How long should charities keep DBS and volunteer records?

Separate the records before setting a period

An event team may have a volunteer’s application, contact details, references, identity evidence, declaration, DBS certificate information, recruitment decision and safeguarding records. You need these records for different reasons, so they should not all have the same deletion date.

List each type of record, why you need it, who may see it and when you will delete it. Say when the keeping period starts, such as the date recruitment ends. Ask the person responsible for the policy to approve the plan.

DBS certificate information

DBS says to store information securely, limit who can see it and keep it only as long as necessary. ^[1] Disputes, complaints, safeguarding reviews or inspection rules may mean you need to keep information longer. It does not set a universal six-month rule in the current text reviewed for this guide.

When you no longer have a valid reason to keep the details, securely delete or destroy them and any copies. A scan kept in a general folder is still a copy; moving it out of a paper file does not solve the retention question.

The limited check and decision record

DBS identifies details that may be retained separately, including the certificate issue date, subject’s name, check type, position, reference number and recruitment decision. ^[1]

Keep that record useful and limited. An organiser checking the rota needs to know whether someone has been approved for particular duties, not the full disclosure history. Detailed reasons that must be retained should have appropriately restricted access.

Record a policy review date separately from a certificate issue date. A policy review date tells you when to review your decision. It is not an official expiry date for the certificate.

Plan when to review and delete each type of record

This table is a planning aid, not a legal retention schedule. Consider relevant complaints, claims, inspection requirements and any legal reason to preserve evidence before deleting records.

Make the policy work after the event

Assign someone to review records after recruitment and again at the planned deletion dates. Include exported spreadsheets, email attachments and copies held by former organisers. Tell volunteers about retention through the privacy information.

The Information Commissioner’s Office (ICO) says to destroy detailed vetting information promptly when you no longer need it. You may still keep an appropriate record of the result. Its guidance is under review following changes in law, so use the current version when approving your policy. ^[2]

Also stop Update Service status checks when consent or legal entitlement ends, including when the person leaves. Keeping an old record does not authorise continuing checks. ^[3]