National Police Checks: Who Needs One, How Long They Last, and Storing Them Safely

A National Police Check tells you what police records said about a person on the day it was issued. Asking for one is easy. Knowing how old each check is, who has seen it, and when a new one is due is the hard part, and so is storing a document that counts as sensitive information.

This post covers what a police check is, how long it lasts, what to keep, and how to track it in WorkZerk.

What a National Police Check is

Its official name is a Nationally Coordinated Criminal History Check, run through the Australian Criminal Intelligence Commission (ACIC) and the state and territory police. A person applies through an Australian police agency or an ACIC accredited body. The result is either No Disclosable Court Outcomes (NDCO) or Disclosable Court Outcomes (DCO), such as charges, convictions or matters awaiting a court hearing (ACIC: how the Service works).

Most checks are name based. Some purposes, such as security guard licensing, also need a fingerprint check, which takes at least 15 working days through the Australian Federal Police.

Who needs one

Some roles need one by law, and the rules come from the sector. Aged care workers, for example, need either a police certificate not older than 3 years, with no record of certain offences, or an NDIS worker screening check. Elsewhere it is employer policy, such as for roles handling cash or entering people's homes. Ask only where the role genuinely needs it.

Working with Children Checks and NDIS worker screening are separate schemes. See tracking a Working with Children Check and the NDIS worker screening check.

How long a police check lasts

It has no expiry date. The ACIC says there is no standard timeframe that a check result is valid for. It is a point-in-time check: someone can get a clear result one day and be charged the next.

The organisation that needs the check decides how recent it must be, based on its own risk assessment. So set a re-check period. Some sectors set one: Victoria's child protection manual requires a new check at least every three years for residential care staff in client contact roles.

Check the purpose, too. The ACIC says a check cannot be reused for a different purpose, because the purpose can change what is released.

Consent and privacy

A check can only be done with the person's informed consent, given for that specific purpose.

Criminal record information is sensitive information under the Privacy Act 1988. Under APP 3, an organisation covered by the Act may collect it only with consent, and only where it is reasonably necessary for its activities. APP 11 asks you to protect what you hold and, in certain circumstances, destroy it.

The Act covers organisations with an annual turnover of more than $3 million, and some others. Private sector employee records are exempt where directly related to the employment, but job applicants and contractors are not employees. More in the Australian Privacy Principles.

Spent convictions and discrimination

Under the Commonwealth Spent Convictions Scheme, a conviction for a less serious offence becomes spent after a waiting period, generally 10 years (5 for a juvenile offender). The person usually does not have to disclose it, and you cannot take it into account unless an exclusion applies. States and territories have their own schemes.

A disclosable result is not an automatic no. The Australian Human Rights Commission's guidelines on criminal record discrimination ask employers to weigh each record against the inherent requirements of the job, case by case.

What to keep on file

For each person, keep:

• the date the check was issued
• the result (NDCO or DCO)
• the reference number on the certificate or report
• who sighted it and when
• the date a new one is due under your policy

Keeping the certificate itself is a separate choice. If a record that you checked it is enough, keeping less is safer.

Rules differ between sectors and states and change over time, so this is general information, not legal advice. Check with your sector regulator and the ACIC.

What WorkZerk does with a police check

WorkZerk keeps the record side of the job in one place:

• Each person uploads their certificate from a private link, with no account or password.
• Marked sensitive, the file is stored encrypted, only admins can open it, and every view is recorded.
• You approve each check, and WorkZerk records who approved it and when.
• WorkZerk emails the person before a new check is due.
• The Document compliance report shows who is current, due or missing a check.
• WorkZerk can delete approved files after a set time and keep only the record.

What it does not do: WorkZerk does not apply for or run the check, contact the police or an accredited body, or verify a certificate. Those steps stay with you.

Setting it up in WorkZerk

1. Turn on two-factor authentication

Asking people to upload documents needs two-factor authentication on your account. Set it up first under Account, then Two-factor authentication (opens in WorkZerk in a new tab).

2. Create a National Police Check field

Open Fields (opens in WorkZerk in a new tab) in the sidebar. Add a field called National Police Check, choose the Upload type, tick Require an expiry date, and tick Don't use AI to check expiry date.

A police certificate prints no expiry date, so here the "expiry date" is the date a new check is due under your policy. That date is what drives the reminders and the compliance report. The AI check is off because there is no printed date to read.

Then open the field and click Mark as sensitive. See keeping sensitive information private for exactly what that changes.

Add three more fields:

• Police check issued on, a Date field.
• Police check reference, a Text field.
• Police check result, a Text field your team fills in, marked sensitive, so the result survives if you later delete the file.

Shortcut: the Staff onboarding (Australia) pack includes an optional National police check upload, already sensitive, but it does not ask for a date. See starter request packs.

3. Ask for the check on a portal

Open Portals (opens in WorkZerk in a new tab) and pick or create one. On its Requests panel, click + Insert, choose Upload, and name it "National Police Check". Pick your field under Document type and make sure Require expiry is on.

Spell the date out in the description, for example: "Upload your National Police Certificate or check results report. In the expiry date box, enter the date three years after the issue date on your certificate."

Then add a Fields request for Police check issued on and Police check reference. Say in the description why you need the check, so people know what they are agreeing to.

4. Review and approve

Uploaded checks wait under Needs review on Requests (opens in WorkZerk in a new tab). Check the name, issue date, purpose and result. If the due date is wrong, click Change date and correct it. Approve it, which records who sighted it and when, then enter the result on their contact record.

5. Switch on the reminders

Open Automations (opens in WorkZerk in a new tab). Switch on Document expiring reminder and Document expired reminder. Both start switched off, and the expiring one goes 30 days before the due date by default. The ACIC aims to finish 95 per cent of checks within 10 business days, but some take longer, so consider 60 days.

If you re-check every year or two, Time to ask again is an alternative: it emails the person a set number of days after you approve a document with no expiry date (365 by default, up to 720). The compliance report cannot show an undated check as due, though.

6. Decide how long to keep the file

Open Profile (opens in WorkZerk in a new tab) and find Document retention. You can delete approved files a set number of days after approval, or 30 days after the expiry date. The dates and your approval stay. The setting covers every approved document with an expiry date in your account, not just police checks. See deleting documents after you approve them.

7. Check who is covered

Open Requests (opens in WorkZerk in a new tab) and click Document compliance. Each person shows as current, expiring, needs review, expired or missing for their police check. Use Download CSV when an auditor or funding body asks for a register.

Getting started

Start a free WorkZerk trial at workzerk.com, then work through the steps above. If you get stuck, the getting started guide walks through a first portal end to end, or email us at [email protected].