credit checks may be relevant for certain roles or transactions, but should only be used where there is a proper reason and the required permissions and safeguards are in place.
- Public record and company checks: Companies House and other official sources can help verify business information. Make sure any conclusions are based on accurate, up-to-date records.
Use reliable sources and verify what you find
Information found online can be incomplete, out of date or about someone with a similar name. Whenever possible, check important details against the original source, such as an awarding body, former employer or official register. Give the person a chance to clarify apparent errors before making a decision based on them.
Do not attempt to obtain information by deception, access someone’s accounts or devices without permission, or use data obtained unlawfully. A background check should not become an excuse for intrusive surveillance or gathering irrelevant details about someone’s private life.
Follow the rules for criminal record checks
DBS checks are not available at every level for every role. An employer must first establish that the role is eligible for the level of check requested. A basic DBS check shows unspent convictions and conditional cautions; higher-level checks can include additional information where the law allows. Disclosure rules differ across the UK, so check the relevant guidance for the location and role.
Criminal record information is sensitive personal data. Handle it confidentially, restrict access and do not make decisions automatically without considering the role, the circumstances and any relevant rehabilitation rules.
Make a fair decision
A background check should support a fair assessment, not replace one. Apply the same relevant standards to people in comparable situations, consider explanations and correct inaccuracies. If you are making a decision that could significantly affect someone, be transparent about the process and provide a suitable way for them to query the information.
When to seek professional advice
Requirements can vary depending on whether you are an employer, landlord, organisation or private individual, and on the type of information involved. If you are unsure whether a check is permitted or how to handle the results, consult the Information Commissioner’s Office (ICO), the appropriate government guidance or a qualified legal professional.
Running a background check responsibly means being clear about your purpose, using appropriate sources, respecting privacy and acting on information carefully. A lawful, proportionate process is more likely to produce useful results and protect everyone involved.
8 Essential Tips for Running a Background Check in the UK
- Get the person’s informed consent first.
- Check UK data protection and employment laws.
- Verify identity using reliable documents.
- Use reputable, authorised screening providers.
- Check only information relevant to the role.
- Confirm important findings with primary sources.
- Give the person a chance to correct errors.
- Store results securely and delete them when no longer needed.
Get the person’s informed consent first.
Before running a background check, explain clearly what you intend to check, why you need the information and how you will use and store it. Get the person’s informed consent where required, and make sure they understand what they are agreeing to. Consent does not make every type of check lawful or appropriate, so keep your enquiries relevant, proportionate and in line with UK data protection and other applicable laws.
Check UK data protection and employment laws.
Before running a background check, check that your process complies with UK data protection and employment laws. Be clear about why the information is needed, collect only what is relevant, identify a lawful basis for using personal data and explain the process to the person being checked. If the check relates to recruitment, make sure it is appropriate for the role and follow the rules on criminal record checks, including which DBS level is legally available. Keep information secure, restrict access and give the person a fair opportunity to query any inaccuracies before making a decision.
Verify identity using reliable documents.
Verify a person’s identity using reliable, current documents, such as a passport or photocard driving licence, and check that the details match the information they have provided. Where appropriate, use a reputable verification service and follow the relevant data protection requirements. Only collect the information you need, store it securely and avoid relying on a document alone if anything appears inconsistent.
Use reputable, authorised screening providers.
Use reputable, authorised screening providers with clear procedures for accuracy, privacy and data security. Before engaging a provider, check what information they collect, where it comes from and how they handle it, and confirm that any checks—particularly criminal record checks—are legally available for your purpose. Avoid services that promise access to restricted records or rely on unclear sources, and make sure the person being checked is informed where required.
Check only information relevant to the role.
Check only information that is relevant to the role and the responsibilities involved. For example, verifying professional qualifications may be appropriate for a specialist position, while unrelated details about someone’s personal life are unlikely to be necessary. Keeping checks focused helps protect privacy, supports fair decisions and reduces the risk of relying on irrelevant or misleading information.
Confirm important findings with primary sources.
Confirm important findings with primary sources wherever possible. For example, verify qualifications with the awarding institution, employment history with the relevant employer, and company details through official registers. Online profiles and third-party summaries can be outdated, incomplete or refer to someone with a similar name, so checking the original source helps reduce errors. Give the person an opportunity to explain or correct any significant discrepancy before relying on it.
Give the person a chance to correct errors.
Before acting on the results of a background check, give the person a reasonable opportunity to review and correct any information that may be inaccurate or out of date. Records can contain mistakes or refer to someone with a similar name, so verify disputed details with the original source and consider any explanation provided. This helps ensure decisions are fair, informed and based on reliable information.
Store results securely and delete them when no longer needed.
Store background-check results securely and limit access to people who genuinely need them. Use appropriate safeguards, such as password-protected systems and secure storage, and avoid keeping unnecessary copies. Set a clear retention period, then securely delete or destroy the information when it is no longer needed, in line with your legal obligations and data-protection policies.