Consent for Criminal Record Checks: Understanding UK Legal Requirements
Contents
- What Is Consent?
- Why Consent for Criminal Record Checks Is Legally Required
- What Counts as Valid Consent?
- When Is Consent Not Enough?
- How Employers Should Collect Consent
- Can an Applicant Refuse Consent?
- What Happens If Consent Is Withdrawn?
- Common Employer Mistakes
- Best Practice Checklist
Understanding Consent for Criminal Record Checks
Criminal record checks play an important role in safer recruitment, helping employers make informed hiring decisions while protecting vulnerable groups and sensitive roles. However, because criminal record information is highly sensitive personal data, UK law places strict requirements on how it can be collected and used — with consent for criminal record checks being a key part of the process.
For employers, recruiters, and HR professionals, understanding what valid consent for criminal record checks looks like under UK law is essential. Getting it wrong can lead to legal penalties, data protection breaches, and reputational damage. For individuals, consent ensures transparency and fairness throughout the background checking process.
This article explains why consent for criminal record checks is required, what counts as valid consent, and how employers can collect it correctly when carrying out criminal record checks in the UK.
What Is Consent in the Context of Criminal Record Checks?
In simple terms, consent means that an individual has clearly agreed to their criminal record being checked, fully understanding what information will be accessed and why.
Under the UK General Data Protection Regulation (UK GDPR), criminal record data is classed as special category data. This makes obtaining proper consent for criminal record checks especially important, as it is subject to stronger legal protections than most personal information.
Employers cannot lawfully carry out a criminal record check without the individual’s knowledge and agreement.
Consent must be an active choice. Silence, inaction, or assumptions do not count. The individual must take a clear step to confirm they agree, such as signing a consent form or completing a digital application.
Why Is Consent for Criminal Record Checks Legally Required?
Criminal record information can have a significant impact on a person’s employment prospects, reputation, and privacy. Because of this, UK law requires that individuals are treated fairly and transparently when consent for criminal record checks is requested.
Several legal frameworks govern consent for criminal record checks, including:
- UK GDPR
- Data Protection Act 2018
- Regulations issued by the Disclosure and Barring Service (DBS)
Together, these laws ensure that criminal record checks are only carried out when there is a genuine legal justification and when valid consent for criminal record checks has been obtained.
Employers who fail to obtain proper consent risk serious consequences, including fines from the Information Commissioner’s Office (ICO), legal claims, and loss of trust from candidates and employees.
What Counts as Valid Consent?
Not all consent is created equal. For consent for criminal record checks to be valid under UK law, it must meet several strict criteria.
Freely Given
The individual must not feel pressured or forced into agreeing. Consent should not be a condition of employment unless the check is genuinely necessary for the role.
Specific
Consent must relate clearly to a criminal record check. Vague or general permission to “process data” is not sufficient to qualify as valid consent for criminal record checks.
Informed
The individual must understand what type of check is being carried out, what information may be disclosed, and how the results will be used.
Unambiguous
There must be a clear affirmative action, such as ticking a box, signing a form, or submitting an online application.
Employers should ensure that consent for criminal record checks is clearly presented and easy to understand, rather than hidden within lengthy policies or contracts.
When Is Consent Not Enough on Its Own?
While consent for criminal record checks is essential, it does not automatically make a criminal record check lawful.
Employers must also ensure that:
- The role is eligible for a criminal record check
- The correct level of check is used (Basic, Standard, or Enhanced)
- There is a lawful basis for processing criminal record data
Consent for criminal record checks cannot override eligibility rules. Carrying out a higher-level check without proper justification is unlawful, even if consent has been given.
How Should Employers Collect Consent for Criminal Record Checks?
Collecting consent for criminal record checks properly is just as important as obtaining it.
Best practice for employers includes:
- Requesting consent in writing or digitally, rather than verbally
- Clearly explaining:
- The type of criminal record check being carried out
- Why the check is required for the role
- What information may be disclosed
- Who will see the results
- How long the information will be stored
Consent should be collected before the check begins, and records of consent for criminal record checks should be securely stored for audit and compliance purposes.
Can an Applicant Refuse Consent?
Yes — individuals have the right to refuse consent for a criminal record check.
If consent for criminal record checks is refused, employers must consider whether the check is genuinely necessary for the role.
What Happens If Consent Is Withdrawn?
Under UK GDPR, individuals can withdraw their consent at any time.
If consent for criminal record checks is withdrawn before the check is carried out, the employer must stop the process immediately.
Common Employer Mistakes to Avoid
- Assuming consent is automatic once a job offer is made
- Carrying out checks too early in the recruitment process
- Using an incorrect level of check
- Failing to explain how results will be used
- Storing DBS information for longer than legally permitted
Best Practice Checklist
Before carrying out a criminal record check, employers should ensure they:
- Confirm the role is eligible
- Use the correct level of check
- Clearly explain the process
- Obtain explicit consent for criminal record checks
- Store data securely and limit access
- Delete information in line with retention rules
Conclusion
Consent for criminal record checks is not just a formality — it is a legal and ethical requirement in the UK. Employers must ensure that consent is clear, informed, and properly recorded, while also ensuring the check itself is lawful and proportionate.
By handling consent for criminal record checks correctly, organisations can protect themselves from legal risk, build trust with candidates, and demonstrate a fair and transparent approach to safer recruitment.