Your organisation carries out online checks. Could you defend how?

Why search results, AI and safeguarding-led recruitment need a more controlled approach

When Keeping Children Safe in Education first expected schools to consider online searches on shortlisted candidates in September 2022, it was a welcome step forward. It recognised a real gap in the recruitment system: formal checks, references and interviews do not always show publicly available information that may be relevant to someone’s suitability for a safeguarding-sensitive role.

From 1 September 2026, KCSIE describes this more specifically as carrying out a search “via an online search engine”. It also says that shortlisted candidates should be told that online searches may form part of the school’s due diligence.

That is helpful for schools. But the wider issue is not limited to schools, and not every safeguarded organisation has the same level of guidance. Charities, care providers, sports organisations, faith groups, youth services and other organisations recruiting people into positions of trust may face similar questions without the same clear sector-specific wording.

The instruction takes up only a few lines, and even where guidance exists, it leaves much of the operating detail to individual organisations.

Type a candidate’s name into Google and you may find a namesake, an unverified allegation, political opinions, religious beliefs, health information or a social-media profile with no reliable link to the person being recruited. You may also find nothing and assume there is nothing to find.

This creates practical issues around training, identity matching, relevance and record keeping. Organisations also need to decide what should be ignored, what should be passed to the decision-makers and what should be raised with the candidate.

Having worked as a bursar, I know what often happens when guidance leaves the operating detail to local teams. Local practice fills the gap.

In a smaller school, charity or care provider, the task may fall to the bursar, HR manager, operations lead or someone else already carrying several responsibilities. Elsewhere, different hiring managers may be expected to complete their own checks. One person looks at the first page of Google and LinkedIn. Another searches Facebook and local news. Some staff are reluctant to search at all because they are worried about crossing a legal or ethical line.

All of them may record the same words on the recruitment file: “online check completed”.

The paperwork appears consistent. The checks behind it may have been quite different.

What the checklist does not show

Publicly available information may reveal an incident or issue that a school should explore with a candidate before deciding whether to appoint them. The difficulty lies in turning that sensible intention into a fair and repeatable process.

KCSIE explains why schools should consider a search, but it does not provide a complete method. It does not prescribe how far the search should go, how a possible match should be linked to the correct person or what should count as relevant. Much of the judgement is left to the school.

A narrowly conducted search may miss something important. A poorly controlled one may expose the reviewer to inaccurate, irrelevant or highly sensitive information and allow it to influence the appointment decision.

Consider a candidate with a common name. A reviewer finds a concerning article about somebody else and assumes it relates to the applicant. In another case, the search reveals information about health, religion, sexual orientation or political opinions. It has no bearing on suitability for the role, but it is now known to someone involved in the recruitment process.

These types of information may amount to special category data under UK GDPR. They require additional protection and a proper basis for processing. Some may also reveal protected characteristics that should have no bearing on the appointment decision.

A search may also produce nothing concerning on the first page. The file is marked complete, even though the method tested little beyond what the search engine chose to rank most highly that day.

A search engine can surface information, but the school still has to establish who the information relates to and whether it has any proper bearing on the appointment.

If the recruitment decision were challenged six months later, the school would need to reconstruct what had been searched, what had been found, what had been discounted and why its final decision was reasonable. A tick on a checklist will not provide that explanation.

AI and the limits of presentation

Recruitment has always relied on visible signs of credibility. These include a coherent employment history, a well-written application, a plausible reference and an identity that appears to match the person being interviewed.

AI has made good presentation much easier to produce.

Candidates can use it legitimately to improve CVs and applications or to prepare for interviews. There is nothing improper in using technology for editing or preparation. The practical consequence for recruiters is that polish and internal consistency are now weaker evidence of authenticity. CIPD discussions on AI in recruitment already assume that candidates are using these tools to improve applications and prepare for interviews.

A candidate can turn limited information into a convincing supporting statement. Inconsistencies can be smoothed out, and several documents can be made to sound as though they came from the same coherent account.

Schools should not approach every candidate with suspicion. They should recognise that presentation cannot carry the same evidential weight it once did.

DBS checks, references, qualification checks, identity checks and interviews remain essential. Each answers a different question and has its own limitations. Online due diligence sits alongside them, helping the school identify publicly available information that may need to be explored before an appointment is made.

The practical response is better control over the evidence. The school needs a consistent search scope, a reliable way to establish identity and someone capable of assessing relevance and context. It also needs a clear record of how any information was handled.

Technology can support that work by applying a repeatable method and bringing possible concerns to a reviewer’s attention. A trained person must still check the match, understand the context, consider any explanation and decide what happens next. Responsibility for the appointment remains with the school.

How the process can be tightened

Consider a composite example based on a pattern seen across school recruitment.

A school believes that online checks are being completed consistently. In practice, hiring managers choose their own search terms and sources. Some take screenshots. Others write a single sentence. A matching name is treated as proof of identity, and there is no agreed threshold for escalating a concern.

When the school looks at the process properly, it finds that different reviewers can search the same candidate, see different information and reach different conclusions.

The first step is to define the purpose of the check. The school agrees that it is looking for publicly available incidents or issues that may be relevant to the candidate’s suitability to work with children. Candidates are told what may be checked and why.

The search scope is set in advance. Reviewers use information beyond a name before associating material with a candidate. This might include employment history, location or another identifier already held for the recruitment process. A common name requires a higher level of confidence.

The person conducting the search is trained and, where practical, is separate from those making the final appointment decision. Possible concerns are checked before being passed on. Irrelevant material is filtered out, and sensitive information is only considered where there is a proper reason to do so.

Candidates are given an opportunity to explain or challenge relevant information. The final decision and its reasoning are recorded. Underlying material is kept only for as long as it is genuinely required.

This reflects the approach in the ICO’s current draft recruitment guidance. The ICO gives an example of one member of staff screening online information for relevance and passing only relevant material to the recruitment panel. It also says that a candidate should be able to comment on the accuracy of information before it is used in a decision. The guidance is under review following changes to data protection law, so these points should be treated as sensible control principles rather than new statutory requirements.

Only after setting out the process should the school decide where technology can help.

For many schools, maintaining this standard internally will be difficult. Recruitment comes in bursts, capacity is tight and the person trained to conduct the search may also be sitting on the appointment panel. In a school group, central policy can quickly turn into several different local practices.

At that point, the case for specialist support rests on governance and assurance, as well as staff capacity.

A bursar considering an external provider should ask which sources are searched and which are excluded. The supplier should be able to explain how it establishes a reliable identity match, how possible false positives are checked and what information reaches the school.

Procurement should also cover where data is processed, who can access it, how long it is retained and how a candidate can challenge a finding. The school needs to understand whether any automated system is making a decision or organising information for review by a trained person.

Government guidance on responsible AI in recruitment places similar weight on supplier assurance, transparency, fairness, accountability and the ability to contest an outcome.

The outcome should be a method that the school can explain to a candidate, governor, inspector or regulator.

Five questions bursars should take back to their teams

For a bursar, online due diligence reaches beyond HR. It touches safeguarding, data protection, procurement, governance and reputation.

1. What are we trying to identify?

The school should agree the purpose before anyone enters a candidate’s name into a search engine.

KCSIE points towards publicly available incidents or issues that the school may want to explore at interview. This is narrower than a general search into someone’s character, beliefs or private life.

2. How do we know we have the right person?

A matching name is weak evidence, particularly where the name is common.

The school should define which additional identifiers may be used and the level of confidence required before information can be linked to a candidate. Conflicting details should stop the process from moving forward until the match has been checked.

A possible match should not become a safeguarding concern without further validation.

3. Who decides what is relevant?

The person conducting the search needs training, clear boundaries and somewhere to escalate uncertain findings.

A junior administrator should not be left to make an unsupported safeguarding judgement. Depending on the nature of the information, the school may need input from HR, the designated safeguarding lead or the person leading safer recruitment.

Where practical, irrelevant information should be filtered out before the appointment panel sees it. This reduces the risk of a decision being influenced by material that has nothing to do with suitability for the role.

4. Can the candidate respond?

Online information may be inaccurate, historic, manipulated or connected to somebody else. Even where the information is genuine, its context may have changed.

A fair process should allow the candidate to explain or challenge relevant material before the school reaches a decision. Historic information should not be ignored automatically, but neither should it be treated as current without proper consideration.

A system flag is only the start of the review. The school must consider the evidence and make its own judgement.

5. Could we evidence the process later?

The recruitment record should show who carried out the check, when it was completed and what method was followed. It should also record any material that was escalated and the reason for the final action.

A nil result still needs enough information to show that an agreed process was followed. Schools should avoid retaining large collections of screenshots or irrelevant personal information simply to prove that a search took place.

The school should also know who can access the records, when they will be deleted and when the process itself was last reviewed.

See how the check is carried out

Before the next recruitment round, ask the responsible person to walk through an online check using a suitable test case or recent completed example.

Start with what happens in practice rather than the wording of the policy. Look at the search terms used, how identity is established and what is recorded. Ask the reviewer to explain how they would handle a serious concern, irrelevant sensitive information or a result that may belong to somebody else.

The completed recruitment file may say “online check completed” in every case. That wording tells a governor very little about the quality of the work behind it.

Where the process depends on personal instinct, with no training, agreed boundaries or evidence trail, the file overstates the control the school has.

A completed checklist has little value if nobody can explain the process behind it.

‍