Skip to main content

Alternative Data Processing Agreement (DPA) Options

Learn how uCheck’s alternative DPA option lets you replace leave date–based retention with configurable result‑based deletion (3–60 months) for most checks, which checks are excluded, and how your Primary Contact can request this setup by email.

Written by Ben Nicholas

Overview

By default, uCheck uses a standard Data Processing Agreement (DPA) that relies on leave dates to control how long applicant data is stored.

If you prefer, you can use an alternative DPA configuration that removes the need to enter leave dates and instead uses a result‑based retention period.

This article explains:

  • How the standard DPA works

  • Which checks can use the alternative DPA

  • How result‑based retention works

  • How to request this change

1. Standard DPA – Leave Date–Based Retention

Under the standard DPA:

  • When an applicant leaves your employment, you enter their leave date in the application (Employment History section).

  • uCheck then removes the application completely from the platform 2 years after that leave date.

This is the default behaviour unless you request an alternative setup.

2. Alternative DPA – Result‑Based Retention

In line with UK GDPR requirements, uCheck can offer an alternative to entering leave dates.

For the following check types:

  • Disclosure Scotland Basic checks

  • DBS checks (Basic/Standard/Enhanced)

  • Identity checks

  • Adverse Credit checks

you can choose to:

  • Skip entering leave dates, and

  • Have uCheck delete applicant personal data based on a time period from the result issue date.

2.1 Right to Work checks are excluded

Right to Work checks cannot use this alternative DPA.

Reason:

  • The Home Office requires that the Leave Date is entered manually in the Employment History section for Right to Work checks.

  • You must continue to record leave dates for Right to Work to meet these requirements.

3. How result‑based retention works

Once you have received the applicant’s result:

  • uCheck can configure the system to delete their personal data after a period you choose, measured from the result issue date.

You can select a retention period between:

  • 3 months and 60 months (5 years) from the result issue date.

Key considerations:

  • Existing guidelines state that, from 3 months after the result issue date, any criminal record results are treated as expired.

  • However, you may choose to keep applications longer than 3 months to meet the needs of:

    • Regulators

    • Internal audit

    • Other legal or compliance requirements

You should select a retention period that balances:

  • Data minimisation under UK GDPR

  • Your regulatory and business needs

4. How to request the alternative DPA setup

If you want to:

  • Use a result‑based retention period, and

  • Remove the need to manually enter leave dates (for eligible check types),

then the Primary Contact for your uCheck account must:

  1. Send an email to [email protected].

  2. Clearly request an alternative DPA setup with result‑based retention.

  3. Specify the retention period you wish to apply (3–60 months from result issue date).

uCheck will then:

  • Review your request

  • Configure your account to use the chosen result‑based data deletion rules for the supported check types.

Did this answer your question?