Skip to main content

Tag: data protection

New guidance published to support employers with GDPR, data protection and processing criminal records in recruitment

Today we have published new guidance to support employers to ensure that their policies and practices on collecting criminal records data during recruitment is compliant with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

The guidance makes it clear that collecting criminal records at the initial application stage is unlikely to be necessary and therefore in breach of data protection law.


Christopher Stacey, co-director of Unlock, said:

“Too often, employers overlook skills, experience and qualifications if an applicant declares they have a criminal record. Yet over 11 million people in the UK have a criminal record. The GDPR and the Data Protection Act 2018 make it clear that asking about criminal records must be necessary – if it isn’t necessary, it isn’t compliant.


“This guidance makes it clear that the current common practice of many large employers of asking about criminal records at the initial application stage needs to change to ensure compliance with data protection law. That’s why we’re strongly encouraging employers to no longer ask about criminal records at application stage. However, fair recruitment is about more than just removing a question. Employers are required to justify why they are asking about criminal records at any stage in the process, and we recommend employers to use this as an opportunity to think about whether they need to ask about criminal records at all and, if they do, how they manage the process so they don’t miss out on talented and qualified applicants with previous convictions.


“Proactive recruiters report that employees with convictions are more productive and more loyal than average. We hope that this guidance helps employers to review their approach towards criminal records and ensure that if information is collected, it is used fairly and only where necessary.”


Jessica Rose, Ban the Box campaign manager at Business in the Community, said:

“Unlock’s straightforward and practical guide for employers collecting criminal records data makes it clear that Ban the Box is the right approach for recruitment under GDPR. We urge employers to read the guide and to move any necessary questions about criminal convictions to later in the recruitment process. Once you’ve made the change we’d be delighted to have you join the growing movement of employers demonstrating their fair approach to the recruitment of people with criminal records through signing up to Ban the Box.”


The Information Commissioner’s Office, who Unlock worked closely with to produce the guidance, said:

“This is useful guidance that will help employers to review their policies and practices when requesting information about criminal records in recruitment. It is crucial that employers understand their obligations to data protection law and this guidance will help them to do this.”


The guidance sets out a three-stage process for employers to follow in determining if, when and how they should ask about criminal records. Key points of the guidance are that:

  1. Collecting criminal records at application stage is unlikely to be necessary and therefore in breach of the GDPR and the DPA18
  2. Collecting at any stage must be justified by a link between purpose and processing.
  3. You must identify a lawful basis for processing AND meet a condition of processing
  4. Applicants have data subject rights that must be upheld
  5. Explaining how you’ll uphold applicants’ rights is key to meeting the condition of processing

The full implications of the GDPR are still being embedded, but it is clear that data controllers must comply with data protection law. This guidance makes it clear what employers should be doing, and it is likely that individuals will look to challenge those organisations that operate policies and practices that do not comply.

This guidance is part of the practical guidance we provide via Recruit! – a website providing advice and support for employers on recruiting people with convictions and dealing with criminal records fairly. Employers looking for further advice about this guidance can contact

We will shortly be publishing separate guidance for applicants on their data subject rights and how to challenge unfair or unlawful practice where they encounter it.



  1. Unlock is an independent, award-winning national charity that provides a voice and support for people with convictions who are facing stigma and obstacles because of their criminal record, often long after they have served their sentence.
  2. There are over 11 million people in the UK that have a criminal record.
  3. Unlock’s website is
  4. The guidance is available to download at
  5. The guidance is for employers and voluntary organisations in England & Wales who collect, or plan to collect, criminal records data for recruitment purposes.
  6. For more information on becoming a Ban the Box employer, please see
  7. Unlock are grateful for the advice and support received from the Information Commissioner’s Office in producing this guidance. Links to their guidance are embedded in the document and more information is available on their website. There is also a useful briefing produced by Nacro on data protection and the use of criminal offence data.

Criminal record requests on application forms could be breaching GDPR

People Management has published an article that looks at a briefing recently published by Nacro that looks at data protection and the use of criminal offence data for employment and education purposes. We very much welcome the briefing by Nacro, which raises some important issues for employers. 

Speaking to People Management, Christopher Stacey, Co-director of Unlock, said:

“GDPR and the new Data Protection Act 2018 means employers that choose to ask applicants about criminal records will need to provide clear reasons and explain their legal basis for doing so. It is likely that asking about criminal records at application stage would be very difficult to justify in light of the recent enhancements in data protection. As one of the founding members of the Ban the Box campaign in the UK, Unlock encourages employers of all sizes and in every sector to sign up and remove criminal record questions from application forms.


“However, fair recruitment is about more than just removing a question. Employers are required to justify why they are asking about criminal records at any stage in the process, and we encourage employers to use this opportunity to think about whether they need to ask about criminal records at all and, if they do, how they manage the process so they don’t miss out on talented and qualified applicants with previous convictions. Proactive recruiters report that employees with convictions are more productive and more loyal than average. We have developed 10 principles of fair recruitment, in collaboration with business and government, and we will be publishing practical guidance for employers on data protection, GDPR and criminal records in the coming weeks.” 

Unlock complaint leads to ruling that the Disclosure and Barring Service breached the Data Protection Act

We’re pleased to report that the Information Commissioners Office (ICO) has today issued a press release which sets out their ruling that the Disclosure and Barring Service (DBS) has breached the Data Protection Action after failing to stop collecting information about criminal conviction data that was no longer required because of a filtering regime that was introduced in May 2013.

The DBS hadn’t updated their application forms, and so although the ‘filtering’ process meant that certain cautions and convictions are no longer disclosed on standard and enhanced checks, the DBS were still asking whether applicants had “ever been convicted of a criminal offence or received a caution…” as part of their application form. The result of this was that employers were finding out information which they weren’t entitled to know about.

We made the original complaint to the ICO in September 2013, after our helpline had received a number of calls about this problem. In particular, we highlighted two cases where individuals had disclosed information they no longer needed to disclose, but had subsequently had their offers of employment withdrawn. The two cases are explained in more detail below.

Christopher Stacey, Co-Director at Unlock, said; “We’re pleased to see that the DBS has responded to this issue by updating their application form and improving their guidance to applicants. It is important that people with convictions are able to understand what they do and don’t have to disclose during the recruitment process, and the DBS have an important part to play to make this clear and easy to understand.”

“It remains difficult for people to find out whether a caution or conviction that they have is eligible for filtering, and we would like to see the DBS respond to this issue by introducing a system which allows individuals to obtain a copy of their DBS certificate before they start applying for jobs or volunteer work, so that they can be confident that they’re disclosing the appropriate level of information. We would also like to encourage employers that are entitled to carry out standard and enhanced checks to make sure that they look at their own recruitment processes and make sure that they are only asking about cautions and convictions that would not be filtered by the DBS”.

Brief details of the cases that formed part of our complaint to the ICO

Case One
An individual ticked ‘Yes’ to the question because the question hadn’t changed, and they didn’t see the accompanying guidance. To them, it was clear what question they were being asked, and so despite their conviction being one that would be filtered, they ticked ‘Yes’ which meant, because they handed the form back to the employer to submit, they had disclosed they had a conviction to the employer. The employer asked further questions about this, and decided to withdraw the job offer.

Case Two
An individual ticked ‘Yes’ to this question because they were not sure whether their conviction would be filtered. As there was no other means of definitively finding out whether it would be filtered or not, they erred on the side of caution and ticked ‘Yes’, believing that, if it would be filtered, it wouldn’t matter what they put. It turned out that their conviction was due to be filtered, but because they had ticked yes, their employer got to find out when they handed the form back, and subsequently decided to withdraw the job offer.


Notes to editors

  1. Press/media
  2. More information relating to the filtering process is available here.

We want to make sure that our website is as helpful as possible.

Letting us know if you easily found what you were looking for or not enables us to continue to improve our service for you and others.

Was it easy to find what you were looking for?

Thank you for your feedback.

12 million people have criminal records in the UK. We need your help to help them.

Help support us now