DBS record keeping & compliance

Handling DBS certificate information is tightly governed: you must not keep a copy of the certificate, and you may keep only a limited record that a check was done.

You must not keep a copy of the certificate

Official guidance on handling DBS certificate information is clear: organisations should not keep any photocopy, image or other copy or representation of the contents of a certificate. Where certificate information is held at all (for example briefly, while a decision is made), it must be stored securely in lockable, non-portable storage with access strictly limited to those entitled to see it. [GOV.UK]

What you can record instead

You may keep a limited “record that a check was carried out”. Guidance indicates this can include:

• the date the certificate was issued;
• the person’s name;
• the type of certificate requested;
• the position applied for;
• the certificate’s unique reference number;
• the recruitment decision taken.

Notice what is not on that list: the actual disclosure content. The permitted record is metadata and a decision — not the criminal-record detail.

Retention and secure disposal

Certificate information should be kept no longer than necessary for the purpose it was requested — generally until the recruitment or other relevant decision is made — unless it is needed to resolve a dispute or complaint or for a safeguarding audit. Once the retention period ends, it should be securely destroyed (for example by shredding, pulping or burning). [GOV.UK]

How Complys helps — status and evidence, not disclosure content

Complys is compliance software, not a DBS service. It is well suited to holding exactly the permitted record-of-check metadata against a worker record — the check type/level, the date, the reference number, the position, and your recruitment decision — plus a review/re-check date with a reminder. It is designed for status and evidence, not for storing the certificate’s disclosure content. Used this way it supports:

• worker records that hold the record-of-check metadata against the person;
• expiry and review reminders so re-checks and status checks are not missed;
• a training / competence matrix alongside safer-recruitment evidence;
• a document library for policies and safer-recruitment records.

Keep your storage, retention and disposal practices aligned with the official handling guidance — do not use any system, including Complys, to retain certificate content beyond what is permitted.