Employing one person without the right to work can now cost up to £60,000. Starting a carer before their DBS clears is a safeguarding breach. These are not HR admin — they are legal duties, and the price of getting them wrong has risen sharply. Here is what care, construction and security employers must check, and the personnel-data trap sitting behind it.
There is a kind of compliance that quietly decides whether a business survives an inspection, an audit or a Home Office visit — and it has nothing to do with ISO clauses or cyber controls. It is whether you can prove, for every person on your payroll, that you were legally allowed to employ them and that they were safe to do the job.
For years this was treated as HR paperwork: a passport photocopied into a folder, a DBS certificate filed and forgotten. Two things changed that. The penalties for getting it wrong have risen sharply, and the data those checks produce is now some of the most tightly regulated information a business holds. This is a plain-English guide to what UK employers — especially in care, construction and security — actually have to do.
Every employer must confirm a person has the right to work in the UK before they start. Get it wrong and, since 13 February 2024, the civil penalty is up to £45,000 per worker for a first breach and £60,000 per worker for a repeat breach within three years — roughly triple the previous levels. That is per worker, not per business.
Above the civil penalty sits the criminal offence: knowingly employing someone without the right to work — or having reasonable cause to believe they lack it — carries up to five years' imprisonment and an unlimited fine.
The good news: doing it right is mostly free. You establish a “statutory excuse” — your defence against a penalty — by one of three routes, completed and recorded before the start date:
For most people with a digital immigration status (eVisa holders), you enter their share code and date of birth into the free Home Office online service. Instant — and it gives you a statutory excuse.
Check an original acceptable document (usually a passport) in the person's presence — or by video call with the original in hand — then copy, date and keep it.
For British and Irish citizens with a valid passport, a certified Identity Service Provider can verify identity digitally. Use an uncertified provider and you get no statutory excuse — the liability stays with you.
A right-to-work check tells you someone can work; a DBS check helps tell you they are safe to do a particular job. There are three levels, and using the wrong one is its own failure:
| Level | What it shows | Typical roles & fee |
|---|---|---|
| Basic | Unspent convictions and cautions | Any role; anyone can apply directly via gov.uk (£21.50) |
| Standard | Spent & unspent convictions, cautions, warnings | Specific roles set in law — including every SIA security licence (£21.50) |
| Enhanced | The above plus police intelligence and, where relevant, the barred list | “Regulated activity” — caring for children or vulnerable adults (£49.50) |
DBS fees as set on 2 December 2024. Check gov.uk for the current position.
Care. Most hands-on care work is regulated activity, so it needs an Enhanced check with a barred-list check. Starting someone in that role before the check is satisfactory is treated by the CQC as a serious safeguarding breach — the classic finding that turns a routine inspection into enforcement.
Construction & security. Most construction roles need a Basic check at most; security staff need a Standard check as a mandatory part of every SIA licence. Two traps catch people out: Standard and Enhanced checks can only be obtained through a DBS Registered Body or an umbrella body — you cannot apply directly — and the certificate you receive cannot simply be filed forever.
Even employers who had this nailed a year ago need to look again. The last two years have brought real change:
The jump to £45,000/£60,000 per worker is the single biggest change, and the reason a check you “usually get round to” is now a board-level risk.
The Worker Protection Act 2023 created a proactive duty to take reasonable steps to prevent sexual harassment, including by third parties, with tribunal compensation uplifts of up to 25% where you fall short. Induction, policies and training records now have to prove the steps you took.
Royal Assent in December 2025. Among the changes expected to phase in through 2027: the unfair-dismissal qualifying period cut from two years to six months, the compensation cap removed, and tighter rules on zero-hours and fire-and-rehire. Clean records and defensible processes matter more, not less. (Most provisions are not yet in force — check the current position.)
Commenced February 2026, with the ICO entering the year with sharper enforcement powers — which brings us to the part most employers overlook.
The checks above generate exactly the kind of data the law protects most. A DBS result is criminal-offence data under Article 10 of the UK GDPR; health and medical information is special-category data under Article 9. Both demand more than a locked filing cabinet:
This matters because ICO enforcement is intensifying — the regulator collected several times more in fines in 2025 than in 2024, with the average penalty rising into the millions. A spreadsheet of DBS numbers on a shared drive, visible to whoever, is the kind of arrangement that looks fine until the day it very much doesn't.
Right to work established (share code, manual, or certified IDVT), the correct DBS level for the role obtained, references and any role-specific credentials (SIA, CSCS, professional registration, medical) on file. Keep the evidence, not just a tick.
DBS destroyed at around six months; right-to-work kept for the statutory period; payroll for years. One retention rule for “HR files” is over-retention and under-retention at once.
Restrict who can see criminal-offence and health data to those who genuinely need it, log every access, and encrypt it at rest. If you can't say who looked at a DBS record last month, you can't answer an inspector or the ICO.
When someone leaves, revoke access and let retention rules erase what you're no longer allowed to keep — with an audit record that erasure happened. Right to erasure is a duty, not a favour.
This is exactly what we built the PICMS People Vault to do — a single, locked-down home for your team's records: right to work, DBS, medicals, competence and registrations, with the compliance built in rather than bolted on.
You can run the free Home Office right-to-work check and a Basic DBS straight from a person's record and file the result as evidence; per-role rules tell you which checks each job needs; and a new starter's onboarding pack tracks what's outstanding. Sensitive data is encrypted at rest and every view is logged; criminal-offence and health data only ever leaves the vault through an explicit, recorded share; and access can be protected with a one-time verification code. When someone leaves, offboarding revokes their shares and retention rules delete each document the day its lawful period ends — the DBS at six months, payroll years later — every deletion recorded.
To be plain about what software does: PICMS does not carry out your checks for you, is not a DBS body, and this article is general guidance, not legal advice — penalty and fee figures change, so check gov.uk at the time of reading. What it does is make the duty visible, the evidence current, and the data defensible, so a check you'd otherwise “get round to” is done, provable and safe.
PICMS People Vault is a locked-down home for right to work, DBS, medicals and competence — run the free gov checks from a person's record, log every view, and let retention rules erase what you can't lawfully keep. From £149/mo, on any plan.