Personnel Screening Policy (Baseline Personnel Security Standard)

1. Purpose

Some of our clients, including government and public-sector bodies, require the people who handle their data to be screened first. The UK Government sets the standard for this screening. It is called the Baseline Personnel Security Standard (BPSS).

This policy explains the screening we carry out and how we protect the information we collect.

BPSS is a set of pre-access checks. It is not a security clearance, and we do not describe it as one.

2. Scope

This policy applies to Unolabs Limited. It covers anyone who needs access to client or government data, including:

• employees and people we are about to employ;
• contractors, associates and their staff;
• people employed by our group company outside the UK.

From 1 December 2026, we will screen people to BPSS before they are given access to client or government data. We will screen anyone who already has access, and has not yet been screened, by 31 January 2027.

This policy does not cover higher levels of national security vetting, such as Security Check (SC) or Developed Vetting (DV). If a client asks for those, the client's own vetting process applies.

3. Framework

• HMG Baseline Personnel Security Standard, Version 7.0 (June 2024)
• Immigration, Asylum and Nationality Act 2006, and the Home Office guidance on right to work checks
• Rehabilitation of Offenders Act 1974
• UK GDPR and the Data Protection Act 2018, including the rules on criminal offence data
• Equality Act 2010

4. Roles and responsibilities

• Chief Executive Officer: owns this policy, makes every screening decision and signs each verification record.
• HR administration: runs the checks, collects the evidence and keeps the records.
• Another director: carries out the checks on the Chief Executive Officer, so nobody checks themselves.
• You: give accurate information and tell us if anything changes.

5. The checks we carry out

From 1 December 2026, before anyone is given access, we will complete the four BPSS checks.

1. Identity. We check original identity documents, such as a passport. We confirm that the photo, name, date of birth and address match you.
2. Right to work and nationality. We carry out a right to work check in line with Home Office guidance. We confirm your nationality and immigration status.
3. Employment history. We confirm the last 3 years of your employment, study or self-employment. We ask you to explain any gaps, and we ask for evidence for longer gaps.
4. Unspent criminal record. We ask you to tell us about any unspent convictions. We then need a Basic Disclosure and Barring Service (DBS) check, which the candidate applies for through GOV.UK and shares with us. Unolabs Limited pays the fee. If you live in Scotland or Northern Ireland, you apply for the matching basic check there instead.

A Basic DBS check shows unspent convictions and conditional cautions only. We never ask about spent convictions, and we never take them into account.

An unspent conviction does not mean an automatic refusal. We look at how relevant it is to the work, how long ago it happened and what you tell us about it. You can respond before we make a final decision.

6. The verification record

We record the outcome of each check on a BPSS verification record. It shows which checks were done, when, by whom, and what evidence we saw. The Chief Executive Officer signs it before access is given.

The record notes only whether the criminal record check was clear or needed a decision. It does not list any conviction.

If a client asks, we confirm whether a named person has been screened. We share more only where the contract requires it and the law allows it.

7. When we screen again

BPSS is a check at one point in time. We screen again when:

• you return to us after a break of more than 12 months;
• your right to work is time-limited and needs a follow-up check;
• your name, nationality or immigration status changes;
• you tell us about a new conviction, or we receive credible information that raises a concern;
• a client requires a newer check or a higher level of vetting.

8. Contractors and associates

Contractors and associates must meet the same standard before they get access. We either run the checks ourselves, with their consent, or accept evidence from their employer or agency.

We accept evidence only if it covers all four checks to BPSS Version 7.0, and we can see the verification record. We will require suppliers who provide people for screened work to apply the same checks, from 1 December 2026.

9. Staff based outside the UK

Some of our staff are based outside the UK. We check their identity, nationality and employment history in the same way.

Some checks are harder to complete outside the UK. A UK right to work check does not apply to work done abroad. A Basic DBS check covers UK records only. It does not cover time spent living abroad. If you have lived abroad, we ask for an official criminal record certificate from the country concerned, such as a police clearance certificate. You obtain this certificate and pay any fee for it.

Overseas checks can take longer. If we cannot complete a check to the standard, we do not give access. Some client contracts allow access only from the UK. Where that applies, we follow the contract.

10. How we protect your information

Screening involves personal data, and the criminal record check involves criminal offence data. To protect it, we:

• tell you what we collect and why before we start;
• collect only what the check needs;
• keep screening records in a restricted store that only the Chief Executive Officer and HR administration can open;
• never use screening information for any other purpose;
• keep an appropriate policy document that explains how we handle criminal offence data and keep it safe, as the Data Protection Act 2018 requires.

How long we keep records. We keep screening records only as long as we need them for their purpose, or as long as the law or a contract requires:

• Verification record and right to work evidence: while you work with us, then 2 years. If a client contract requires us to keep them longer, we tell you.
• Basic DBS certificate: we record its number, date and outcome. We then return or delete any copy you shared with us.
• Information about candidates who do not join: up to 6 months after our decision.

We handle any loss of screening data as a personal data breach, under our Data Protection Policy.

11. Your rights and concerns

You can ask to see the information we hold about you, or ask us to correct it. Email info@unolabs.com with the subject line "Data protection request". We reply within one month, as our Data Protection Policy explains.

If you are unhappy with how we handled your information, please complain to us first. You can also complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint (opens ico.org.uk).

To raise a concern about a screening decision or about someone's access to data, email info@unolabs.com with the subject line "Screening concern". It goes to the Chief Executive Officer. We treat concerns in confidence.

12. Review

We review this policy every 12 months. We also review it if BPSS, the law or a client requirement changes.

13. Contact