Security companies make important decisions from workforce information every day. Vetting evidence, employment records, appraisal notes, training history, incident information and CCTV may all involve personal data. The practical challenge is not to collect everything. It is to know why each record is needed, who can see it and when it should be reviewed or removed.
Security company HR software can help a team keep those records organised, but it cannot choose a lawful basis, set a retention period or make an employer compliant. Those remain decisions for the organisation, based on the role, the purpose and the law that applies.
Last reviewed: 18 October 2026. This guide is not legal advice; check the official sources linked below before acting.
Start with a clear record map
Before selecting settings or moving files into one platform, list the categories of worker information you hold. For each one, record its purpose, the people who need access, its source, the lawful basis you rely on and the point at which it should be reviewed. This makes it easier to explain the process to staff and to spot records that no longer have a purpose.
The ICO guidance on employment records says workers must be told the purpose, lawful basis, conditions where applicable, retention period, sharing and rights that apply to their data. A staff privacy notice and a workable internal record map should tell the same story.
Use the right rules for the right type of data
Not all sensitive workforce records are governed by the same additional rules. Health information and biometric data used to uniquely identify someone can be special category data, so an organisation needs an Article 6 lawful basis and an Article 9 condition. The ICO's special category guidance explains the distinction.
DBS results and other information about criminal allegations, proceedings or convictions are not special category data. They are criminal offence data, which is subject to separate Article 10 controls. In addition to an Article 6 lawful basis, an employer normally needs to identify a relevant condition in Schedule 1 of the Data Protection Act 2018, unless the processing is under official authority. The ICO's criminal offence data guidance explains these safeguards and the related documentation duties.
Choose and document a lawful basis
Every processing activity needs an Article 6 lawful basis. The right answer varies. Legal obligation may be relevant where a specific legal duty applies. Legitimate interests may be relevant for some operational purposes, but it requires a documented assessment of necessity and impact. Consent is often a weak choice for routine employment processing because a worker may not be able to refuse freely.
Do not assume that one lawful basis covers every record in an employee file. Review the specific purpose, keep a record of the decision and obtain suitable data-protection or legal advice where the use is high risk or unclear.
Set retention by purpose, not by a blanket number
The UK GDPR does not set one universal retention period for workforce records. The ICO recommends a retention schedule that states the type of record, why it is held and how long it is needed. A record may need to be kept for a legal, tax, licensing, safeguarding or contractual purpose, while another can be removed much earlier. Once information is no longer needed, it should be securely deleted or anonymised where appropriate.
Surveillance records need the same discipline. The ICO says there is no fixed minimum or maximum retention period for CCTV or other surveillance information. The documented purpose should determine the shortest necessary period. Its surveillance guidance recommends documented retention, secure storage and regular checks that deletion is happening as intended.
Handle DBS certificate information with extra care
DBS certificate information should be used only for the purpose for which it was obtained and kept for no longer than necessary. Government guidance says the information should usually be destroyed after a suitable period, normally no longer than six months. An organisation may still need an appropriate, proportionate record that the check was completed and how it was considered. It should separate that record from the certificate information and document its approach.
Read the current DBS employer guidance and the DBS code of practice before setting a policy. This article is general information, not legal or data-protection advice.
Build access and accountability into everyday work
Security teams often need several people to contribute to a worker record, but that does not mean every user should see every document. Define role-based access, record significant changes, provide staff with clear privacy information and have a process for correcting inaccuracies. If an appraisal is subjective, record that it is an opinion and, where relevant, whose opinion it is.
A subject access request also needs a repeatable process. Knowing which system holds the record, who can review it, whether third-party information needs protection and how the response is logged can reduce avoidable delay. Complex requests and exemptions should be handled with appropriate specialist advice.
How WFC Verify can support an organised workforce record
WFC Verify is the WFC360 workflow for vetting, HR records, employment Control Documents, training, appraisals, surveys and audit reporting. It can help an HR, vetting or compliance team keep related workforce evidence together, show what is outstanding and produce reports from the records they manage. Its employee portal and version-controlled document workflow can also provide a clearer record of what has been issued and acknowledged.
That organisation supports better preparation. It does not replace the employer's privacy notice, retention policy, legal basis assessment, data-protection impact assessment or management judgement. Teams should configure the workflow around their own documented policies and keep those policies under review.
A practical next step for security companies
Choose one workforce record type, such as DBS certificate information, a right-to-work record or appraisal evidence. Confirm why it is held, who has access, which legal rules apply, how long it is needed and what should happen at the review date. Then repeat the exercise across the wider employee record. A controlled approach is more useful than a single generic retention rule.
Further reading
- ICO: Collecting and keeping employment records
- ICO: Criminal offence data
- GOV.UK: DBS check requests guidance for employers
Frequently asked questions
Are DBS results special category data under the UK GDPR?
No. DBS results and other criminal offence data are subject to separate Article 10 controls. An organisation still needs an Article 6 lawful basis and, unless it acts under official authority, a relevant Schedule 1 Data Protection Act 2018 condition. Health information and biometric data used to uniquely identify a person can be special category data, which has its own Article 9 requirements.
How long can a security company retain staff data?
There is no single UK GDPR retention period for every staff record. The period should be justified by the purpose, record type and any applicable legal, regulatory or contractual requirement. ICO guidance recommends a documented retention schedule and secure deletion or anonymisation when information is no longer needed.
Is there a fixed UK GDPR retention period for CCTV footage?
No. The ICO says the UK GDPR and Data Protection Act 2018 do not set fixed minimum or maximum retention periods for surveillance information. The documented purpose should determine the shortest necessary period, with secure deletion and periodic checks.
Can security company HR software make an employer GDPR compliant?
No. Software can help organise records, access and reporting. The employer remains responsible for its lawful basis, privacy information, retention schedule, security measures and decisions about how personal data is used.