Reference Checks

DDC are an ISO27001 and ISO9001 certified company, so we take information security seriously, and we have been assessed and approved against a major information security standard. Our certificates are shown below. We only use SSL-encrypted communication protocols to send secure data, and we don’t receive or record your bank details. All of our staff are background-checked, following the UK Cabinet Office’s ‘Baseline Personnel Security Standard’, to verify our employees identity and to ensure they are suitable to work with confidential data.

GoCardless take a number of steps to ensure users data remains safe at all times:

• Access to Direct Debit is provided by RBS, who have approved their systems.
• All servers are hosted in a secure datacentre in the UK – data is never transmitted outside the country.
• GoCardless financial data server is separated from their application server by multiple firewalls.
• All GoCardless client-server communication is 256-bit SSL encrypted.

As with all new Direct Debit transactions, payment takes a little while to set up, so payment will not leave your account for 4 days. For this service we will only ever take a single payment from your account, so you don’t need to worry about unauthorised regular payments leaving your account. Once payment has left your account, it will take a further 3 days to reach our account. In total, it takes around 7 working days for the money to reach our account. You will be able to proceed with your application before payment reaches us, but your application will not be submitted to the DBS until payment in confirmed.

Due Diligence Check Online Portal Browser Support

The following are Internet Browsers that are recommended by DDC and have been official tested for use with our online portal. If you have any questions please contact your account representative.

Internet Browsers that are recommended by DDC

• Chrome version 64 or greater
• Internet Explorer 11 / IE Edge
• Firefox version 52 or greater

If your browser does not appear in the list above and you are concerned that our service will not be compatible please contact use for advise.

for a link of useful links and resources please follow this link.

Yes, you can give reference information, but it’s important to ensure that any sharing of personal data in a reference complies with data protection and fairness principles. When giving a reference, you should take the following into account:

1.) Establish a lawful basis for sharing

Before providing a reference, identify a lawful basis for processing the individual’s personal data — typically this will be under legitimate interests. You must be able to demonstrate that sharing the information is necessary and proportionate for the purpose of assessing the individual’s suitability for a role.

2.) Necessity and adequacy

Only share information that is relevant, adequate, and limited to what is necessary for the purpose of the reference. Avoid including excessive or unrelated personal details.

3.) Special category considerations

Do not include special category data (such as information about health, race, religion, or trade union membership) unless there is a clear lawful basis and the individual has explicitly consented. These categories require additional protection.

4.) Consent and imbalance of power

Avoid relying on consent as your legal basis where there is an imbalance of power, such as between an employer and employee. In such cases, consent may not be freely given and therefore may not be valid.

5.) Sector specific requirements

Check whether your sector has any particular rules or codes of practice governing references (for example, in financial services, education, or healthcare). You must comply with any such obligations in addition to general data protection law.

6.) Making references more useful

Keep your reference factual, accurate, and job-related. Provide clear, evidence-based information about the individual’s performance or conduct, and avoid vague or subjective comments that could mislead the recipient.

7.) Avoiding discrimination

Only comment on matters relevant to the individual’s ability to perform the job. Do not include any information that could be seen as discriminatory on the grounds of age, sex, race, disability, religion, or any other protected characteristic.

8.) Disclosure to the individual

References are generally exempt from subject access requests under data protection law. If you do not wish your reference to be shared with the individual, make this clear in the document — for example:

“This reference is provided in confidence and should not be disclosed to the individual to whom it relates.”