11Aug 2026

Pre-employment checks explained: a UK employer's guide

UK security officer holding identity document

Pre-employment checks are the formal verification steps an employer carries out before a new hire starts work, confirming identity, legal right to work, criminal history where relevant, and the accuracy of a candidate’s claimed qualifications and experience. For UK employers, two checks are non-negotiable regardless of sector: a right to work check before the start date, and a DBS check at the appropriate level for any role that legally requires one.

The legal stakes are real. Employing someone without a valid right to work check exposes your organisation to a civil penalty of up to £60,000 per illegal worker under the Immigration, Asylum and Nationality Act 2006. Carry out the check correctly and you establish a statutory excuse, which protects you from that penalty even if the employee later turns out not to have had the right to work.

The Rehabilitation of Offenders Act 1974 shapes what criminal record information you can ask about and what must appear on a DBS certificate. Spent convictions are generally off the table for basic checks, though they can appear on standard and enhanced certificates for eligible roles.

The non-negotiable checks at a glance:

  • Right to work: mandatory for every hire, before day one
  • DBS check: required by law for roles involving children, vulnerable adults, or specific regulated activities; optional but advisable for security and other sensitive positions
  • Identity verification: confirm the person in front of you matches the documents they present
  • References: at least one employment reference for most roles; two is standard practice
  • Qualifications and professional registrations: verify where the role requires a licence or accreditation (an SIA licence for door supervisors, for example)
  • Health checks: only where a legal requirement or genuine job-essential need exists

Pro Tip: Start the right to work check on the day you make a conditional offer, not on the first day of employment. Running it early flags problems before you have invested time in onboarding.

Key takeaways

Pre-employment checks in the UK are a legal and practical requirement: right to work must be verified before day one, DBS checks must match the role’s legal entitlement, and all results must be documented and retained for at least two years after employment ends.

Point Details
Right to work is mandatory Check before the start date using one of three prescribed routes; retain copies for two years after employment ends.
DBS level must match the role Only request the level the role is legally entitled to; enhanced checks may be delayed by police force review.
Conditional offers protect you Word offers as conditional on named checks; give candidates a chance to respond to adverse results before withdrawing.
Health checks need consent Only ask for health information post-offer unless a legal requirement exists; obtain written consent and keep records separate.
Document everything A signed checklist filed with the candidate record is your audit trail for statutory excuse and ICO compliance.

Table of Contents

1. How to carry out right to work checks and establish a statutory excuse

The core legal duty is straightforward: check before employment begins, not after. If permission to work is time-limited, you must also carry out a follow-up check before that permission expires.

The Employer’s guide to right to work checks sets out three prescribed routes. Use the one that fits your applicant:

The three prescribed check routes:

  1. Manual document check — the applicant presents original documents from List A or List B of the Home Office guidance. You check them in the applicant’s presence, make a clear copy, and record the date.
  2. Home Office online check (share code) — the applicant generates a share code via the UK Visas and Immigration service. You enter the code and their date of birth at the online checking service. A confirmed result provides a statutory excuse.
  3. Digital Identity Verification (DVS) — available for British and Irish passport holders only. You use a certified Identity Service Provider (IDSP) to verify the document digitally. This route is only valid when the provider is on the Home Office’s certified DVS register.

When to use the Employer Checking Service (ECS):

The ECS is for edge cases where a manual or online check is not possible, for example when an applicant has an outstanding immigration application or appeal and cannot produce acceptable documents. Submit a request to the ECS and, if the applicant does have the right to work, you will receive a Positive Verification Notice (PVN). A PVN gives you a statutory excuse for six months.

Record keeping steps to retain a statutory excuse:

  • Make a clear, non-editable copy of every document checked (both sides of a biometric residence permit)
  • Record the date you carried out the check on the copy itself
  • Keep copies securely throughout employment and for two years after employment ends
  • For online checks, retain a screenshot or PDF of the Home Office result page, including the date

Step-by-step process before the start date:

  1. Identify which check route applies to this applicant
  2. Carry out the check in person or via the prescribed digital route
  3. Copy and date-stamp the documents or save the online result
  4. File securely in the candidate’s personnel record
  5. Diarise a follow-up check if the applicant’s permission to work has an expiry date
  6. If documents are unclear or unavailable, contact the ECS before proceeding

Pro Tip: For roles where you are hiring multiple candidates simultaneously, create a right to work tracking spreadsheet with columns for check date, method used, document type, expiry date, and follow-up due date. Auditors will thank you.

2. DBS checks: choosing the right level for your role

The DBS checks guidance for employers is clear on one point: you may only request the level of check to which the role is legally entitled. Requesting a higher level than the role warrants is not permitted, regardless of how cautious you want to be.

There are four levels, each disclosing progressively more information:

DBS level What it discloses Who can request it
Basic Unspent convictions and conditional cautions only Any employer, for any role
Standard Spent and unspent convictions, cautions, reprimands, warnings Roles listed in the Rehabilitation of Offenders Act 1974 (Exceptions) Order
Enhanced All of the above, plus any relevant information held by local police Roles in regulated activity with children or vulnerable adults
Enhanced with Barred List(s) All of the above, plus a check against the children’s and/or adults’ barred lists Roles in regulated activity only

Choosing the right level by role type:

A basic check suits most security roles where regulated activity is not involved: retail security officers, event stewards, or corporate reception security. Standard checks apply to roles such as certain financial services positions or legal professionals. Enhanced checks are appropriate for roles involving direct, unsupervised contact with children or vulnerable adults, such as a security officer working in a hospital ward or a school. Enhanced with barred lists is reserved for regulated activity, where being on a barred list is a legal bar to employment.

For security roles specifically, the SIA licence process already incorporates a criminal record check, but employers often run their own basic DBS check as an additional layer, particularly for roles not covered by the SIA licensing regime.

How DBS checks are requested:

Employers request standard and enhanced checks through a Registered Body or an Umbrella Body. The applicant completes the application form and provides identity documents. For basic checks, applicants can apply directly via the DBS website, or employers can use a Responsible Organisation. The basic DBS check guidance confirms both routes are available.

Why enhanced checks take longer:

Enhanced DBS applications may be referred to one or more police forces when there is a potential match on police records. Each force assesses whether the information is relevant to the workforce in question before deciding whether to disclose it. That assessment takes time, and there is no fixed deadline for police forces to complete their review. Budget for this when planning your hiring timeline.

Pro Tip: Never use a DBS certificate as the sole basis for a hiring decision. The certificate is a snapshot of the moment it was issued. A candidate could acquire a conviction the day after you receive it. Treat DBS as one layer of a broader safer recruitment process.

3. Identity checks, qualifications, and how to take references that actually tell you something

Verifying identity

Identity verification sits alongside the right to work check but serves a different purpose: confirming that the person in front of you is who they claim to be, not just that someone with those documents has the right to work. Check that the photograph matches the person, that the date of birth is consistent across documents, and that any name changes are explained with supporting evidence such as a marriage certificate.

Gloved hands checking UK identity documents

For British and Irish passport holders, Digital Identity Verification Technology (IDVT) via a certified provider offers a faster, more reliable alternative to manual document inspection. The provider checks the document’s chip data and biometric features against the applicant’s live image.

Verifying qualifications and professional registrations:

  1. Ask for original certificates, not photocopies, for any qualification that is a condition of employment
  2. For professional registrations, check the relevant online register directly rather than relying on the candidate’s word
  3. For security roles, verify the SIA licence number on the SIA’s public licence checker before the start date
  4. For healthcare roles, check the NMC or GMC register; for legal roles, the SRA or Bar Council register
  5. Contact the awarding body directly if you have any doubt about a qualification’s authenticity

Pro Tip: For security hires, treat an expired or suspended SIA licence the same way you would treat a failed right to work check. The candidate cannot legally work in a licensed role without a valid licence. Check it on the day of offer, not the day they start.

Taking references that reveal real risk:

Most reference requests get bland, non-committal replies because employers ask the wrong questions. A reference that says “John was a reliable employee” tells you almost nothing. Ask instead:

  • Would you re-employ this person? If not, why not?
  • Were there any conduct, attendance, or performance concerns during employment?
  • Did the candidate’s role involve handling cash, keys, or access to sensitive areas?
  • Is there anything you think we should know before we proceed?

Red flags in a reference response:

  • A refusal to answer specific questions beyond confirming dates of employment
  • Significant gaps between the dates the candidate gave you and the dates the referee confirms
  • A referee who is not the line manager or HR department, despite the candidate listing them as such
  • Vague language about “circumstances of leaving” without explanation

If you suspect a candidate has falsified documents or provided false information, do not confront them immediately. Gather the evidence first, then give the candidate a formal opportunity to explain before making any decision. Document every step.

4. When are health checks lawful, and how do you manage them fairly?

The general rule is simple: do not ask for health information before you make an offer. The Equality Act 2010 restricts pre-offer health enquiries to a narrow set of circumstances, and breaching this exposes you to discrimination claims.

When a health check is lawful:

  • A legal requirement exists for the role (for example, HGV drivers must meet DVLA medical standards; certain security roles require specific fitness or eyesight standards)
  • The check is genuinely necessary to determine whether the candidate can perform a function that is intrinsic to the job, with reasonable adjustments considered
  • You are monitoring diversity in your applicant pool (aggregate, anonymised data only)
  • The role involves a national security vetting requirement

How to manage health checks fairly:

  • Obtain written consent before referring a candidate to occupational health
  • Share the occupational health report with the candidate before making any decision based on it; they have the right to see it and request corrections
  • Keep medical information strictly confidential, separate from the main personnel file, with access limited to those who genuinely need it
  • Consider reasonable adjustments before withdrawing an offer on health grounds; failure to do so is likely to constitute disability discrimination under the Equality Act 2010
  • Apply health checks consistently: if you require a fitness test for one candidate in a role, require it for all candidates in that role

Processing health data requires a lawful basis under UK GDPR plus a Schedule 1 condition under the Data Protection Act 2018, typically explicit consent or a legal obligation. The ICO’s guidance on special category data sets out the requirements in detail.

Pro Tip: If your occupational health provider recommends adjustments, document your consideration of each one in writing. A paper trail showing you genuinely engaged with the adjustment question is your best defence against a later discrimination claim.

Blood pressure check in UK health clinic

Processing candidate data during recruitment is lawful under UK GDPR, but the lawful basis depends on what you are collecting. For most standard recruitment data, legitimate interests or the performance of a contract (steps prior to entering a contract) will apply. For special category data, such as health information or criminal conviction data, you need both a lawful basis and a separate condition under Schedule 1 of the Data Protection Act 2018.

What your privacy notice must cover:

  • The purpose for which you are collecting the data
  • The lawful basis for processing
  • How long you will retain the data (and why)
  • Who will have access to it, including any third-party providers such as DBS umbrella bodies
  • The candidate’s rights: access, rectification, erasure, and the right to object
  • How to make a complaint to the ICO

Practical retention schedule:

Keep unsuccessful candidate data for no longer than six months after the recruitment process ends, unless you have the candidate’s explicit consent to retain it for future roles. Retain right to work copies and DBS certificates for the duration of employment plus two years. Medical records should be kept separately, with a longer retention period where occupational health legislation requires it.

Secure storage guidance:

  • Store digital records in access-controlled systems with role-based permissions
  • Encrypt sensitive documents, particularly DBS certificates and health reports
  • Never email DBS certificates or health information without encryption
  • Conduct a brief data flow audit annually to confirm that candidate data is not sitting in personal email inboxes or unprotected shared drives

Pro Tip: Create a single “candidate data destruction log” and record every deletion. If a candidate later asks what happened to their data, you can show exactly when it was deleted and by whom.

6. How to withdraw or modify an offer when a check raises concerns

A conditional offer is the right tool here. Word it clearly: “This offer is conditional upon satisfactory completion of a right to work check, DBS check at [level], and references.” That framing gives you a lawful basis to withdraw if checks fail, without creating a breach of contract claim.

Step-by-step process for adverse check results:

  1. Gather the facts. Obtain the full check result and any supporting documentation before taking any action.
  2. Assess relevance. Ask whether the information is genuinely relevant to the role. A spent conviction for a minor offence ten years ago is very different from an unspent conviction for fraud in a candidate applying for a cash-handling role.
  3. Give the candidate a chance to respond. Write to the candidate, explain what the check has revealed, and invite them to provide context in writing or at a meeting. This step is not optional; skipping it significantly increases your legal exposure.
  4. Consider proportionality. Weigh the nature of the information against the requirements of the role, the time elapsed, and any mitigating factors the candidate has raised.
  5. Take a consistent decision. Apply the same criteria you would apply to any other candidate in the same situation. Inconsistency is the fastest route to a discrimination claim.
  6. Document everything. Record the information received, the candidate’s response, your reasoning, and the decision. Keep this on file.
  7. Communicate the outcome. If you are withdrawing the offer, tell the candidate in writing, giving the reason (subject to any legal restrictions on disclosing DBS information).

Practical wording for a conditional offer:

Documentation checklist when withdrawing an offer:

  • Copy of the check result that prompted the review
  • Written record of the information shared with the candidate
  • Candidate’s written response or notes from any meeting held
  • Written rationale for the final decision, signed and dated by the decision-maker

Pro Tip: Never withdraw an offer verbally and then follow up in writing. Do it in writing first. A verbal withdrawal that the candidate disputes is far harder to defend than a clear, dated letter.

7. Realistic timelines, fees, and who usually pays

Hiring managers who build a single-day buffer for pre-employment checks will be caught out. The range is wide.

Typical processing times:

  • Basic DBS check: usually 24–72 hours when submitted electronically with complete information
  • Standard DBS check: typically 5–10 working days, though this varies
  • Enhanced DBS check: the majority complete within two weeks, but police force referrals can extend this to several weeks or longer; some forces take considerably more time than others
  • Right to work (online share code): near-instant when the applicant has generated a valid code
  • Right to work (manual document check): same day if the applicant attends in person with correct documents
  • References: typically 5–10 working days, though chasing is almost always necessary

DBS fees (verify current rates on GOV.UK before budgeting):

The DBS sets the application fee, and umbrella bodies or Registered Bodies may charge an additional administration fee on top. Confirm the current fee schedule directly on GOV.UK, as fees are subject to change. For basic checks, the applicant can pay directly if applying via the DBS website; for standard and enhanced checks, the employer or umbrella body typically pays and may or may not recover the cost from the applicant.

Who normally pays:

Most employers absorb DBS and right to work check costs as part of their recruitment overhead. Some pass the cost of a basic DBS check to the applicant, particularly in sectors where candidates are expected to hold a current certificate. For security roles, candidates often already hold a valid DBS as part of their SIA licence application, which can reduce duplication.

Factors that delay processing:

  • Incomplete application forms (missing address history is the most common cause)
  • A name match on police records triggering a force referral for enhanced checks
  • Applicants who are slow to provide documents for manual right to work checks
  • Overseas applicants who need an ACRO police certificate for criminal records from another country

Pro Tip: Set a firm document deadline in your offer letter: “Please provide all required documents within five working days of receiving this offer.” Candidates who miss the deadline without explanation are often the same ones who cause problems later in the process.

8. A practical pre-employment checklist and ready-to-use template wording

The security staff onboarding checklist at Securityjobsboard covers the full workflow for security hires. The core checklist below applies to any UK employer.

Pre-employment checks checklist (per hire):

  • Right to work check completed via correct route (manual / online / DVS)
  • Documents copied, dated, and filed
  • Follow-up check diaried if permission is time-limited
  • DBS check requested at appropriate level (if required)
  • SIA licence verified on the SIA checker (security roles)
  • Identity documents verified and photograph matched to candidate
  • Qualifications and professional registrations confirmed with issuing body
  • At least two references requested and received
  • Health check completed (if legally required or job-essential) with consent obtained
  • Privacy notice issued and candidate acknowledgement recorded
  • Conditional offer letter issued with checks listed
  • All check results filed securely in the candidate’s personnel record
  • Data retention schedule applied to the candidate file

Template: privacy notice line for a job application form

Template: candidate consent for checks

Template: conditional offer wording

Sector note for security roles:

Security employers should also verify SIA licence validity on the day of offer and again on the start date, as licences can be suspended between those two points. For roles requiring security screening, consider whether the role triggers any additional vetting requirements beyond standard DBS. Keep a recurring calendar reminder to recheck SIA licences for all active staff, as a lapsed licence means the individual cannot legally work in a licensed role.

Store the completed checklist alongside the candidate’s personnel file. If an audit or tribunal ever requires you to demonstrate that checks were carried out correctly, a signed and dated checklist is far more useful than a verbal assurance.

Pro Tip: For teams hiring regularly, build the checklist into your applicant tracking system as a mandatory workflow stage. A check that is not recorded in the system is a check that, legally speaking, may as well not have happened.

9. What most hiring guides get wrong about pre-employment checks

The standard advice is to run your checks thoroughly and document everything. That is correct, but it misses the part that actually causes problems in practice.

Most hiring managers treat pre-employment checks as a box-ticking exercise at the end of the process, after they have already mentally committed to the candidate. By that point, an adverse result creates pressure to rationalise it away rather than act on it. The right to work check gets done on day one instead of before the offer. The DBS comes back with something unexpected and nobody has a documented process for what to do next.

The fix is structural, not attitudinal. Run your right to work check and reference requests in parallel, not sequentially, and keep the DBS conditional on a final offer. That way you are not holding up a start date waiting for a reference, and you have not invested two weeks of onboarding before discovering a problem. For security hires specifically, verify the SIA licence before anything else: it is the fastest check and the one most likely to disqualify a candidate outright.

Two practical tips worth building into your process: first, always send reference requests to the line manager, not the HR department. HR will confirm dates of employment and nothing more. A line manager who genuinely rated the candidate will say so; one who did not will often find a way to signal that, even within the constraints of a cautious reference policy. Second, for any role involving access to keys, cash, or sensitive data, treat a gap in employment history the same way you would treat an adverse DBS result: ask about it directly, document the explanation, and make a proportionate decision.

For security sector employers, Securityjobsboard’s employer pages include resources specifically designed for regulated hiring, including guidance on SIA licence verification and sector-specific screening considerations.

Sources

The following official resources should be your first stop for current rules, fees, and templates:

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

How long do pre-employment checks take in the UK?

Right to work checks via the online share code are near-instant; manual document checks take the same day. Basic DBS checks typically complete within 24–72 hours electronically, standard checks within 5–10 working days, and enhanced checks within two weeks in most cases, though police force referrals can extend this considerably.

How do you pass pre-employment checks?

Candidates pass by providing accurate information, valid original documents, and honest answers on application forms. Discrepancies between CV claims and verified records are the most common reason checks fail, so accuracy from the outset matters more than anything else.

What counts as a red flag in a background check?

Undisclosed gaps in employment history, convictions directly relevant to the role (fraud for a finance position, violence for a lone-worker role), a referee who cannot be verified, or documents that do not match the person presenting them are the most significant red flags. Context matters: assess each against the specific requirements of the role.

What pre-employment checks does HMRC carry out?

HMRC conducts right to work checks, identity verification, and criminal record checks at the appropriate DBS level for the role. Roles with access to sensitive taxpayer data or enforcement functions typically require enhanced vetting. Specific requirements vary by role and are set out in HMRC’s own recruitment process.

Do pre-employment checks apply to existing employees?

Right to work checks must be repeated for employees whose permission to work is time-limited, before that permission expires. DBS certificates are not automatically renewed, but many employers in regulated sectors run periodic rechecks, particularly for roles involving children or vulnerable adults. SIA licences must be monitored continuously, as they can be suspended or revoked at any point.