An Enhanced DBS check is not a default requirement for every security role. This guide explains the three check levels, how the SIA's own criminal-record check works, and how a security employer should assess role eligibility.
Employee vetting software UK teams use should make that decision trail easier to organise. It should not choose the check level, decide whether an applicant is suitable or turn a DBS result into an automatic employment decision.
Last reviewed: 18 October 2026. This guide is not legal advice; check the official sources linked below before acting.
What a DBS check can show
The Disclosure and Barring Service offers different levels of criminal-record check. A Basic check shows unspent convictions and conditional cautions. A Standard check can show spent and unspent convictions and cautions. An Enhanced check can include the information from a Standard check plus local police information considered relevant to the role. An Enhanced check with barred-list information is available only where the role and legal eligibility justify it.
The Government's DBS check guidance explains the different levels and their limits. Use its eligibility tools or obtain suitable advice if the position is not clear. A more detailed check is not simply a safer default. It must be lawful and proportionate for the job.
Start with the role, not the job title
A security company may employ people with very different responsibilities. Work with children or vulnerable adults, access to particular sites, supervision duties and the actual activities performed can all affect the level of check that may be available. Record the role assessment and ensure that the recruitment policy explains how criminal-record information is considered fairly.
GOV.UK says employers that carry out criminal-record checks must have a policy on employing ex-offenders and show it to any applicant who asks. A clear policy helps managers explain why a check is requested and avoids treating all roles, or all results, in the same way.
SIA licensing and employer screening are different processes
When someone applies for an SIA licence, the SIA runs its own criminal-record process. It may arrange a disclosure request through DBS, Disclosure Scotland or AccessNI depending on the applicant's circumstances. It can also require overseas criminal-record evidence for relevant time spent outside the UK. This licensing process is separate from an employer's recruitment, vetting and contract requirements.
The SIA criminal-record guidance is the right source for licence applicants. Employers should not treat an SIA licence as a substitute for their own screening policy, and should not present an employer-obtained Enhanced DBS check as a blanket requirement for all security staff.
Do not treat a DBS certificate as permanently current
A DBS certificate has no official expiry date. It reflects the information available when the check was carried out. It is for the employer to decide when a new check is needed, taking account of the role, risk, contract terms, safeguarding duties and any applicable guidance. Where an applicant uses the DBS Update Service, an employer may be able to check whether the certificate remains up to date, provided the required conditions are met.
A review date is useful only when it is tied to a documented reason. Avoid adopting a generic recheck period simply because it appears in a template or sales claim. Review the current role and the requirements that actually apply.
Keep certificate information to a minimum
A DBS certificate can contain highly sensitive information. Government guidance says certificate information should be considered only for the purpose for which it was obtained and destroyed after a suitable period, usually no longer than six months. A company may need to retain a proportionate record that a check was completed and how its policy was applied, but it should avoid retaining the certificate information itself without a clear, documented reason.
The DBS employer guidance and the DBS code of practice should be read alongside the organisation's data-protection policies. Criminal-record information is subject to specific Article 10 safeguards under the UK GDPR and Data Protection Act 2018.
How WFC Verify supports a controlled vetting workflow
WFC Verify is the WFC360 workflow for vetting, screening, HR records, employment Control Documents, training and audit reporting. It can help a team organise role-relevant evidence, show outstanding vetting actions and keep an auditable record of the workflow. This can reduce the effort of chasing spreadsheets and scattered emails when a file or report is needed.
The organisation remains responsible for DBS eligibility, its ex-offender recruitment policy, the lawful handling of certificate information and every employment decision. WFC Verify supports the record-keeping process. It does not make a DBS decision, provide a licence decision or guarantee that a screening workflow meets every client, legal or accreditation requirement.
A practical screening check before you request a DBS certificate
Ask four questions: what will the person actually do, what DBS level is legally eligible, why is that level necessary, and who will make a fair and documented assessment if information is disclosed? Capture the answer before the application begins. This establishes a better control than requesting the same check for every role.
Further reading
- GOV.UK: Check someone's criminal record
- GOV.UK: SIA criminal-record checks
- GOV.UK: DBS check requests guidance for employers
Frequently asked questions
Does every security role need an Enhanced DBS check?
No. The DBS level depends on the role and its legal eligibility. Employers should check the duties rather than assume an Enhanced check is required for all security roles. A more detailed check may only be requested where the role is eligible.
Does an SIA licence mean an employer does not need to screen a worker?
No. The SIA carries out its own criminal-record process for licence applications. Employer screening, role requirements, contract requirements and employment decisions remain separate responsibilities.
Do DBS certificates expire?
A DBS certificate has no official expiry date. It records information that was current when the check was carried out. The employer decides whether and when another check is needed, based on the role, risk and requirements that apply.
Can employee vetting software UK teams use decide DBS eligibility?
No. Software can organise evidence and workflow status, but eligibility and hiring decisions require the employer to assess the actual role, follow current Government guidance and apply its own documented policy.