Keeping information safe

As well as storing the list of DBS checks you’ve requested and certificates you’ve seen, you should also keep a record of everyone who has seen the certificates or the information in them.

It’s against the law to:

• share information in a DBS certificate with anyone who isn’t involved in your organisation, unless a relevant legal exception applies
• share information with anyone in your organisation unless it’s necessary for them to carry out their duties
• knowingly make a false statement to obtain, or enable someone else to obtain, a certificate.

The DBS code of practice states that all registered bodies need a written policy on correctly handling and safely storing DBS certificates and certificate information.

Organisations must also comply with their obligations under the General Data Protection Regulation (GDPR), Data Protection Act 2018, and other relevant legislation on safely handling, retaining and disposing of certificate information.

• The Disclosure and Barring Service has a sample policy on handling DBS certificate information that you can use.
• If you're handling information linked to a DBS check you must follow the DBS code of practice.
• To learn more about data protection, use our general guide to data protection and GDPR.