UK GDPR and ICO Compliance for Background Checks: What Employers Must Get Right

Jurisdiction: This article covers UK data protection law, including the UK GDPR, the Data Protection Act 2018, and Information Commissioner's Office (ICO) guidance.

This article is for informational purposes only and does not constitute legal advice. Employment law and screening regulations vary by jurisdiction. Consult a qualified legal professional before making compliance decisions.

Background checks generate some of the most sensitive information an employer ever holds about a candidate: identity documents, criminal record disclosures, employment history, and sometimes credit data. Under the UK GDPR, that information carries clear rules on what to collect, how long to keep it, and how automated tools can use it.

2026 brought those rules into sharper focus. All data protection provisions of the Data (Use and Access) Act 2025 (DUAA) were in force by June 2026, including new rules on automated decision-making. The ICO is now updating its employment guidance to match.

What does UK GDPR require when processing candidate background check data?

UK GDPR requires a lawful basis for every background check, clear notice to candidates before each check, and only the information the role needs. Criminal record data needs an additional condition under the Data Protection Act 2018.

Verification and vetting are different activities

The ICO's draft recruitment and selection guidance separates two kinds of checks, and the distinction shapes everything that follows:

Verification: checking information the candidate has provided, such as qualifications, identity, and references

Pre-employment vetting: making your own enquiries with third parties about a candidate's background

The ICO describes vetting as particularly intrusive. Vetting is expected only where there is a legal obligation, such as Right to Work checks, or a significant and particular risk linked to the role.

Choosing a lawful basis

Depending on the check, the lawful basis is often legal obligation, as with Right to Work checks, or legitimate interests. The ICO advises caution with consent as a lawful basis in recruitment, because the imbalance of power between employer and candidate makes it hard to show consent was freely given. Asking a candidate to agree to a check remains good practice for transparency, but that agreement is separate from the lawful basis itself.

Where an employer relies on legitimate interests, the ICO expects a documented legitimate interests assessment. One assessment can cover a group of candidates when the reasons and information are the same.

Criminal record data needs an extra condition

Criminal offence data has its own protections under Article 10 of the UK GDPR. Employers without official authority need a condition from Schedule 1 of the Data Protection Act 2018. The ICO's draft guidance highlights two as most relevant:

Employment law obligations, such as safeguarding duties or Financial Conduct Authority conduct rules

Substantial public interest conditions, such as safeguarding, preventing unlawful acts, or preventing fraud

The ICO also expects a data protection impact assessment (DPIA) for criminal record vetting in most circumstances, because of the sensitivity of the data.

Transparency comes first

Before any check runs, candidates should know what will be checked and why. Candidates should also know which sources will be used, who will see the results, and how long the data will be kept. The ICO recommends explaining verification as early as possible, for example on the application form.

How long can employers retain background check data under UK GDPR?

UK GDPR sets no fixed retention periods for background check data. Employers keep it only as long as necessary and set a documented retention period for each category of information. For vetting data, the ICO's draft guidance expects secure destruction as soon as reasonably practicable once the recruitment decision is made.

Here is how retention typically works for the main types of check data.

Data type

Typical retention approach

Source of the rule

Vetting information, including third-party enquiries

Destroy securely once the decision is made, keeping a record of the outcome

ICO draft recruitment and selection guidance

DBS certificate information

Keep no longer than necessary for disputes or safeguarding audits, with no copies of the certificate retained

DBS guidance on handling certificate information

Right to Work check records

Keep for the duration of employment and two years afterwards

Home Office employer's guide

Unsuccessful candidates' records

Keep no longer than the period in which a legal claim could be brought, unless there is a clear reason

ICO draft recruitment and selection guidance

Statistical data

Anonymise fully before keeping

ICO draft recruitment and selection guidance

In summary, retention is set by purpose, and each type of check data has its own defensible period.

What to keep after destroying a DBS certificate

DBS guidance allows employers to keep a short record after the certificate information is destroyed: the date of issue, the applicant's name, the type of certificate, the position, the certificate reference number, and the recruitment decision. That record supports audits without retaining the disclosure itself.

Setting retention for unsuccessful candidates

The ICO notes that destroying records too quickly can make it harder to show a fair process, for example if a candidate makes a subject access request. Limitation periods for legal claims vary by claim and by UK nation, so many employers set retention with legal advice and apply it automatically.

What does ICO guidance say about candidate vetting data?

ICO guidance says vetting should be proportionate to an identified risk, targeted, and limited to the candidate you intend to appoint. Employers should not routinely vet every candidate unless the law requires it.

The ICO's draft guidance sets out five practical expectations:

Check the successful candidate: verify information for successful candidates where possible, and obtain criminal record disclosure only for the person you intend to appoint

Ask for the minimum: request only what the role needs, such as one identity document rather than two

Use the statutory route for criminal records: DBS in England and Wales, AccessNI in Northern Ireland, and Disclosure Scotland in Scotland

Resolve discrepancies fairly: give candidates a chance to explain any mismatch and record the decision

Justify extra checks: credit checks and public social media checks need a documented, role-specific reason

References follow the same principle. If a role only needs confirmed employment dates, the ICO's draft guidance suggests asking referees for that and nothing more.

One status point is worth knowing. The ICO's recruitment and selection guidance is still in draft, and the ICO has flagged it for review following the DUAA. Building processes around its core principles of necessity, proportionality, and transparency gives employers a stable foundation as the final version arrives.

What does the ICO say about using AI to process background check data?

The ICO supports AI in recruitment when it is lawful, fair, and transparent, with meaningful human involvement in decisions about candidates. Under the DUAA reforms now in force, significant decisions made solely by automated means require specific safeguards.

What the ICO's AI audits found

In November 2024, the ICO published the outcomes of consensual audits of AI recruitment tool providers. The regulator made almost 300 recommendations, and the companies accepted or partially accepted all of them. The recommendations focused on:

Processing personal information fairly and keeping it to a minimum

Collecting characteristics directly from candidates rather than inferring them

Monitoring for and mitigating potential discrimination

Giving candidates clear privacy information, including a retention period

Alongside the report, the ICO published key questions for organisations procuring AI recruitment tools, which make a practical starting checklist for any buyer.

Automated decision-making after the DUAA

Article 22A of the UK GDPR now defines automated decision-making as a decision based solely on automated processing with a legal or similarly significant effect. The ICO's draft recruitment guidance treats decisions to shortlist, interview, or reject a candidate as significant. Where such decisions are solely automated, Article 22C requires four safeguards:

Information for the candidate about the decision

The ability to make representations

The ability to obtain human intervention

The ability to contest the decision

Restrictions remain tighter where special category data is involved.

Meaningful human involvement in practice

Most screening workflows sit outside solely automated decision-making because a person makes the final call. Well-designed AI-powered hiring screening is built that way. The ICO's draft guidance describes what makes that involvement meaningful:

A person reviews automated outputs before a candidate progresses or is removed

That person can disagree with the AI and overturn its recommendation

Staff are trained not to give AI outputs undue weight

A DPIA covers the use of solely or partly automated tools

What are the most common UK GDPR mistakes in the hiring process?

The most common UK GDPR gaps in hiring come from habit rather than intent, and each has a simple fix built into the process.

Checking every applicant: the ICO expects verification and vetting to focus on successful candidates, so running checks at the conditional offer stage keeps processing proportionate.

Relying on consent as the lawful basis: identify the correct basis for each check and keep candidate agreement as a transparency step.

Collecting more than the role needs: set check packages by role, so a junior hire and a regulated role receive the checks each one requires.

Keeping data indefinitely: set a retention period for each data type and automate deletion.

Skipping the DPIA: complete one before introducing criminal record vetting or AI-assisted screening, and review it when the process changes.

How does AI-powered screening support UK GDPR-compliant workflows?

AI-powered screening supports UK GDPR compliance by applying the same rules to every candidate: configured check packages, consistent candidate notices, controlled access, automated retention, and a complete audit trail. People still make every hiring decision.

What a well-designed workflow handles

Role-based check packages, so each candidate receives only the checks the role justifies

One transparent candidate notice that explains each check, its source, and its retention period

Access controls that limit results to the people involved in the decision

An audit trail that records what was checked, when, and who reviewed it

Human review of every result before it reaches a decision-maker

Configured once, those controls turn compliance and regulatory screening into part of the hiring process rather than a separate project for compliance and risk teams.

How TRACE fits a UK GDPR-ready process

TRACE, TraqCheck's AI background verification agent, runs identity, criminal record, and employment verification in one consent-to-report workflow. Candidates receive a branded, mobile-friendly consent link that guides them through the process, and recruiters trigger checks from Greenhouse, Lever, Workday, or the API.

AI agents run checks in parallel and flag inconsistencies, and a human verification specialist reviews every result before the report reaches your team. TRACE is GDPR-ready, SOC 2 Type II and ISO 27001 certified, and keeps a full audit trail for every check. For candidates with overseas history, the same workflow extends across 190+ countries.

Making UK GDPR part of how you hire

UK GDPR and ICO guidance ask employers to do something sensible: check what each role genuinely needs and explain it clearly. Keep the data only as long as it serves a purpose, and keep a person at the centre of every hiring decision. With the DUAA now fully in force and the ICO updating its employment guidance, now is a good time to review check packages, retention periods, and DPIAs. Read more on the future of hiring compliance. To see how TRACE supports a consistent, audit-ready screening process for UK hiring, book a demo.

Frequently asked questions

What is the UK GDPR requirement for storing candidate background check data?

UK GDPR requires employers to keep background check data only as long as necessary and to store it securely. The ICO's draft guidance expects vetting data to be destroyed once the recruitment decision is made. Right to Work records are kept for the length of employment plus two years.

Can employers rely on consent for background checks under UK GDPR?

Usually not as the lawful basis. The ICO notes that the imbalance of power in recruitment makes freely given consent hard to show. Checks typically rely on another basis, such as legal obligation or legitimate interests. Asking for candidate agreement is still good practice for transparency.

How does ICO guidance affect how UK employers handle candidate vetting data?

ICO guidance expects vetting to be proportionate to an identified risk, limited to the candidate you intend to appoint, and explained to candidates in advance. Vetting data should be destroyed securely once it has served its purpose.

What condition do employers need to process criminal record data?

Employers without official authority need a condition under Schedule 1 of the Data Protection Act 2018, alongside a lawful basis. Employment law obligations and substantial public interest conditions, such as safeguarding or fraud prevention, are the most relevant.

What is the ICO's position on using AI to process candidate background check data?

The ICO supports AI in recruitment when it is lawful, fair, transparent, and subject to meaningful human involvement. Solely automated significant decisions require safeguards, including the right to obtain human intervention and to contest the decision.

Do employers need a DPIA for background checks?

The ICO expects a DPIA for criminal record vetting in most circumstances and for using solely or partly automated decision-making in recruitment, because both are high risk.