.png)
TL;DR
- There are four DBS levels in the UK (Basic, Standard, Enhanced, Enhanced with Barred List). They show progressively more, but they are all records-based.
- DBS checks do not assess current online behaviour; they can only disclose information that exists in formal records (including, for Enhanced, relevant local police information).
- DBS checks are necessary (often mandatory), but not sufficient on their own.
- Decision rule: run the statutory check because it is required; add a digital risk screening search because it is current.
What a Basic DBS check shows
A Basic check is the entry-level DBS disclosure. It is available for any role and discloses unspent convictions (and may include unspent cautions) held on central police records.
In plain terms, an unspent conviction is a conviction that is still within its rehabilitation period under the Rehabilitation of Offenders Act 1974. While it remains unspent, it can still need to be disclosed in many contexts, and it can appear on a Basic DBS check. Once it becomes “spent”, it will not appear on a Basic DBS check (though it may still be disclosed on Standard/Enhanced DBS checks where eligible and subject to filtering rules).
✅ What it covers:
- Unspent convictions in England and Wales
❌ What it does not cover:
- Spent convictions, cautions, reprimands, or warnings
- Police intelligence or local force information
- Barred list status
- Any online behaviour, digital footprint, or current conduct
A Basic check is a starting point. For many roles, it is the only DBS check available. It tells you whether someone has a current, unspent criminal conviction – and nothing more.
What a Standard DBS check shows
A Standard check goes further. It is available for roles listed in the Rehabilitation of Offenders Act 1974 (Exceptions) Order – typically positions of trust or roles involving access to sensitive information.
✅ What it covers:
- Convictions (spent and unspent) and cautions, reprimands, and warnings held on the Police National Computer (PNC) – subject to filtering rules for protected cautions/convictions
❌ What it does not cover:
- Police intelligence or local force information
- Barred list status
- Online behaviour or digital risk signals
A Standard check gives a fuller picture of an individual's formal criminal history. It is a meaningful step up from Basic, but it still draws from the same source: records that have already been formally created and stored.
What an Enhanced DBS check shows
An Enhanced check is the level most commonly discussed in safeguarding-sensitive sectors. It is required for roles involving close, regular contact with children or vulnerable adults – including teaching, social care, and healthcare positions.
✅ What it covers:
- Convictions (spent and unspent) and cautions, reprimands, and warnings (subject to filtering rules for protected cautions/convictions)
- Any additional information held by local police forces that a chief officer considers relevant and proportionate to disclose
❌ What it does not cover:
- Barred list status (unless specifically requested)
- Online behaviour, digital footprint, or dark web activity
- Risks that have not been reported to or recorded by the police
The inclusion of local police intelligence is what makes an Enhanced check more powerful than a Standard one. It can surface information that has not led to a conviction but is considered relevant – for example, ongoing investigations or local concerns.
Nevertheless, it remains dependent on what has been formally reported, recorded, and held within policing systems. If a concern has not reached the police, an Enhanced check will not reveal it.
What an Enhanced DBS check with Barred List shows
This is the highest level of DBS disclosure. It is required for roles defined as "regulated activity" – direct, unsupervised work with children or vulnerable adults.
✅ What it covers:
- Everything included in an Enhanced check
- Where requested and the role is eligible, whether the individual is on the Children’s Barred List, the Adults’ Barred List, or both
❌ What it does not cover:
- Online behaviour, digital footprint, or activity on the dark web
- Risks that have not been formally detected, investigated, or recorded
- Post-clearance changes in behaviour or associations
Being on a barred list means an individual has been formally assessed as posing a risk and prohibited from working in regulated activity. It is the strongest formal safeguard within the DBS system.
But it is still a record of what has already been determined. If someone has not yet been investigated, or if their concerning behaviour exists outside formal systems – online, in digital communities, or on the dark web – the barred list will not show it.
The structural blind spot all four checks share
Every level of DBS check draws from the same structural foundation: formal records held by police, courts, and regulatory bodies.
This means all four checks share the same limitation. They are:
- Records-based – they can only surface information that has been formally detected, investigated, and recorded
- Backward-looking – they reflect what has already happened, not what is happening now
- Dependent on formal systems – if a concern has not entered the criminal justice or regulatory system, it does not exist in a DBS check
What none of them can see directly:
- Current online behaviour – posts, comments, and affiliations visible on social media and public forums
- Deep web activity – content not indexed by standard search engines but publicly accessible
- Dark web associations – activity on encrypted platforms linked to extremism, exploitation, or fraud
- Post-clearance conduct – changes in behaviour or associations that emerge after the DBS check was completed
A person can pass every level of DBS check and still present a risk that is visible online but invisible to DBS records. (If online activity has led to police information that is recorded and considered relevant, it may surface via an Enhanced disclosure – but that is still record-based, not an assessment of “what someone is doing online”.)
DBS is doing what it was designed to do: disclose relevant records. The limitation is structural. The DBS system was not designed to monitor the internet, and expecting it to do both is where the gap opens.
Necessary but insufficient
DBS checks are a statutory requirement for many roles, and rightly so. They are an essential part of any responsible vetting process. No organisation should skip them, and no responsible screening approach would suggest otherwise.
But statutory compliance and effective safeguarding are not the same thing.
Compliance asks: have we completed the required checks? Safeguarding asks: have we done enough to identify the risks that actually exist?
The DBS check answers the first question. It does not fully answer the second.
Organisations that treat the DBS check as the endpoint of their due diligence are, in effect, accepting a blind spot in their process. That blind spot covers exactly the kind of risks that tend to generate headlines: online extremism, harmful digital behaviour, undisclosed associations, and activity that exists in plain sight – just not within the formal records the DBS system was built to search.
What closes the gap
The gap between what a DBS check can see and what actually exists is structural, and widening as more people’s lives, associations, and conduct move online.
Digital Risk Screening (DRS) addresses this gap by searching for risk signals across the surface web, deep web, and dark web – using AI-scale discovery to identify potential associations, then applying human analyst validation to ensure findings are accurate, contextualised, and relevant.
The output is not a pass-or-fail decision. It is a structured, evidence-led report that gives decision-makers the context they need to act proportionately and defensibly.
Treat it as an additional layer alongside the DBS check – it gives current, digital visibility that DBS records cannot provide.
The decision rule
Use this as a simple decision rule:
- Run the statutory check – because it is required. The DBS check remains an essential, non-negotiable part of workforce vetting for eligible roles.
- Add a Digital Risk Screening (DRS) – because it is current. It fills the gap that no level of DBS check can cover: what someone is doing online, right now, that may be relevant to the role they are being hired for.
- Record what you found, why it is relevant, and how you made the decision – because defensibility matters. If something goes wrong, the question will not be whether you ran a DBS check. It will be whether you did enough.
If your organisation relies on DBS checks as the primary safeguard in your vetting process, it may be worth asking what those checks are not designed to show. Safehire.ai provides digital risk screening that combines AI-scale discovery with human analyst validation – giving you a current, evidence-led, and defensible layer of due diligence that closes the gap DBS checks leave open.
.png)
.png)
