Not everyone who runs a background check on you in the UK needs your permission to do it. Some checks require explicit consent, but others draw entirely on public information and involve no data processing. The type of check and who is running it determines whether permission is needed, and where you stand.
Which background checks require your consent in the UK?
Most people asking whether someone can check their criminal record in the UK without telling them are thinking about DBS. And the answer is no. DBS checks always require consent.
A DBS check without consent in the UK cannot be lawfully submitted. The individual must know it is happening and actively agree, and that agreement needs to be informed and genuine, not buried in small print or implied.
Any check involving personal data also needs a lawful basis under UK GDPR. Consent is one thing, but you’ll need to consider legitimate interest and legal obligation too. That’s why employers can sometimes run checks without explicitly asking your permission, provided they have set out how your data is processed in a privacy notice and their reasoning is sound.
What can employers legally check without telling you?
Publicly available information does not require your consent, because no protected personal data processing is involved. Companies House records, court judgments, professional profiles, and insolvency registers are all accessible to anyone.
An employer checking whether your stated qualifications match publicly available records is acting within the law without needing to ask.
What employers cannot do is access restricted records, run a DBS check, or use your data in ways that go beyond their stated purposes. A GDPR background check in the UK requires transparency about what is being checked, the legal basis for doing so, and how findings will be stored and used. Failing on any of those points exposes an employer to ICO enforcement.
Can a PI run a background check on you lawfully?
A PI working from open-source intelligence, public records, and lawful databases does not need your consent. There is no legal right to be free from investigation using information that is already in the public domain, and a professionally run check of that kind is entirely within the law.
An unlawful background check in the UK looks different. Accessing restricted records without authority, obtaining personal data through deception, or processing information without a documented lawful basis all cross the line.
A professionally accredited agency avoids all of that, because evidence gathered through unlawful means is inadmissible and the exposure for both investigator and client is serious. The distinction between a lawful and unlawful check comes down to method, not the intention behind commissioning it.
Your rights under GDPR and the Data Protection Act 2018
UK GDPR gives you specific rights over how your personal data is used. You can request access to any data an organisation holds on you, ask for inaccurate data to be corrected, and sometimes, request deletion. You can also object to processing where the organisation cannot demonstrate a clear lawful basis for it. These rights apply regardless of whether the organisation is an employer, a reference agency, or a private investigator.
Transparency is also a requirement, not a courtesy. Organisations must tell you at the point of data collection who they are and why they are processing your information. If that hasn’t happened, it may constitute a breach of UK GDPR and be grounds for an ICO complaint.
A data access request is the practical starting point if you suspect something has gone wrong. Organisations have one month to respond. If the response confirms unlawful processing, or they simply do not reply, that is sufficient basis for an ICO complaint. The ICO has genuine enforcement teeth, including substantial fines and the power to order organisations to stop processing your data entirely, so don’t be afraid to use them.
What to do if you suspect an unlawful background check
Submit a subject access request to any organisation you believe has processed your data without lawful basis. Document what you know, including dates and any evidence of who may have conducted the check. Keep records of any unusual activity, communications, or indicators that an investigation may be underway.
If a PI is involved, the ICO is the go-to for data protection concerns and the police are the ones to contact if any conduct amounts to harassment or is unlawful. If you’ve suffered damage as a result of unlawful data processing, including distress or financial loss, civil action against the organisation responsible may also be an option.
Knowing your rights makes a difference
Most background checks in the UK are conducted lawfully and within appropriate limits. When they are not, the law gives you real routes to challenge what has happened.
If you need a background check conducted properly, B25 operates strictly within UK data protection law. Every check has a documented lawful basis, no restricted data is accessed without authority, and everything is handled in complete confidence. The team’s background across military, intelligence, and policing means the methodology is rigorous from the outset.
B25 conducts all background checks within UK data protection law. Contact us on 0800 593 2525 or use our online form to get the answers you need.