Secure Handling of Information
Our Code of Practice for the correct use, storage, retention and disposal of Disclosure information.
Llewelyn Enterprises Ltd T/A DBS Support Ltd (“we”) use the Disclosure & Barring Service (DBS) to help assess the suitability of applicants for positions of trust and comply fully with the DBS Code of Conduct regarding the correct use, storage, retention and disposal of Disclosures and Disclosure information.
We also comply fully with our obligations under the Data Protection Act 2018 and UK GDPR, as set out in “Handling of DBS certificate information” on GOV.UK, and other relevant legislation pertaining to the safe handling of Disclosure information, and have a written policy on these matters, as detailed below.
In accordance with section 124 of the Police Act 1997, Disclosure information is only passed to those who are authorised to receive it in the course of their duties.
Disclosure information is only used for the specific purpose for which it was requested and for which the applicant’s full consent has been given.
Once a recruitment decision has been made, Disclosure information is not retained for any longer than is absolutely necessary and is not photocopied. This is generally for a period of up to six months; however, in exceptional circumstances we will consult with the Disclosure & Barring Service (DBS) should it be necessary to keep Disclosure information for a longer period of time.
Digital identity verification (TrustID)
Where an applicant’s identity is verified using our digital identity verification route, provided by TrustID — a Digital Verification Service (DVS) certified under the UK Digital Identity and Attributes Trust Framework (DIATF), at the confidence level required for the relevant check type — the following additional safeguards apply, alongside everything set out above:
- Access to biometric verification data and outcomes is restricted to staff who need it to process the application, on the same basis as other Disclosure information.
- The audit trail of each digital identity check — including the data supplied by TrustID and the verification outcome — is retained for a minimum of 2 years and made available to DBS on request. This is a longer, distinct retention period from the six-month general Disclosure information retention described above.
- Any suspected compromise of biometric verification data is treated as a security incident and escalated immediately, in addition to our standard Disclosure information handling procedures.
- Applicants may choose manual (Route 2) identity verification instead of the digital route at any time, without disadvantage to their application.
Destruction & retention
Once the retention period has elapsed, we will ensure that any paper-based Disclosure information is immediately and safely destroyed by use of a shredder, and any electronic information is removed from the system.
All Disclosure information held on the e-bulk solution is removed as per the requirements of the Ministry of Justice. All personal information is wiped from the system six months after the disclosure date. For auditing purposes, the system retains a record holding only the following information:
- Applicant name
- Disclosure reference number
- Disclosure number
- Status
All data is managed and retained in line with DBS e-bulk requirements, as set out in the e-bulk Interchange Agreement (“DBS e-bulk: non-technical documents”, GOV.UK).
About us
OFFICIAL GOVERNMENT REGISTERED BODY 30157900009
DBS Support Ltd is a trading name of Llewelyn Enterprises Ltd t/a DBS Support Ltd, registered in England & Wales, No. 08862064.
Contact us
support@dbs-online.org.uk