Pre-employment checks: what an employer can lawfully ask and verify

The principle behind every check

Every pre-employment check processes the candidate’s personal data, and the UK GDPR applies to all of it. The test is the same each time: the check must be necessary for a decision about this role, proportionate to the risk the role carries, and explained to the candidate before it is carried out. A check that would be reasonable for a finance director is intrusive for a warehouse operative, and the regulator expects employers to be able to say why each check was run.

Two practical rules follow. Decide which checks apply to which roles before recruiting, and write it down. Tell candidates, in the privacy notice or the application pack, what will be checked and how.

Checks every employer must make

Right to work. Carry out the prescribed check before employment starts, using the route appropriate to the person and their documents or status. Apply checks consistently and follow the official employer guidance. Not every applicant can use every checking method.

Common checks, with a role-related purpose

Identity. Confirming that the candidate is who they say they are, against original documents, is the foundation of every other check.

References. Employers do not generally have to provide a reference, although contractual or regulatory duties can apply. Any reference supplied should be fair and accurate. Confirm who provided it and what they can actually verify.

Qualifications. Where relevant to the role, verify the award with the issuing organisation or its authorised service, following its requirements for authority and consent. An apparent mismatch may need clarification before a decision.

Employment history. Checking dates against references and against public sources reveals gaps and overlaps, and a candidate should be given the chance to explain them.

Professional registration. Where a role requires membership of a regulated profession, the relevant register is public and should be checked directly.

Checks that need a specific justification

Criminal records. Basic DBS checks cover unspent convictions and conditional cautions. Standard and enhanced checks are restricted to eligible roles, and filtering rules apply; enhanced checks may include relevant police information. Barred-list checks have separate eligibility requirements. Check the DBS eligibility guidance before requesting a level. Scotland and Northern Ireland have different disclosure services.

For roles outside the relevant exceptions, applicants generally do not have to disclose spent convictions and should not be refused employment because of them. Do not assume an exempt role permits questions about every historical record: protected and filtered information needs separate consideration.

Credit and financial checks. Establish why a financial check is necessary for this particular role, what information is relevant, and how it will be used. Financial responsibility alone is not an unrestricted justification. Tell the candidate and give them a chance to explain an adverse finding.

Health questions. The Equality Act 2010 prohibits asking about a candidate’s health or disability before an offer is made, other than for specific purposes such as arranging adjustments to the interview or establishing whether the candidate can carry out a function intrinsic to the job. Health questionnaires belong after the conditional offer.

Social media and online searches. Public profiles may contain irrelevant, inaccurate, or sensitive information. Define a role-related purpose, tell candidates about the check, and limit what reaches the decision-maker. Do not seek private account access or infer suitability from protected characteristics. Separate matching a profile to the candidate from evaluating its content.

When a standard check is not enough

Senior and sensitive roles may justify additional checks because of access to funds, data, regulatory responsibilities, or decision-making authority. Assess that risk for the actual role rather than assuming every senior candidate needs the same investigation.

Enhanced screening goes further, from public and licensed sources:

• Directorships and disqualifications, including dissolved companies, insolvencies, and any disqualification, from the company register.
• Litigation and judgements, including county court judgements, bankruptcy, and involvement in civil claims.
• Adverse media, meaning press and online reporting connecting the candidate to fraud, regulatory action, misconduct, or reputational matters.
• Sanctions and politically exposed person screening, where the firm is a regulated entity or the role touches international business.
• Undisclosed interests, such as a directorship of a competitor or a supplier that would create a conflict.
• Verification of the narrative, meaning whether the career described actually happened as described.

The result is a report that states what was checked, what was found, and what could not be verified, in a form that can be shared with the candidate and, if it is ever needed, put before an employment tribunal. Our background screening page sets out the scope, and how we charge explains the fixed-fee basis.

Doing it properly

• Get consent and give notice. Explain the checks in writing, get the candidate’s consent where the check needs it, and keep a record that you did.
• Check consistently. The same checks for every candidate for the same role. Different checks for different candidates is where discrimination claims start.
• Keep the decision separate from the search. The person who runs the check reports relevant findings; the hiring manager makes the decision on those findings and the job criteria.
• Give the candidate a chance to respond. A finding that appears adverse often has an explanation. Put it to them before acting on it.
• Keep only what you need. Set and document retention periods based on the purpose, legal requirements, and any relevant dispute. Record the applicable lawful basis and any additional conditions for sensitive or criminal-offence data; a legitimate interests assessment is appropriate where that is the basis relied on.
• Do not go around the rules. Using an agency does not create an entitlement to information the employer cannot lawfully obtain. Require the provider to explain its sources, authority, safeguards, and limitations.

This is general guidance within the scope identified above. It is not legal advice and does not take account of your circumstances. Before a legal, employment, or court-related decision, seek advice from a solicitor in the relevant jurisdiction. Harwick provides investigative services; legal advice is a separate professional service.

Related services