Updated Criminal Conviction Rehabilitation Periods in force

3 mins

Posted on 06 Nov 2023

Updated Criminal Conviction Rehabilitation Periods in force

The Rehabilitation of Offenders Act 1974 was amended from 28 October 2023 to reduce the length of time for which some criminal records need to be declared (the “rehabilitation period”).

Criminal Record Checks – An Overview

Certain roles require background checks to be completed with the Disclosure and Barring Service (“DBS”).

There are three levels of DBS checks:

  • Basic (which reveals details of unspent criminal convictions, conditional and unconditional cautions)
  • Standard (which also reveals spent convictions, spent and unspent cautions and police reprimands and warnings)
  • Enhanced (which also includes relevant police information and, where appropriate to the post being applied for, information stored about the person on statutory lists (containing details of people who are considered unsuitable to work with children or vulnerable adults)).

While employers may ask for voluntary disclosure of criminal records, there is a limit to what they can do to verify the responses given. Employers cannot force individuals to obtain their criminal record history through a subject access request (this is a criminal offence under the Data Protection Act 2018. Instead, the employer may ask them to obtain a Basic Certificate (which, of course, the individual may refuse to do). In many cases, new employees are asked to sign a form permitting a third-party checking organisation to undertake a basic check on their behalf and disclose the results to the employer.

While certain industries (such as legal, financial services and those who work with children, provide care services or work with vulnerable adults) require individuals to obtain standard or enhanced DBS checks, many industries are not permitted to obtain these.

Updated Rehabilitation Periods from 28 October 2023

The rehabilitation periods have been amended as follows:

New rehabilitation periods

  • Community order – the last day on which the order had effect
  • Custody of one year or less – one year
  • Custody of more than one year and up to four years – four years
  • Custody of more than four years – seven years.

Old rehabilitation periods

• Community order – one year beginning with the last day on which the order had effect

• Custody of six months or less – two years

• Custody of more than six months and up to 30 months – four years

• Custody of more than 30 months and up to four years – seven years

• Custody of more than four years - the conviction was never spent and therefore always had to be declared.

However, convictions for serious sexual, violent, or terrorist offences continue (as before) never to be spent. The stricter disclosure rules through standard and enhanced DBS checks will continue to apply to jobs that involve working with vulnerable people (as outlined above). In addition, if an individual reoffends during the rehabilitation period, they will have to disclose both their original and subsequent offences to employers for the duration of whichever rehabilitation period is longer.


Employers need a lawful ground to process criminal records information and must also comply with the data protection principles, including that processing should be adequate, relevant and not excessive. Employers must also have an "appropriate policy document" covering the need for and use of such data. Unlock (a charity supporting people with criminal convictions) has guidance on obtaining criminal records checks and advises using a “legitimate interest assessment” (to assess the employer’s and individual’s competing interests) to meet data privacy obligations.

Please contact our Data Privacy team for further information.

Piers Leigh-Pollitt

Piers advises a mixture of corporates and individuals on a wide range of HR/employment law matters and data protection issues (mainly from an HR perspective). Piers is also the firm’s internal compliance officer and handles all regulatory and internal compliance matters. He also heads up the firm's Data Privacy team and holds the Practitioner Certificate in Data Protection (GDPR).

  • Partner & Compliance Officer for Legal Practice
  • T: +44 (0)118 951 6761
  • Email me

View profile

Mike Hibberd

Mike is an employment and data privacy law expert advising both organisations and senior individuals on a wide range of human resources and related issues.

  • Legal Director
  • T: +44 (0)118 951 6765
  • Email me

View profile

The articles published on this website, current at the date of publication, are for reference purposes only. They do not constitute legal advice and should not be relied upon as such. Specific legal advice about your own circumstances should always be sought separately before taking any action.

Back to top