Retention Policy

Policy; Secure Storage, Handling , Use, Retention & Disposal of Disclosures and Disclosure
information

Summary

This document has been produced because It is a requirement within the DBS Code of Practice
that all Registered Bodies must have a written policy on the correct handling and safekeeping of
Disclosure information. It also obliges Registered Bodies to ensure that a body or individual, on
whose behalf they are countersigning Disclosure applications, has a written policy.

Policy Statement

General principles

As an organisation using the DBS Disclosure service to help assess the suitability of applicants
for positions of trust, Swift Check Ltd complies fully with the DBS Code of Practice regarding the
correct handling, use, storage, retention and disposal of Disclosures and Disclosure information.
It also complies fully with its obligations under the General Data Protection Regulation (GDPR)
and the Data Protection Act (DPA) 2018 and other relevant legislation pertaining to the safe
handling, use, storage, retention and disposal of Disclosure information.

Storage and access

Hard copies of Disclosure information are kept securely, in lockable, non-portable, storage
containers with access strictly controlled and limited to those who are entitled to see it as part of
their duties.
Swift Check Ltd utilises a system developed by Kent County Council for processing e-DBS
applications and all information is therefore stored on their servers. These servers containing
sensitive information are stored in accordance within ISO27001 standards, They are in secure,
locked areas to prevent unauthorised access.

Handling

In accordance with section 124 of the Police Act 1997, Disclosure information is only passed to
those who are authorised to receive it in the course of their duties. We maintain a record of all
those to whom Disclosures or Disclosure information has been revealed and it is a criminal
offence to pass this information to anyone who is not entitled to receive it.
E-bulk Disclosure Information Handling
Access to the e-Bulk system is limited to those who require it as part of their role, and appropriate
controls are in place.

Usage

Disclosure information is only used for the specific purpose for which it was requested and for
which the applicant’s full consent has been given.

Retention

Once a recruitment (or other relevant) decision has been made, we do not keep Disclosure
information for any longer than is necessary. This is generally for a period of up to six months, to
allow for the consideration and resolution of any disputes or complaints. If, in very exceptional
circumstances, it is considered necessary to keep Disclosure information for longer than six
months, we will consult the DBS about this and will give full consideration to the data protection
and human rights of the individual before doing so. Throughout this time, the usual conditions
regarding the safe storage and strictly controlled access will prevail.

Disposal

Once the retention period has elapsed, we will ensure that any Disclosure information is
immediately destroyed by secure means, i.e. by shredding, pulping or burning. While awaiting
destruction, Disclosure information will not be kept in any insecure receptacle (e.g. waste bin or
confidential waste sack). We will not keep any photocopy or other image of the Disclosure or any
copy or representation of the contents of a Disclosure. However, notwithstanding the above, we
may keep a record of the date of issue of a Disclosure, the name of the subject, the type of
Disclosure requested, the position for which the Disclosure was requested, the unique reference
number of the Disclosure and the details of the recruitment decision taken.

E-bulk Disclosures Disposal

Once a recruitment decision has been made or a check cancelled, the application can be
archived.
Once done, the system will automatically purge any confidential information after 6 months in line
with DBS requirements.

Policies:

We confirm that our policies, including our privacy notice, have been updated in compliance with
the GDPR, and that these will be kept under regular review.