Who Actually Decides on Your Security Clearance? The Law Behind UK Vetting

Why this matters

Most people who go through UK security vetting assume two things: that United Kingdom Security Vetting (UKSV) is the only body that grants or refuses SC, DV, eSC and eDV clearance, and that the whole process sits on a proper statutory foundation.

Both assumptions are wrong. And the shape of the real system, which is not what most people imagine, determines what arguments are available when a clearance is refused, suspended or withdrawn.

There is no Vetting Act

National security vetting is not governed by any statute. No Vetting Act, no statutory instrument, nothing. UKSV is not a statutory body. A vetting decision is not a statutory decision. There is no statutory right of appeal against one.

The power to require vetting as a condition of employment comes from two much older sources: the Crown’s prerogative to set the terms of service of its own servants, and ordinary contract law. That is why the published policy says no one is obliged to undergo vetting, but that holding a vetted post depends on passing it. Vetting is treated as a condition of the job, not a duty imposed by Parliament.

The rule book is the Cabinet Office’s HMG Personnel Security Controls, last updated on 31 October 2022. That document, together with the wider Security Policy Framework and GovS 007, sets out how SC, DV, CTC and the other clearance levels operate. It is policy, not law. It binds departments because they agree to follow it, and it binds individuals because their civil service or contractor terms incorporate it.

Who actually takes the decision?

Most people get this wrong. Paragraph 18 of the HMG Controls is direct:

“Decisions on national security vetting clearances are made either by UKSV on behalf of some departments, by the department or organisation themselves or by the vetting authority of the department or organisation that requires the clearance.”

The FAQ at Annex C is even blunter: “The employing or contracting department, or the relevant vetting authority, will make the final decision in light of all the available information obtained during the vetting process.”

UKSV is not automatically the decision-maker. It investigates, assesses, and recommends. The formal grant-or-refuse power sits with the sponsoring department, which can either take the decision itself or let UKSV take it on its behalf. In most cases UKSV takes it in practice, because sponsors rarely depart from its recommendation. But they can.

That is what happened in the Peter Mandelson ambassadorship. When the Foreign, Commonwealth & Development Office granted Developed Vetting to Lord Mandelson against UKSV’s recommendation in late January 2025, it was not pulling some obscure override lever. It was exercising the authority the policy framework has always placed with the sponsor. The striking feature of the episode is not that the power exists. It is that departmental overrides of this kind are, on the available reporting, rare.

The levels of UK security clearance

UKSV currently operates six levels of national security clearance. The HMG Personnel Security Controls of October 2022 describe four main levels, but UKSV’s own published guidance, last updated in September 2024, now recognises two additional enhanced levels that sit above SC and DV:

• Accreditation Check (AC) / Level 1A – aviation-sector posts involving unescorted access to the security restricted area of UK airports.
• Counter Terrorist Check (CTC) / Level 1B – posts with proximity to public figures at risk from terrorism, or access to information of value to hostile actors.
• Security Check (SC) – posts with frequent and uncontrolled access to SECRET assets, or occasional supervised access to TOP SECRET.
• Enhanced Security Check (eSC) – a supplementary level that sits between SC and DV. It allows regular uncontrolled access to SECRET assets and occasional controlled access to TOP SECRET, without extending to the full DV threshold. Typically used for posts with access to SECRET codeword material, designated information systems, or certain overseas postings with significant espionage exposure.
• Developed Vetting (DV) – the most widely used high-level clearance, for posts involving frequent and uncontrolled access to TOP SECRET material or codeword material.
• Enhanced Developed Vetting (eDV) – required for a very small number of specific posts where an additional level of assurance is required above DV. eDV can only be requested by a small number of sponsors with a prior agreement in place with UKSV and the Cabinet Office.

All six levels sit on top of the Baseline Personnel Security Standard (BPSS), which is not itself a security clearance but has to be in place before any NSV level can be granted. The checks get deeper as the level rises: SC adds a credit and financial check, DV adds a full financial review and a long interview with a trained Investigating Officer, and eSC and eDV add further interviews (supervisor and referee) and additional questionnaires covering family, travel and internet use.

If your role requires SC clearance or DV clearance – including the enhanced eSC and eDV levels – everything in this article applies both to the original grant and to any later review or withdrawal.

Which statutes do bite?

The vetting decision itself is non-statutory, but several statutes govern the landscape around it. Each becomes relevant in different kinds of appeal.

Data protection. The Data Protection Act 2018 and UK GDPR govern how vetting personal data is handled. For CTC/L1B, SC and DV, the data controller is usually UKSV, though in police-sector vetting the relevant force or agency may also be a controller. The National Security Vetting Privacy Notice, published on GOV.UK, sets out how vetting data is collected, retained and shared. Subjects have rights of access, rectification and, sometimes, erasure, subject to the national security exemption. In practice, the DPA is often the most productive route for challenging inaccurate information in a vetting file.

Human rights. Article 8 of the European Convention, incorporated by the Human Rights Act 1998, protects private and family life. It is engaged both by the intrusiveness of the enquiries and by the impact of a refusal on reputation and career. Any interference has to be “in accordance with the law” and “necessary in a democratic society in the interests of national security”.

Equality. The Equality Act 2010 gives a discrimination route to the Employment Tribunal, preserved expressly at paragraph 53 of the HMG Controls. Where a refusal involves direct or indirect discrimination on a protected ground, the tribunal route runs in parallel with the vetting appeal.

Criminal records. The Rehabilitation of Offenders Act 1974 is disapplied for NSV purposes, so spent convictions remain disclosable. The weight given to those records is a matter of proportionality.

Police vetting. Police vetting is the one part of the landscape with proper statutory footing. Section 39A of the Police Act 1996 requires chief officers to have regard to a statutory Vetting Code of Practice. That is why police vetting appeals operate slightly differently. The regulatory framework in this area has moved quickly. The High Court decision in R (Di Maria) v Commissioner of Police for the Metropolis [2025] EWHC 275 (Admin) found there was no lawful basis for dismissing officers for loss of vetting clearance under the Performance Regulations 2020, which in turn drove the Home Office to introduce the Police (Vetting) Regulations 2025. The Court of Appeal in Di Maria [2026] EWCA Civ 28 later partly overturned the High Court ruling, confirming that forces may consider conduct-related information in vetting decisions even where misconduct proceedings found no case to answer.

Intelligence agencies. MI5, SIS (MI6) and GCHQ sit outside the UKSV framework entirely. They conduct their own vetting in-house, to their own standards, with their own vetting officers. DV is the effective baseline for most agency staff and applicants, reflecting the nature of the material routinely handled, and a small number of posts require the higher Enhanced Developed Vetting (eDV) level. The appellate route for agency applicants, staff and contractors is also different: complaints go to the Investigatory Powers Tribunal under section 65 of the Regulation of Investigatory Powers Act 2000, not to SVAP.

The appeal architecture

When a clearance is refused, suspended or withdrawn, paragraphs 45 to 56 of the HMG Controls set out what is available.

The first stage is an internal appeal to the Head of Department or a nominated senior official. It has to be run independently of the original decision-maker, follow natural justice, and include a face-to-face interview.

The second stage is the Security Vetting Appeals Panel (SVAP). SVAP is an independent, non-statutory body chaired by a senior retired judge. A notice of intention to appeal has to be registered within 28 days of the final internal decision. The Panel reviews both the decision and the process, and makes recommendations to the Head of Department. Those recommendations are not binding, but departments rarely ignore them.

Judicial review sits behind SVAP, once other remedies are exhausted. An Employment Tribunal discrimination claim can run alongside.

SVAP is not open to unsuccessful recruitment candidates – only to existing employees and contractors. SVAP cannot award compensation; its job is to review the decision, not the employment consequences that follow it.

What this means if you are facing a refusal or withdrawal

Decisions are not unchallengeable. The strongest arguments usually rest on four things:

Departure from published policy. The HMG Controls, SVAP guidance and UKSV’s own material create legitimate expectations. A decision that departs from them, whether in substance or in process, is exposed.

Inaccurate underlying data. Under the DPA 2018, subjects can challenge inaccurate personal data. A file built on information that turns out to be wrong, incomplete or out of date is often a route to reconsideration.

Proportionality. The Article 8 test asks whether the interference is necessary and proportionate. Historical matters, age at the time, evidence of stability and change, operational need and mitigations all feed into that question.

Procedural fairness. Natural justice is required by the HMG Controls themselves. Inadequate disclosure, no real opportunity to respond, or involvement of the original decision-maker in the review are all weaknesses worth pressing.

SC and DV decisions are rarely driven by a single issue. They are usually a composite of concerns weighed against the sensitivity of the post. An appeal has to take each strand apart, test each one against the framework, and put the case for reinstatement on the evidence.

Frequently asked questions about UK security vetting

Is UK security vetting governed by legislation?

No. There is no Vetting Act and no statutory instrument that creates the national security vetting system. Vetting operates on policy issued by the Cabinet Office, principally the HMG Personnel Security Controls. The power to require vetting as a condition of employment derives from the Crown’s prerogative over the terms of service of its own servants and from ordinary contractual authority in civil service, armed forces and contractor employment.

Who actually grants SC or DV clearance?

The sponsoring department, or UKSV on that department’s behalf. Paragraph 18 of the HMG Personnel Security Controls locates the formal decision with the employing or contracting department, or with the relevant vetting authority. UKSV investigates and recommends. For most departments UKSV also takes the formal decision in practice, but it is not automatically the decision-maker. The grant-or-refuse power sits with the sponsor unless expressly delegated.

Can a department overrule a UKSV recommendation?

Yes, although it is unusual. Because the policy framework locates the decision with the sponsoring department, a department can grant clearance notwithstanding an adverse UKSV recommendation, and can refuse clearance where UKSV would have granted. Sponsors typically defer to UKSV. The January 2025 grant of Developed Vetting to Lord Mandelson by the FCDO, against UKSV’s advice, is described in the reporting as a rare example of a sponsor exercising its latent decision-making authority.

Can I appeal if my SC or DV clearance is refused or withdrawn?

Yes, if you are an existing employee or contractor. There are two stages: an internal appeal to the Head of Department or a nominated senior official, then an onward appeal to the Security Vetting Appeals Panel (SVAP). Applicants for recruitment do not have access to SVAP. Separate arrangements apply to applicants, staff and contractors of the intelligence agencies, who appeal via the Investigatory Powers Tribunal.

What is SVAP and what can it do?

The Security Vetting Appeals Panel is an independent, non-statutory body chaired by a senior retired judge. It reviews both the substantive decision and the process, and makes recommendations to the Head of Department. SVAP’s recommendations are not legally binding but are rarely ignored in practice. SVAP cannot award compensation and does not consider subsequent employment action taken as a result of the vetting decision.

What is the time limit for appealing to SVAP?

Twenty-eight days. You have to register your intention to appeal with the SVAP Secretariat in writing within 28 days of receiving the final notification rejecting your internal appeal. The deadline is strict. Where a case is time-critical, a protective registration should be lodged before the substantive submissions are finalised.

Can I take a vetting decision to judicial review?

Yes, once other remedies are exhausted. The High Court considers whether the decision-making process was properly conducted, whether the conclusion was reasonable and whether proper reasons were given. If the challenge succeeds, the court will usually quash the decision and send it back for reconsideration rather than substitute its own. Claims often run alongside DPA 2018 rectification claims and, where relevant, Equality Act 2010 claims in the Employment Tribunal.

Does a criminal record automatically prevent me obtaining SC or DV clearance?

No. Each case is assessed on its merits. The decision-maker considers the seriousness of the offence, how long ago it was, the applicant’s age at the time and any surrounding circumstances. The Rehabilitation of Offenders Act 1974 is disapplied for NSV, so spent convictions remain disclosable, but weight is a matter of proportionality. Concealment or non-disclosure of a conviction is usually treated more seriously than the offence itself.

Expert help with SC and DV clearance appeals

If you are facing a refusal, suspension or withdrawal of your SC clearance or DV clearance, early specialist advice makes a real difference to the outcome. Legisia Legal Services works exclusively on police records, DBS and security vetting matters.

Contact Legisia Legal Services for a fixed-fee initial consultation on your vetting matter.