Pre-employment checks: what an employer can lawfully ask and verify

The principle behind every check

Every pre-employment check processes the candidate’s personal data, and the UK GDPR applies to all of it. The test is the same each time: the check must be necessary for a decision about this role, proportionate to the risk the role carries, and explained to the candidate before it is carried out. A check that would be reasonable for a finance director is intrusive for a warehouse operative, and the regulator expects employers to be able to say why each check was run.

Two practical rules follow. Decide which checks apply to which roles before recruiting, and write it down. Tell candidates, in the privacy notice or the application pack, what will be checked and how.

Checks every employer must make

Right to work. Employers are required by statute to check that every employee is entitled to work in the UK before they start, by examining original documents, using the government’s online checking service, or through an identity service provider. The check must be done for everyone, not only for candidates who seem likely to need it, since selective checking is discrimination. A failure to check exposes the employer to a civil penalty for each illegal worker.

Checks that are lawful for any role

Identity. Confirming that the candidate is who they say they are, against original documents, is the foundation of every other check.

References. A previous employer is not obliged to give a reference, and many now confirm only dates and job title. What can be verified is that the employment existed and covered the dates claimed. Any reference given must be accurate and fair, which is why they have become brief.

Qualifications. Awarding bodies and universities confirm qualifications directly, with the candidate’s consent. Where a role depends on a qualification, verify it; qualifications are among the most commonly misstated items on a CV.

Employment history. Checking dates against references and against public sources reveals gaps and overlaps, and a candidate should be given the chance to explain them.

Professional registration. Where a role requires membership of a regulated profession, the relevant register is public and should be checked directly.

Checks that need a specific justification

Criminal records. A criminal record check runs at one of three levels, and the level available depends on the role, not on the employer’s preference. A basic check shows unspent convictions and can be requested for any role. Standard and enhanced checks show spent convictions and, at the enhanced level, police intelligence, and are available only for roles listed in the exceptions to the rehabilitation legislation, such as work with children or vulnerable adults, and certain regulated professions. The glossary sets out the levels.

The rule for everyone else is that a candidate is entitled not to disclose a spent conviction and cannot lawfully be refused employment for one. Asking about spent convictions for a role that is not exempt is unlawful.

Credit and financial checks. Lawful where the role involves handling money or carries financial responsibility, and where the employer has told the candidate. A credit reference search for a role with no financial element is difficult to justify.

Health questions. The Equality Act 2010 prohibits asking about a candidate’s health or disability before an offer is made, other than for specific purposes such as arranging adjustments to the interview or establishing whether the candidate can carry out a function intrinsic to the job. Health questionnaires belong after the conditional offer.

Social media and online searches. Looking at what a candidate has put in public is lawful, and it is where a good deal of the material employers later wish they had known is found. It needs care, because it also reveals protected characteristics the employer must not take into account. The regulator’s expectation is that searches are carried out only where justified by the role, that the candidate is told, that the search is done consistently and by someone who is not the decision-maker, and that only relevant findings are passed on. Looking at private accounts by any means other than what the candidate has made public is not lawful.

When a standard check is not enough

Most hiring risk sits at the top of the organisation and in a small number of sensitive posts: directors, finance, treasury, roles with access to client funds or data, roles that carry the firm’s regulatory status, and senior appointments where a resignation would be public. For these, the checks above establish that the candidate exists and has the qualifications claimed. They do not establish what the candidate has done.

Enhanced screening goes further, from public and licensed sources:

• Directorships and disqualifications, including dissolved companies, insolvencies and any disqualification, from the company register.
• Litigation and judgements, including county court judgements, bankruptcy and involvement in civil claims.
• Adverse media, meaning press and online reporting connecting the candidate to fraud, regulatory action, misconduct or reputational matters.
• Sanctions and politically exposed person screening, where the firm is a regulated entity or the role touches international business.
• Undisclosed interests, such as a directorship of a competitor or a supplier that would create a conflict.
• Verification of the narrative, meaning whether the career described actually happened as described.

The result is a report that states what was checked, what was found and what could not be verified, in a form that can be shared with the candidate and, if it is ever needed, put before an employment tribunal. Our background screening page sets out the scope, and how we charge explains the fixed-fee basis.

Doing it properly

• Get consent and give notice. Explain the checks in writing, get the candidate’s consent where the check needs it, and keep a record that you did.
• Check consistently. The same checks for every candidate for the same role. Different checks for different candidates is where discrimination claims start.
• Keep the decision separate from the search. The person who runs the check reports relevant findings; the hiring manager makes the decision on those findings and the job criteria.
• Give the candidate a chance to respond. A finding that appears adverse often has an explanation. Put it to them before acting on it.
• Keep only what you need. Retain the record of the check and the outcome; delete the underlying material once the decision is made and any appeal period has passed. A legitimate interests assessment records why each check was justified.
• Do not go around the rules. An employer who cannot lawfully obtain information for a role cannot lawfully have an agency obtain it either. Anyone who offers to get a candidate’s medical records, spent convictions for a non-exempt role or the contents of private accounts is offering to break the law on your behalf.

This guide is general information about the law of England and Wales as we understand it at the date shown at the foot of the page. It is not legal advice and does not take account of your circumstances. Before acting on anything here, particularly where court proceedings, a criminal complaint or an employment decision are involved, take advice from a solicitor. We are investigators, not lawyers, and we will say so if a question you bring us needs one.

Related services