Practical guidance – Asking for self-disclosure of criminal records information

Aim of this guidance

This guidance explores the role of self-disclosure and looks at when it could (and when it probably shouldn’t) play a role in the recruitment process.

‘Self-disclosure’ in this context means individuals providing an employer with details about their criminal record. This is in contrast to official disclosure, which means carrying out criminal record checks using the appropriate government agency – in England & Wales, the Disclosure and Barring Service (DBS).

Whether a tick box on the application form or part of pre-employment checks, asking has become the norm, often without employers questioning why they ask, or whether the information is relevant to the role. Employers carrying out regulated activity are legally obliged to carry out an enhanced DBS check as part of the recruitment process, but many also ask for written self-disclosure prior to interview.

Employers are accountable for ensuring they comply with data protection law – The General Data Protection Regulation (GDPR) and the Data Protection Act 2018. The penalties for failure to comply can include an enforcement notice, or a fine of up to €20 million, or 4% of annual revenue for breaches related to the basic principles or lawfulness of processing.

It is hard to envisage a case where asking all applicants to self-disclose any criminal record is both necessary and proportionate (although if you do this and can explain why, please let us know). Doing so could be considered excessive data collection. Most applicants will not be successful, and employers will then be responsible for managing a large amount of sensitive data. The management of criminal records data has its own compliance considerations and employers should be clear about their responsibilities for managing the data they hold.

Unlock encourages employers to follow ten principles of fair recruitment, including banning the box from application forms. If it is necessary to ask about criminal records at all, we suggest asking only the preferred candidate/s, or simply carrying out a DBS check (at the appropriate level) ahead of a formal offer of employment. Employers should hold an open discussion with the candidate about any relevant criminal records, before a final decision is made. Whatever approach employers take, the purpose of asking for self-disclosure must be made clear from the start.

Things to consider

When asking whether self-disclosure is necessary and proportionate, there are a few things to consider.

Will applicants undergo a DBS check?

If the applicant will undergo a DBS check before appointment, what is the purpose of self-disclosure? It can be an opportunity to have an open and frank discussion, allowing employers to ask questions and applicants to provide context. However, advice from the ICO indicated:

‘In general, an organisation asking people to self-declare criminal offence data when it is going to be undertaking DBS checks can be deemed excessive and due to the complexity of the legislation, it could potentially receive inaccurate information. Good practice would be undertaking checks when individuals have a conditional offer rather than at the interview stage.’

Though this advice is case specific, it illustrates that employers must demonstrate how asking for self-disclosure is necessary if carrying out a DBS check. If you are unable to demonstrate necessity, you should not ask for self-disclosure.

How will you use the self-disclosure?

Employers sometimes use self-disclosure as a test of an applicant’s integrity, comparing their self-disclosure with the DBS certificate and taking discrepancies as evidence of dishonesty. This is a potentially risky use of personal data and could be considered unfair.

Sometimes people don’t know or can’t remember the details of their criminal record. In our experience, applicants make honest mistakes in disclosing and there are risks when employers rely on this information. Examples include:

  • Disclosing something that is not required:
    • Jim disclosed a spent conviction when applying for a job in a supermarket. It is a job covered by the ROA and so a spent conviction shouldn’t have been taken into account.
  • Not disclosing something that is required:
    • Esther did not disclose a childhood caution when applying for a promotion that was eligible for a standard DBS check because she mistakenly believed childhood criminal records were automatically deleted at 18.
    • Nadeem disclosed a conviction for benefit fraud but his DBS check showed he was convicted of two counts, dealt with in the same proceedings on the same day and by way of the same penalty.
    • Laura needed to disclose a caution on her application for a hospital receptionist role but couldn’t remember the name of the offence. Requesting this information could take weeks, by which time the application deadline had passed.

These examples underlines why it is important not to use self-disclosure as a test of an applicant’s honesty or integrity, but as a chance to have an open discussion. This should take place in the latter stages of the recruitment process to ensure that applicants are not inadvertently discriminated against.

How will you verify the information?

If the purpose of asking about criminal records is to assess risk to your staff or business, unverified self-disclosure is unlikely to fulfil that purpose. As described above, people make mistakes when disclosing and some may deliberately not disclose. It will be difficult to demonstrate the necessity of asking for self-disclosure if the information will not be verified.

Is the role exempt from the Rehabilitation of Offenders Act 1974?

Where the role is exempt from the Rehabilitation of Offenders Act 1974, it will be eligible for a standard or enhanced DBS check. Employers recruiting for roles in regulated activity – teachers, medical professionals – will carry out enhanced DBS checks with a check against the children’s and/or adults’ barred list. If a candidate is barred from regulated activity, they cannot be employed in the role, and applying may be an offence. If a candidate has a criminal record but is not barred, it is the employer’s decision.

DBS checks are necessary for exempt roles and self-disclosure can give preferred candidates the chance to provide detail and context around their criminal record and to answer questions about the changes they have made since that time. However, employers must still demonstrate that it is necessary to ask for self-disclosure. We think that any self-disclosure prior to offer stage is likely to be excessive, and recruiters run the risk of inadvertently discriminating against suitable and qualified candidates because of their criminal record. As mentioned above, unless an applicant is barred there is no legal reason why they cannot be considered. In most cases the suitability of the applicant will be a matter for the employer to decide. Research we published in 2018 found the vast majority of criminal records that appear on standard and enhanced DBS checks are old and minor, often from decades ago.

Considering criminal records in context is a key principle of fair recruitment. The need to minimize data collection must be balanced alongside other data protection principles. For exempt roles, we consider the principles of fairness and accuracy are best met by allowing candidates the opportunity to discuss their criminal record before a decision is made. Fair treatment of criminal records information means allowing applicants the chance to provide context. This also enables them to provide an accurate picture of the circumstances and what happened as well as what has changed since.

It is possible to have this discussion with a candidate once the DBS certificate is received so employers who elect to ask for self-disclosure before a DBS check comes back must be clear about why they consider this to be necessary and proportionate. The timing of any self-disclosure, how it is carried out and how information is managed are important factors to consider in whether it is necessary and proportionate. Bear in mind the ICO’s advice – self-disclosure is likely to be excessive if carrying out a DBS check, unless an employer can demonstrate that it is necessary. If it is necessary, make sure the question asked elicits only the necessary, relevant information. Employers, as controllers, are accountable for all processing.

Employers recruiting for roles covered by the ROA should consider whether to ask about criminal records at all. If you decide you do need to ask, bear in mind the need to demonstrate the necessity of doing so. If you cannot demonstrate necessity, asking is unlikely to be compliant with the law. You can still carry out a DBS check even if you do not ask for self-disclosure, but this should be made clear to applicants from the start.

If the role is covered by the ROA, there is no legal requirement to carry out a DBS check, although employers can request a basic check if they can demonstrate that it is necessary and proportionate to do so. As always, only the minimum amount of data should be collected. For compliance with the data protection principle of data minimization, we advise employers not to request self-disclosure for roles covered by the ROA, but instead provide an opportunity for applicants to discuss any relevant information that appears on the DBS certificate

If you need to ask for self-disclosure

If, having considered the above, you decide you need to ask for self-disclosure, bear in mind that the timing of self-disclosure is an important part of demonstrating necessity and proportionality. We recommend it be from the preferred candidate/s only and in person. This ensures that:

  • Applicants are considered on merit
  • You collect only necessary data
  • Recruiters have the opportunity to ask questions and understand context.

The purpose and lawful basis for asking applicants to self-disclose should be set out in your recruitment policy, which will need to include privacy information for applicants.

Staff should have appropriate training so they can properly assess any information disclosed. For example, protected convictions are old/minor cautions or convictions that, by law, will no longer be disclosed on an enhanced DBS certificate.

Keep written records to a minimum. If you do use paper forms for self-disclosure you will need to demonstrate that these are necessary and include them in your data retention schedule to ensure that they are stored/destroyed appropriately. Ensure any forms you use reflect your approach to assessing criminal records and don’t rely on tick boxes or narrow free text fields.

Our recommended practice

For ROA exempt roles and organisations with statutory safeguarding duties:

  • Bear in mind, safeguarding responsibilities are not compromised by asking applicants later
  • Consider whether self-disclosure is both necessary and proportionate
  • Be clear that self-disclosure is the applicant’s chance to provide context, not an opportunity to compare with the DBS disclosure as a test of their honesty or memory.

For roles covered by the ROA:

  • Consider whether asking about criminal records is necessary at all
  • If you are carrying out a basic check, self-disclosure is potentially excessive
  • If you don’t plan to carry out a basic check, self-disclosure is not being verified and the purpose is therefore unclear.

For all roles:

  • Consider if and when self disclosure is necessary
  • Understand compliance requirements relating to data collection, retention and security
  • Provide applicants with guidance on disclosure legislation and your policy
  • Staff handling criminal records information should have appropriate training
  • Ensure your policy is GDPR compliant
  • Only use paper forms if necessary and avoid tick boxes or narrow free text fields
  • Have a clear framework for assessing criminal records disclosure, and keep records of decisions made
  • Remember that you are accountable for any processing that takes place

Examples of good practice

ROA exempt roles

NHS Employers

‘Unless there is a specific safeguarding requirement for us to ask for information earlier in the recruitment process, we will only require you to complete and return this form after we have issued a conditional offer of appointment. Any requirements for information to be provided to us earlier in the process will have been made clear to you when you applied for this position.’

More information for schools

Roles covered by the ROA


Freshfields only request information about unspent convictions once a job offer has been made, and convictions that are later disclosed will be assessed on a case-by-case basis. They have implemented a robust policy and process to consider the risk and relevance of any disclosed convictions to the firm. This process is handled by the HR team at the same time as pre-employment checks and is the same for their regulated and unregulated roles.

City and Guilds

The City & Guilds Group do not ask about criminal convictions at any stage in the recruitment process.

More information

Read Unlock’s Principles for Fair Chance Recruitment

Read more about Unlock’s project Fair Access to Employment

Read Unlock’s guidance for employers on complying with GDPR and data protection law

See the full list of Ban the Box employers.

Print Friendly, PDF & Email