Criminal offence data

It has its own legal route

Criminal offence data includes allegations, proceedings, convictions and sentences, as well as related security measures. It can arise in a criminal record certificate, a disclosure from a candidate or an investigation record. It is not one of the special categories in Article 9, but UK GDPR Article 10 gives it separate protection.

An employer needs an Article 6 lawful basis and must either act under official authority or meet a condition in Schedule 1 to the Data Protection Act 2018. The ICO's criminal-offence-data guidance explains that an appropriate policy document is also required for many Schedule 1 conditions.

Start with the role, not the curiosity

Decide what information is genuinely needed and why before asking a candidate or worker about it. A role's eligibility for a criminal record check and the data-protection condition for using the result are related questions, but they are not the same test.

The ICO's vetting guidance says vetting should be necessary and proportionate to the role. Do not collect broad declarations from everyone because a more limited check would be easier to administer.

Restrict the record and its lifetime

Limit access to people making the authorised decision. Record the source, purpose, lawful basis, Schedule 1 condition, policy-document requirement and reasoning. Keep certificate detail out of ordinary interview notes and general personnel files.

Set a deliberate retention period. Often the useful record is the check type, date, outcome and decision rather than a lasting copy of every disclosed detail. Review access and deletion across email, downloads and supplier systems as well as the main HR record.