Handling of DBS certificate information

General principles

As an organisation using the Disclosure & Barring Service (DBS) checking service to help assess the suitability of applicants for positions of trust, the University of Exeter complies fully with the Code of Practice regarding the correct handling, use, storage, retention and disposal of certificates and certificate information. It also complies fully with its obligations under the Data Protection Act 1998 and other relevant legislation pertaining to the safe handling, use, storage, retention and disposal of certificate information (for further information on Data Protection please go to the University’s Data Protection webpage.

Storage and access

Certificate information is never kept on an applicant's personnel file and is always kept separately and securely, in lockable, non-portable, storage containers with access strictly controlled and limited to those who are entitled to see it as part of their duties.

Handling

In accordance with section 124 of the Police Act 1997, certificate information is only passed to those who are authorised to receive it in the course of their duties. The University maintains a record of all those to whom certificates or certificate information has been revealed and the University recognises that it is a criminal offence to pass this information to anyone who is not entitled to receive it.

Usage

Certificate information is only used for the specific purpose for which it was requested and for which the applicant's full consent has been given.

Retention

Once a recruitment (or other relevant) decision has been made, the University does not keep certificate information for any longer than is absolutely necessary. This is generally for a period of up to six months, to allow for the consideration and resolution of any disputes or complaints. If, in very exceptional circumstances, it is considered necessary to keep certificate information for longer than six-months, the University will consult the DBS about this and will give full consideration to the Data Protection Act and Human Rights Act and inform the individual subject before doing so. Throughout this time, the conditions regarding appropriate, safe storage and strictly controlled access will prevail.

Disposal

Once the retention period has elapsed, the University of Exeter will ensure that any DBS certificate information is immediately destroyed by secure means, ie by shredding, pulping or burning. While awaiting destruction, certificate information will not be kept in any insecure receptacle (eg waste bin or confidential waste sack). We will not keep any photocopy or other image of the certificate or any copy or representation of the contents of a certificate.

However, notwithstanding the above, the University may keep a record of the date of issue of a certificate, the name of the subject, the type of certificate requested, the position for which the certificate was requested, the unique reference number of the certificate and the details of the recruitment decision taken.