Background Check Documents: What Employers Need to Verify

Background check documentation is the collection of records an employer must gather, verify, and retain before a new hire begins work. In the United Kingdom, some of these checks are a legal requirement — failing to complete them correctly can result in civil penalties of up to £60,000 per worker. Others are discretionary but strongly advisable depending on the role. This guide sets out exactly which documents are required, what each check covers, and how to manage the process lawfully under UK GDPR.

This article is for informational purposes only and does not constitute legal advice. Regulatory references are accurate as of publication date. Consult a qualified professional for advice specific to your situation.

The legal foundation: which background checks are mandatory in the UK

Employers are legally required to verify the right to work of every employee before their first day of paid work. This obligation arises from the Immigration, Asylum and Nationality Act 2006, sections 15–25. Civil penalties for non-compliance reach up to £45,000 per illegal worker for a first breach and up to £60,000 for a repeat breach, as set out in the Home Office Employer's Guide.

Beyond right to work, several other background checks become mandatory in specific circumstances: Disclosure and Barring Service (DBS) checks are required for roles working with children or vulnerable adults; financial conduct checks apply to certain FCA-regulated positions; and professional licence verification is required in healthcare, education, and legal services. All other background checks — including employment history, character references, and social media screening — are discretionary.

Right to work documents: List A and List B explained

The right to work check must happen before employment begins, not on the first day of work. The Home Office Employer's Guide divides acceptable documents into two lists with different compliance implications.

Employers who correctly follow one of the three recognised checking methods — manual document check, online share code check, or certified IDVT (Identity Document Validation Technology) — obtain a statutory excuse even if the employee later turns out to have no right to work. Selective checking based on a worker's perceived nationality constitutes unlawful discrimination under the Equality Act 2010 and does not reduce liability.

For more detail on the three checking methods and record-keeping obligations, see our guide to Right to Work Check: Employer Compliance Guide.

DBS checks: selecting the right level for the role

A Disclosure and Barring Service check discloses an individual's criminal record history. The Disclosure and Barring Service offers four levels, and employers must select the appropriate level based on the nature of the role — requesting a higher level than permitted is itself unlawful.

The Rehabilitation of Offenders Act 1974 means that spent convictions cannot generally be disclosed or used against a candidate for most jobs. Enhanced and Standard checks are exceptions to this rule and apply only to specifically exempt occupations defined in the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975.

A Basic DBS check typically returns results within two to five business days. An Enhanced DBS check, which involves local police forces, can take two to four weeks depending on the force and whether any information is held.

Employment history verification: what employers actually check

Employment history verification confirms that a candidate worked where and when they claim. Most employers cover the last five to ten years of work history, though some roles — particularly in financial services and security — require a full account with no unexplained gaps.

In practice, many former employers will only confirm employment dates and job title, citing legal liability concerns around providing references. A written confirmation that "Mr Smith was employed from January 2020 to March 2023 as a Senior Analyst" is legally safe; a subjective negative reference opens the previous employer to a defamation claim. Employers should be aware that the absence of a detailed reference does not indicate a problem — it is standard commercial caution.

Unexplained gaps in employment history are a legitimate area for follow-up. Candidates should be asked to account for any gap exceeding one month. Reasonable explanations include further study, caring responsibilities, travel, or illness; any gap a candidate refuses to explain warrants closer scrutiny.

Education and qualification verification

Qualification fraud is more common than many employers expect. Our analysis of 65,000+ HR dossiers found a 6.1% fake diploma rate, with fraudulent certificates increasing in volume alongside the growth of online certificate mills.

For UK degrees and higher education qualifications, the recognised verification service is HEDD (Higher Education Degree Datacheck), which connects directly to UK universities and awarding bodies. HEDD can confirm whether a specific degree was awarded, the classification, and the dates of study. For professional qualifications, the relevant awarding body (e.g. ICAEW for accountants, SRA for solicitors) maintains its own register.

Employers in regulated sectors have a direct legal obligation to verify qualifications before appointment. A healthcare trust employing an unqualified surgeon faces regulatory action from the Care Quality Commission in addition to potential criminal liability. For most commercial roles, qualification verification is discretionary but significantly reduces negligent hiring risk.

For a detailed breakdown of diploma verification methods and the HEDD process, see our guide to HR Document Verification: Diplomas and Right to Work.

Financial and credit checks: when they apply

Credit history checks in the context of employment are permitted only for roles where financial conduct is directly relevant. The FCA requires firms to assess the fitness and propriety of certain staff — including certified persons under the Senior Managers and Certification Regime (SMCR) — and a credit check forms part of that assessment.

For most non-financial roles, running a credit check without a specific regulatory basis is difficult to justify under the data minimisation principle of UK GDPR. Candidates for roles involving access to financial systems, client funds, or sensitive financial data may be asked to consent to a credit check, but employers should obtain specific legal advice before making this a condition of employment in non-regulated contexts.

UK GDPR and data protection in background screening

Background checks involve processing sensitive personal data, including criminal record information (which is a special category under UK GDPR when it involves convictions). The Information Commissioner's Office (ICO) employment guidance sets out the key obligations.

Employers must:

• Issue a privacy notice before collecting background check information, explaining what data is collected, why, and how long it will be retained.
• Have a lawful basis for each type of check — legal obligation (for right to work checks), legitimate interests (for most others), or explicit consent where required.
• Apply data minimisation — collect only what is necessary for the specific role.
• Set a defined retention period — typically the duration of employment plus a short period for post-termination disputes; DBS certificates should not be retained beyond six months in most cases.
• Ensure secure storage and restrict access to those with a genuine need to see the information.

Criminal record information requires an additional condition under Schedule 1 of the Data Protection Act 2018 — most employers rely on the "substantial public benefit" or "employment" conditions, but this should be reviewed with a data protection officer or solicitor.

Putting it together: a practical document checklist by role type

The documents an employer needs depend entirely on the role. The table below gives a baseline for common hiring scenarios.

How automated verification changes the process

Manual background check processes are slow and introduce human error at every stage — a document copy is missed, a follow-up check date is not set, a diploma is not verified because the previous employer gave a satisfactory reference. Our platform reduces background check processing time by 83% compared to manual workflows, with a 94.8% fraud detection recall rate on document authenticity checks.

Automation handles the repeatable parts of the process: document capture, format validation, cross-referencing against databases, and generating audit-ready records. It does not replace human judgement on what to do with a flagged result. The combination of automated detection and human review is consistently more accurate than either approach alone.

CheckFile provides document verification solutions purpose-built for HR and compliance teams. Our solutions include automated right to work checks, diploma verification integrated with HEDD, and DBS application management. Data is processed in accordance with UK GDPR, with full audit trails and configurable retention policies — see our security documentation for technical detail. Pricing is available for teams of all sizes.

---

Frequently Asked Questions

Do employers always call previous employers during a background check?

Not always. Many employers verify employment dates and job title in writing rather than by telephone call. Former employers routinely decline to provide subjective commentary on a candidate's performance due to liability concerns, so a written confirmation covering dates and role is the typical outcome. Some specialist background screening firms use telephone verification to reach HR departments directly and can confirm additional detail, but this is not universal practice.

How long do background checks take in the UK?

A standard background check covering right to work, employment history, and qualification verification typically takes two to five business days for straightforward cases. DBS Enhanced checks involve local police forces and can take two to four weeks, with significant variation between police force areas. Delays usually occur when previous employers are slow to respond to verification requests or when an applicant's records require manual tracing.

What documents prove the right to work in the UK?

The most common List A documents are a valid British or Irish passport, a British birth certificate combined with an official letter showing a National Insurance number, or a certificate of entitlement. For individuals without a British or Irish passport, a Biometric Residence Permit (BRP), an eVisa confirmed via a share code, or an EU settled/pre-settled status confirmed via a share code are the primary List B alternatives. The full lists are set out in the Home Office Employer's Guide.

Can an employer ask about spent convictions?

For most roles, no. The Rehabilitation of Offenders Act 1974 means that once a conviction is spent, the individual is not obliged to disclose it and an employer cannot lawfully take it into account. The exceptions are roles that fall within the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975 — including healthcare, law, education, and certain financial services roles. These roles may obtain Standard or Enhanced DBS checks that disclose spent convictions.

What are the GDPR obligations when retaining background check documents?

Employers must retain background check records only for as long as there is a documented, lawful purpose. Right to work copies must be kept for the duration of employment and for two years after termination, per the Home Office code of practice. DBS certificates should generally not be retained beyond six months. All records must be stored securely, accessed only on a need-to-know basis, and disposed of securely when the retention period ends. The ICO employment guidance provides a detailed framework for setting retention schedules and handling subject access requests.