DBS policy statement and code of practice handling, retention and storage

Disclosure policy statement and code of practice for registered persons and other recipients of disclosure information on the handling, storage and retention of DBS certificates

This code of practice is intended to ensure - and to provide assurance to those applying for standard and enhanced disclosures - that the information released will be used fairly. The code is concerned with the use of information provided to anyone entitled to see such disclosures. Under the provisions of the code, sensitive personal information must be handled and stored appropriately and must be kept for only as long as is necessary.

This code of practice is published under section 122 of the Police Act 1997 ('the Act') in connection with the use of information provided to registered persons ('disclosure information') under Part V of that act.

Disclosure information is information:

contained in criminal record certificates under section 113 of the Act (which are referred to in this code as 'standard disclosures'), or
contained in enhanced criminal record certificates under section 115 of the Act (referred to in this code as 'enhanced disclosures'), or
provided by the police under section 115(8) of the act.

Except where indicated otherwise, the code of practice applies to all recipients of disclosure information - that is to say:

registered persons
those countersigning disclosure applications on behalf of registered persons

and
others receiving such information

Where reference is made to 'employers', this should be read as including any person at whose request a registered person has countersigned an application, including:

voluntary organisations and others engaging, or using the services of, volunteers,

and
regulatory and licensing bodies

Further information in relation to the code, and other matters relating to registered persons and others having an involvement with disclosure information, is contained in an explanatory guide.

Purpose of the code

The code of practice is intended to ensure - and to provide assurance to those applying for standard and enhanced disclosures - that the information released will be used fairly.
The code also seeks to ensure that sensitive personal information is handled and stored appropriately and is kept for only as long as necessary.

Obligations of the code

These are as follows:

1. Fair use of disclosure information

Recipients of disclosure information shall:

observe guidance issued or supported by the Disclosure and Barring Service ('the Bureau') on the use of disclosure information - and, in particular, recipients of disclosure information shall not unfairly discriminate against the subject of disclosure information on the basis of conviction or other details revealed
in the interest of the proper use of disclosure information and for the reassurance of persons who are the subject of disclosure information, registered persons shall have a written policy on the recruitment of ex-offenders, so that a copy can be given to all applicants for positions where a disclosure will be requested
ensure that a body or individual at whose request applications for disclosures are countersigned has such a written policy and, if necessary, provide a model for that body or individual to use

In order that persons who are, or who may be, the subject of disclosure information are made aware of the use of such information, and be reassured, employers shall:

ensure that application forms for positions where disclosures will be requested contain a statement that a disclosure will be requested in the event of a successful application, so that applicants are aware of the situation
include in application forms or accompanying material a statement to the effect that a criminal record will not necessarily be a bar to obtaining a position, in order to reassure applicants that disclosure information will not be used unfairly
discuss any matters revealed in disclosure information with the person seeking the position before withdrawing an offer of employment
make every subject of a disclosure aware of the existence of this code of practice, and make a copy available on request

and
in order to assist staff to make appropriate use of disclosure information in reaching decisions, make available guidance in relation to the employment and fair treatment of ex-offenders and to the Rehabilitation of Offenders Act 1974

2. Handling of disclosure information

Recipients of disclosure information:

must ensure that disclosure information is not passed to persons not authorised to receive it under section 124 of the Act. Under section 124, unauthorised disclosure is an offence
must ensure that disclosures and the information they contain are available only to those who need to have access in the course of their duties

Retention period: disclosure information should only be kept for as long as necessary for the purpose it was obtained.

General rule: in line with the Personnel Record retention period or:

until the recruitment or relevant decision has been made and the employee is not appointed

any dispute about the accuracy of the disclosure has been resolved

Exceptions: retention beyond the normal retention period should only occur:

in very exceptional circumstances that justify it

if required for inspection purposes (for example, by a regulatory body)

Copies of disclosure certificates should be shredded before disposal.

3. Umbrella bodies

(a) An umbrella body is one which has registered with the Bureau on the basis that it will countersign applications on behalf of others who are not registered.

(b) Umbrella bodies must satisfy themselves that those on whose behalf they intend to countersign applications are likely to ask exempted questions under the Exceptions Order to the Rehabilitation of Offenders Act 1974.

(c) Umbrella bodies must take reasonable steps to ensure that those to whom they pass disclosure information observe the code of practice.

4. Failure to comply with the code of practice

The bureau is empowered to refuse to issue a disclosure if it believes that a registered person, or someone on whose behalf a registered person has acted, has failed to comply with the code of practice.

Gateshead Council Policy Statement

1.1 General principles

As an organisation using the Disclosure and Barring Service (DBS) checking service to help assess the suitability of applicants for positions of trust, Gateshead Council complies fully with the code of practice regarding the correct handling, use, storage, retention and disposal of certificates and certificate information. Gateshead Council also complies fully with statutory guidance issued by Ofsted, CQC, DBS and the DfE, and relevant legislation pertaining to the safeguarding of adults and children.

It also complies fully with its obligations under the General Data Protection Regulation (GDPR), Data Protection Act 2018 and other relevant legislation pertaining to the safe handling, use, storage, retention and disposal of certificate information and has a written policy on these matters, which is available to those who wish to see it on request.

1.2 Storage and access

Certificate information will be kept securely, in lockable, non-portable storage containers, or secure electronic storage, with access strictly controlled and limited to those who are entitled to see it as part of their duties.

1.3 Handling

In accordance with section 124 of the Police Act 1997, certificate information is only passed to those who are authorised to receive it in the course of their duties. The DBS maintains a record of all those to whom certificates or certificate information has been revealed, and it is a criminal offence to pass this information to anyone who is not entitled to receive it.

Registered care homes which are inspected by the Care Quality Commission (CQC), those organisations which are inspected by Ofsted and those establishments which are inspected by the Care and Social Services Inspectorate for Wales (CSSIW) may be legally entitled to retain the certificate for the purposes of inspection, so we withhold the right to do so under these circumstances.

In addition, organisations that require retention of certificates in order to demonstrate 'safer recruitment' practice for the purpose of safeguarding audits may be legally entitled to retain the certificate and, should we exercise the right to do so, we will remain compliant with the Data Protection Act, Human Rights Act, General Data Protection Regulation (GDPR), and this policy statement.

1.4 Usage

Certificate information is only used for the specific purpose for which it was requested and for which the applicant's full consent has been given, or for safeguarding purposes.

1.5 Retention

Once a recruitment (or other relevant) decision has been made, we do not keep certificate information for any longer than is necessary, which will normally be a 6-month period, or up to 4 years for CQC inspections. This retention will allow for the consideration and resolution of any disputes or complaints, or be for the purpose of completing safeguarding audits.

Throughout this time, the usual conditions regarding the safe storage and strictly controlled access will prevail.

1.6 Disposal

Once the retention period has elapsed, we will ensure that any DBS certificate information is immediately destroyed by secure means, for example by shredding, pulping, burning or deletion of the electronic copy. While awaiting destruction, certificate information will not be kept in any insecure receptacle (for example, waste bin or confidential waste sack).

We will not keep any photocopy or other image of the certificate or any copy or representation of the contents of a certificate once this retention period has elapsed. However, not withstanding the above, we may keep a record of the date of issue of a certificate, the name of the subject, the type of certificate requested, the position for which the certificate was requested, the unique reference number of the certificates and the details of the recruitment decision taken.

1.7 Acting as an umbrella body

Before acting as an umbrella body, we will take all reasonable steps to satisfy ourselves that they will handle, use, store, retain and dispose of certificate information in full compliance with the DBS code of practiceand in full accordance with this policy.

We will also ensure that any body or individual, at whose request applications for DBS certificates are countersigned, has such a written policy and, if necessary, will provide a model policy for that body or individual to use or adapt for this purpose.

1.8 DBS re-checks and the update service

Under CQC regulations, people working in children's residential establishments must have their DBS check renewed every 3 years. We fully comply with this regulation.

We do not routinely recheck all DBS certificates every 3 years as per Ofsted and DfE guidance, but we do reserve the right to recheck DBS certificates under the following circumstances:

The new role requires a different level of DBS check or different barred list check to the one previously applied for, or the new role allows greater access to children or vulnerable adults.
There has been a break of more than three months between an employee leaving a position which required a DBS check and taking up a new position which requires a DBS check.
There are concerns about the employee which may affect his or her suitability in their role.
They have previously only held a police check and barred list check (List 99) as they have been in position prior to the introduction of the Safeguarding Vulnerable Groups Act 2006.

Gateshead Council will accept DBS certificates issued by other registered bodies providing the applicant is registered with the DBS Update Service and the DBS check is for the same workforce, level and type of barred list check that we are entitled to see.

We will not accept an Update Service check if the position applied for is a foster carer or associated support positions or someone applying to adopt a child.

We comply with the DBS regulations regarding update checks and we will not carry out a check unless we have seen the original DBS certificate the update check is registered on, and we have the applicant's signed consent to carry out the online check.

We will not routinely recheck the status of someone registered with the update service unless there are concerns about the individual which may affect his or her suitability in their role.