Guidance

DBS digital identity factsheet

Updated 9 December 2022

Introduction

The Disclosure and Barring Service (DBS) digital identity guidelines enable people of all nationalities to prove their identity digitally, typically using government-issued documents.

Certified identity service providers

Digital identity must be undertaken by certified identity service providers (IDSPs).

Any organisation that is able to meet the requirements set out in the latest version of the UK digital identity and attributes framework, and the DBS digital identity verification guidance, can become a certified IDSP.

Audit and certification is undertaken by certification bodies recognised by the United Kingdom Accreditation Service, also known as UKAS.

A list of certified IDSPs and information around how to become certified can be found in the Department for Digital, Culture, Media & Sport’s digital identity certification guidance.

Verifying identity and IDSPs working with Registered Bodies and Responsible Organisations

Certified IDSPs will work directly with Registered Bodies (RBs) for Standard, Enhanced, and Enhanced with Barred List(s) DBS checks, and with Responsible Organisations (ROs) for Basic DBS checks. RBs and ROs are responsible for ensuring that the identity check process is managed in accordance with DBS guidelines, as specified in the DBS code of practice, and DBS Basic processing standards.

RBs and ROs may choose which method is used to assure the identity of an application based on the following DBS identity guidelines:

• DBS digital identity verification guidance
• ID checking guidelines for Standard, Enhanced, and Enhanced with Barred List(s) DBS check applications
• Basic DBS check ID checking guidelines

The temporary changes to ID checking guidelines as a result of COVID-19 remain in place and continue to be a valid means to verify the applicant’s identity. These changes are detailed in our ‘COVID-19: Changes to DBS ID checking guidelines’ news story.

Government guidelines for identity verification

DBS guidelines align to government guidelines for identity proofing, which can be found in the ‘How to prove and verify someone’s identity’ guidance.

The government guidelines for identity proofing outline four levels of confidence when verifying an identity. Following a risk assessment, DBS has specified:

• ‘High confidence’ for Standard, Enhanced, and Enhanced with Barred List(s) DBS checks
• ‘Medium confidence’ for Basic DBS checks

These guidelines score individual documents based on how difficult it is to forge or create a counterfeit document. Strength scores are awarded based on the security features in the document, the information it has, and how the person’s identity was checked when the evidence was issued.

A passport with a biometric chip for example, will score higher than a UK driving licence, and a UK driving licence would achieve a higher score than a birth certificate or adoption certification. All are valid forms of identity.

The strength and validity scores of the documents used will determine whether activity history and identity fraud checks are also needed to confirm the person’s identity to the required confidence level.

Verifying an applicant’s name and current address

RBs and ROs must ensure that applications are presented to DBS in the person’s official name, and that their current permanent address is verified.

A person’s current address may be verified digitally through an ‘authoritative source’. An authoritative source, used as part of an identity check, is responsible for ensuring the integrity of the information held is both protected and up-to-date. The authoritative source must also do one of the following:

• Issue evidence – for example, the Driver and Vehicle Licensing Agency (DVLA) issues evidence such as driving licences
• Obtain information from an organisation that issues evidence – for example, credit reference agencies can have authoritative information about bank accounts
• Obtain information from another authoritative source – for example, from another identity scheme

A person’s current address may also be verified in-person, using documentary evidence from the list of documents set out in the following DBS ID guidelines, dependent on the level of DBS check being applied for:

• ID checking guidelines for Standard, Enhanced, and Enhanced with Barred List(s) DBS check applications
• Basic DBS check ID checking guidelines

Please note, the permanent address is the applicant’s correspondence address and this is where DBS will send the applicant’s DBS certificate.

Reusable verified identities

Certified IDSPs may provide a ‘reusable verified identity’ which must be protected using ‘medium quality authenticators’ as outlined in the ‘Using authenticators to protect an online service’ guidance.

When a reusable identity is accepted, the RB or RO must ensure that the applicant’s current address is verified in the 90 days prior to the application being sent to DBS.