DBS check policy template
Certificates never expire and nobody reminds you - so the policy's real job is naming the level, the cycle and the person who owns the diary.
If you use standard or enhanced checks you must have a policy on employing ex-offenders, and certificate information has to be handled under written rules - so put both in one DBS policy. Copy the eight clauses below, fill the square brackets, and pair it with the downloadable renewal tracker. The legal background is in the employer's guide to DBS checks.
What does a DBS check policy say? The template
This policy sets out how [Company] uses Disclosure and Barring Service (DBS) checks: which roles require them, at what level, how often they are repeated, how disclosed information is treated, and how certificate information is stored and destroyed. It applies to employees, workers, volunteers and contractors in the roles listed in clause 2.
The level of check is determined by the role's legal eligibility, not preference. [Company] maintains a role-to-level register: [list role groups, e.g. "Care staff - enhanced with adults' barred list; Finance manager - basic; Office roles - basic or none"]. The reason each role qualifies for its level is recorded with the register. Where a role is not eligible for a standard or enhanced check, no more than a basic check is requested.
Checks are applied for when a conditional offer is accepted. Offers for roles in clause 2 are conditional on a satisfactory check at the required level. Whether and how a person may begin work before a certificate is issued is decided by [role, e.g. the Registered Manager] against sector rules, recorded in writing, and where permitted is subject to [supervision arrangements / DBS Adult First where applicable].
DBS certificates have no expiry date; [Company] re-checks roles in clause 2 every [1/2/3] years, as guided by [regulator/insurer]. [Company] [encourages/requires] staff in these roles to join the DBS Update Service within 30 days of certificate issue [and reimburses the annual fee]. Where a person subscribes and gives consent, a status check replaces a new application at each renewal. [Named role] owns the renewal register and reminder dates.
[Company] assesses disclosed information fairly and individually. A conviction or caution is considered against the role: its relevance to the duties, its seriousness, how long ago it occurred, the person's circumstances since, and the pattern if more than one. Except where the law itself bars a person from a role (barring, in regulated activity), no outcome is automatic. Decisions are made by [named roles], recorded with reasons, and discussed with the candidate before being finalised.
Certificate information is seen only by those who need it to carry out their duties: [named roles]. Once a decision is made, [Company] records the check level, certificate number, issue date and outcome, and does not keep certificate information itself longer than is necessary for the decision or any dispute arising from it. Certificate information is stored securely, separately from general personnel files, and destroyed by secure means when no longer needed.
If a candidate or employee declines a check required by this policy, [Company] explains what the check is for and the consequence of refusal. For roles where a check is a legal or regulatory requirement, the role cannot be offered or continued without one; alternatives (such as redeployment to a role without the requirement) are considered where they exist.
Processing under this policy is carried out under [Company]'s privacy notice and data protection policy. This policy is owned by [named role] and reviewed [annually], including the role-to-level register, the renewal cycle and current DBS fees.
Download the renewal tracker CSV · opens in Excel, Numbers or Sheets
How do you adapt the DBS policy?
Clause 2 is the one that does the compliance work: be specific about role groups and record why each level applies, because that reasoning is what a registered body, regulator or tribunal asks for. Clause 4's bracketed choices are the operational decisions - cycle length, who pays for the Update Service, who owns the diary. If your sector has its own safeguarding framework (education, regulated care), reference it explicitly in clause 3. For choosing levels, see basic vs standard vs enhanced; for timing the recruitment pipeline around the check, see how long a DBS check takes; and DBS evidence belongs alongside right to work in the same tracked compliance file.
Frequently asked questions
Does an employer need a DBS policy?
Employers using standard or enhanced checks must have a policy on employing ex-offenders, and gov.uk guidance expects certificate information to be handled under a written policy: seen only by those who need it, kept no longer than necessary and destroyed securely. A single DBS policy covering both is the practical answer.
What should a DBS check policy contain?
Which roles require which check level and why; when checks happen in recruitment; the re-check cycle and Update Service approach; how disclosed information is assessed fairly against the role; how certificate information is stored, who sees it and when it is destroyed; and who owns the register.
How often should DBS checks be renewed?
Certificates never expire, so the cycle is the employer's decision guided by regulators and insurers - commonly every one to three years in care and education. The policy should state the cycle per role group and name who tracks it.
Can a conviction automatically disqualify a candidate?
Only barring is automatic: a barred person must not be employed in regulated activity. Anything else on a certificate is assessed against the role - its relevance, seriousness and age - which is what an ex-offenders policy commits the employer to doing.
More to download: All 45 templates · 79 guides explaining the rules · 27 calculators
Or let the register keep itself
CoDash records each person's DBS level, certificate number and renewal date next to right-to-work and training - and chases the renewals so the spreadsheet never goes stale.