Care providers often ask whether they should keep the original DBS certificate on file or dispose of it and keep only a record of the check. Two sets of rules apply at the same time, and you need to satisfy both.
What the DBS Code of Practice requires
The DBS Code of Practice says you should not keep the physical DBS certificate (or a copy) for longer than is necessary, normally no more than six months after the recruitment decision. After that, you should securely destroy the certificate and retain only a record that the check was carried out. That record should note the certificate number, the date of issue, the type of check, who carried it out, and the recruitment decision taken.
What the Home Office expects from sponsors
As a sponsor, you must be able to show at a compliance visit that you carried out the recruitment and pre-employment checks that the role required, including any DBS check needed for a regulated activity. The Home Office does not require you to keep the physical certificate. Keeping a clear record of the check, in line with the DBS Code of Practice, satisfies both your safeguarding obligations and your sponsor record-keeping duty.
In practice
Destroy the original certificate within six months, and keep a dated record of the check on the worker's file. There is a limited exception where you can justify retaining the certificate itself for safer-recruitment or safeguarding-audit purposes, but only if your data-protection policy covers it. If in doubt, keep the record and dispose of the certificate.