91±¬ÁÏ

You’ve found the right candidate, the interviews have gone well and the offer’s been accepted. Before they can officially start, though, there are still a few important checks employers need to complete to make sure everything is compliant and properly documented. These are known as background checks. 

We know that organising background checks isn’t super exciting. But getting this process wrong can be an expensive mistake for a business. The penalties are serious with (or £60,000 for reoffenders) per illegal worker, regulatory breaches and lasting reputational damage.

The good news is that once you know exactly what the law requires and why, the whole thing becomes a lot less daunting. This guide breaks it all down: what you must do, what you should do and how to stop background checks from becoming the bottleneck that slows every hire down.

What are background checks?

Background checks are how employers verify that a candidate is who they say they are, that they’re legally allowed to do the job and that nothing in their history makes them unsuitable for the role.

The type and level of checks you need depends heavily on the role, the industry and the regulatory environment you operate in.

Here’s what background checks are designed to do:

• Confirm a candidate’s identity and their right to work in the UK.
• Reduce the risk of a bad hire slipping through.
• Keep you on the right side of employment law and regulation.
• Protect your employees, your customers and your business reputation.
• Verify that candidates actually hold the qualifications or licences the role requires.

Done well, they protect everyone. Done badly or not at all, they leave you exposed.

Which background checks are legally required in the UK?

Not all background checks carry the same legal weight. Some are mandatory for every employer in the UK. Others only apply in specific industries or for specific types of work. And some are entirely discretionary.

Right to work checks

This is the non-negotiable one. Every UK employer, without exception, must verify that every person they hire has the legal right to work in the UK. Not after they start. Before.

The legal obligation comes from the and it applies whether you’re a sole trader taking on your first member of staff or a business with hundreds of employees.

There are three ways to do it:

• Manual document check: Review original documents in person or by video, then copy and securely store them. Acceptable documents include a UK or Irish passport, a biometric residence permit or a share code letter. As this process involves handling sensitive employee PII, businesses should ensure copies are stored in secure, auditable systems to reduce the risk of personal data being duplicated across multiple devices or platforms without proper oversight.
• Online check via Home Office share code: Available for non-UK and non-Irish citizens, this process requires a share code generated through the Home Office system, either by the employee/candidate via the website or by the employer on their behalf. The share code, used alongside the candidate’s date of birth, allows employers to verify right to work status online. However, the process can add administrative overhead, and share codes are only valid for up to 90 days, meaning checks may need to be repeated if onboarding is delayed.
• Digital verification via a certified Identity Service Provider (IDVT): Available for British and Irish citizens with a valid passport. Employers should make sure any IDVT provider they use meets current government certification and trust framework requirements.

There are a couple of key things UK businesses need to keep in mind when it comes to right to work checks. Expired Biometric Residence Permits are no longer acceptable as evidence of right to work under updated Home Office guidance. And if an employee has limited leave to remain in the UK, a single check at the start of employment is not enough. You need to carry out a follow-up check before their leave expires or your statutory defence against a civil penalty will lapse.

DBS checks (where applicable)

DBS checks are where things get more nuanced. They’re not required for every role, but in certain sectors and for certain types of work, they’re a legal obligation you can’t skip.

The Disclosure and Barring Service issues four types of certificate and the level you’re entitled to request depends on what the job involves. It’s important to keep in mind that requesting a higher-level check than the role legally qualifies for is unlawful under the Data Protection Act 2018.

Here’s a quick overview of each level:

DBS Level	What it shows	When it’s required
Basic DBS	Unspent convictions and conditional cautions.	Available to any employer, for any role, at their discretion.
Standard DBS	Spent and unspent convictions, cautions, reprimands, warnings.	Roles covered by the Rehabilitation of Offenders Act Exceptions Order.
Enhanced DBS	Standard content and relevant local police information.	Roles involving regular contact with children or vulnerable adults.
Enhanced DBS  and Barred Lists	Enhanced content and barred list checks.	Regulated activity (e.g. schools, care homes, NHS roles).

have no official expiry date, but best practice is to ask for an update every 3-5 years. Build reviews into your process and remember that DBS certificate information should not be retained for longer than six months in most circumstances.

Employment reference checks (sector-dependent)

References are not a universal legal requirement in the UK. For most private sector employers, there’s no law saying you must obtain them before hiring someone.

That changes in regulated sectors. Under safer recruitment frameworks issued by and the , employment references are a required part of the hiring process for roles in education, childcare and adult social care. In these settings, references need to meet specific standards and usually have to come from a direct line manager.

For everyone else, references remain best practice, especially for senior or high-responsibility roles. 

Professional qualifications and licences

Some roles require candidates to hold specific qualifications, registrations or licences. Not as a preference. As a legal requirement.

Examples you’ll come across:

• Nurses and midwives: Must be registered with the Nursing and Midwifery Council (NMC) before starting a clinical role.
• Doctors: Registration with the General Medical Council (GMC) is non-negotiable.
• Solicitors: Must be authorised by the Solicitors Regulation Authority (SRA).
• Financial advisers: FCA authorisation or registration is required depending on the regulated activity involved.
• Drivers: DVLA licence check, including category entitlements and any endorsements.

Most professional registers are publicly searchable, so verification is usually straightforward. The risk comes from skipping the check entirely or from verifying at the point of hire without setting up a process for renewals.

Equality and discrimination considerations

Whatever background checks you run, how you run them matters just as much as what they contain.

All screening processes must comply with and the . Running a DBS check on some candidates but not others in the same role or applying social media screening inconsistently across your candidate pool, exposes you to discrimination claims.

Under UK GDPR, you also need a lawful basis for processing the personal data collected during screening. For most employment checks, that will be either legal obligation or legitimate interests. However, criminal records data, including DBS certificates, is subject to stricter rules under Article 10 UK GDPR and the Data Protection Act 2018, meaning employers must identify an additional condition for processing. Document your approach, store everything securely and don’t hold onto information any longer than you need to.

The rule of thumb: be consistent, be proportionate and document your process.

Which checks are recommended but not legally required?

Outside regulated sectors, these checks sit in best-practice territory. Whether you run them should come down to a genuine risk assessment of the role, not a blanket policy applied to everyone.

Type of check	When it applies
Employment history checks.	Best practice, especially for senior or sensitive roles.
Credit checks.	Finance or roles with financial responsibility.
Social media screening.	Should be risk-based and applied consistently.
Basic DBS (outside regulated sectors).	Often used for trust or customer-facing roles.
Identity verification (beyond right to work).	Useful for remote or high-risk hiring.

Common compliance mistakes employers make

Most compliance failures in background checking aren’t the result of bad intentions. They come from process problems. And the most common ones come up again and again.

• Inconsistent processes across roles or hiring managers. When different people in the business handle checks differently, gaps are almost inevitable. If one hiring manager runs right to work checks and another doesn’t, the business is still exposed. Consistency isn’t optional.
• Missing or incomplete right to work documentation. The statutory defence against a civil penalty only holds if the check was completed correctly before employment started and the documents were retained properly. A check done after day one or a document that wasn’t copied in the right format, won’t protect you.
• Delayed checks initiated after the start date. Right to work must be completed before employment begins. DBS checks for regulated roles are not something to sort out during the first week of induction. Late checks are compliance gaps, full stop.
• Storing sensitive data incorrectly or longer than necessary. DBS certificate information should not be held beyond six months in most circumstances. Keeping it in an unsecured inbox or shared folder is a data protection problem waiting to happen.
• Manual admin errors from managing checks outside the HR system. When checks live in email threads, spreadsheets or a separate provider portal with no connection to your HR platform, things fall through the cracks. A missing document or an uncompleted check is easy to miss when there’s no central record.
• Weak audit trails. If you can’t show what was checked, when and what the outcome was, you can’t demonstrate compliance. Good record-keeping isn’t a nice-to-have. It’s part of the job.

How 91±¬ÁÏ and Zinc simplify background checks

Here’s the honest truth about managing background checks manually: it’s fragmented, it’s slow and it creates exactly the kind of gaps that lead to compliance issues. Checks are spread across inboxes and spreadsheets, with no single view of what’s been completed or what’s still outstanding. HR teams end up chasing documents instead of focusing on higher-value work.

So we built a better way.

91±¬ÁÏ’s integration with Zinc brings background checking directly into your platform. No switching systems. No copying data between tools. No chasing candidates by email.

Here’s how it works: 

• Checks are triggered from three places inside 91±¬ÁÏ: a candidate’s profile in the ATS via the Background Checks tab, a job listing’s candidate view or an employee’s profile in the People tab using the Background and Eligibility widget.
• Once initiated, Zinc contacts the candidate directly to collect everything it needs. Your HR team doesn’t need to follow up with anyone. The candidate completes their part on any device and Zinc does the rest.
• Results sync automatically back to the candidate or employee record via webhook. PDF reports are available to download on demand. Any check that requires human review can be marked as reviewed directly in the platform, keeping your audit trail clean and the status accurate.
• The full picture is always in one place. The Background Checks report under Reports > Compliance gives you a full view of every employee check across your business: who it’s for, what type it is, who initiated it and the current status. Candidate checks are tracked separately under your Recruitment reports. Both are filterable, downloadable and always up to date, so your team always knows where things stand.

The checks available through the integration cover the most common requirements for UK employers including: 

• Right to work.
• Basic DBS.
• Identity verification.
• Address history.
• Education and qualification verification.
• Sanctions screening.
• Social media screening.
• Financial checks
• Credit checks.

Less admin. Less chasing. Just a clean, auditable process that runs alongside your hiring without slowing it down.

Background checks, built right in with 91±¬ÁÏ + Zinc

Background checks are essential for every UK business, for every hire. No exceptions. And the risk of getting it wrong is significant. But the reality is, when they are managed across spreadsheets, inboxes and disconnected systems, making mistakes is more likely. 

That’s where integration makes the difference.

With 91±¬ÁÏ and Zinc working together, background checks become part of your natural hiring workflow. Everything is triggered directly inside your HR system, completed by the candidate without manual chasing and automatically synced back into your records. Your team gets full visibility of every check, every status and every outcome in one place, without adding extra admin.

Instead of managing compliance reactively, you’re building it into the hiring process from the start. Faster onboarding, fewer manual errors and a clearer audit trail across your organisation.

Want to find out more?