The Water Cooler Test: Who Needs to Know About a Criminal Record?

Let's say you've hired someone with a criminal record. Do you tell the whole team? Pop it in the department newsletter? Put up a "welcome ex-offender" banner in reception?

…Of course not. But if you wouldn't make a big announcement, why would you tell more people than absolutely necessary?

This is what we refer to as the "water cooler test." It's a simple way to think about disclosure: if something could easily become canteen gossip, you've shared it too widely. The principle is straightforward: people need to know based on their role, not because they're curious or might work with someone at some point.

The real question isn't whether to disclose someone's conviction. It's working out who actually needs to know (safeguarding, compliance) versus who simply wants to know (curiosity, assumptions). Get this wrong and you end up in one of two situations: either too many people know, creating gossip and stigma, or the wrong people know, creating compliance gaps.

In this guide, we'll walk through three practical steps to handle disclosure properly, from onboarding through to managing workplace culture, and show you how to apply role-based necessity to keep information on a strict need-to-know basis.

What’s at Stake When Information Spreads?

When too many people know about someone's conviction, the information spreads quickly. People Google them. They chat at the water cooler. They make assumptions. Suddenly, you've got gossip, stigma, as well as potential workplace harassment and bullying on your hands.

2024 research from CIPD found that approximately one in four workers have experienced some form of conflict or abuse in their careers. People with convictions face an even higher risk when their history becomes common knowledge in the workplace. 

Bullying contributes to job dissatisfaction, sickness absence, stress and depression, all things that directly impact retention and performance. This is why careful disclosure handling matters: it's not just about compliance, it's about preventing the stigma and harassment that pushes people out of work.

In the year to March 2024, 31.1% of people with a conviction in England and Wales found employment within six months after release. When they do get a job, the last thing they need is a toxic environment driving them out.

Getting disclosure handling right isn't just about ticking compliance boxes. It's about creating workplaces where people can actually succeed. If someone is taunted, shamed or harassed because of their history, whether they disclosed it themselves or someone Googled them, that becomes an organisational problem. One that affects your culture, your retention and potentially your legal liability.

The Golden Rule? It's Their Information to Share

Ultimately, the conviction information belongs to the individual, not the organisation. You might know about it for compliance or safeguarding reasons, but that doesn't make it yours to share.

The individual can choose to tell colleagues if they want to. You can't really stop them, and it's their information to share, but as an employer, you can't be the one broadcasting it.

What you can do is have strong bullying and harassment policies ready. At that point, it's about how people are treating a colleague, not the historical conviction. You can also have the self-disclosure discussion with candidates to let them know that it’s their information to share and that you won’t be discussing it with other colleagues.

It is also important that, as a company, you make it clear what an employee with a conviction should do if it comes to light and they are being bullied. This can include information on who to talk to, as well as which steps to take.

You've made the decision to hire them. The next step is making sure they're treated with the same dignity as any other employee.

Working Out Who Needs to Know

So let's get practical. Who actually needs to know about someone's conviction? The answer depends on role-based necessity, what someone needs to do their job safely and compliantly, not where they sit in the organisational hierarchy.

Must Know	May Need to Know	Doesn't Need to Know
Safeguarding lead People/HR team (for compliance and support)	Hiring manager	The whole team Other departments New line managers when someone gets promoted Anyone else who’s curious

A quick note on hiring managers. In many organisations, hundreds of people are hiring managers at any given time. That's a lot of people with access to sensitive information.

Forward-thinking organisations like Catch22 are already championing this. Catch22 is a social enterprise working in criminal justice and social care, and has developed a fantastic model for handling disclosure that's worth looking at in more detail.

Their approach is to keep criminal record information secure during the hiring process, with access limited to the people team and the safeguarding lead. The information is stored in a separate personnel file, not in the general one that everyone can access.

This means that when someone gets promoted or moves teams, their new manager doesn't automatically see it. If the information is needed later, maybe for an investigation or a higher level of vetting, the safeguarding team makes a judgment call on what actually needs to be shared.

One way to take this further is to implement post-interview disclosure, where the hiring decision is made first, then disclosure is handled separately with the safeguarding team. That way, the hiring manager might never need to know at all.

3 Practical Steps to Handle Disclosure

So you've worked out who needs to know. Now, how do you actually handle the disclosure process?

Step 1: During onboarding

Make it clear from the start who will know about the disclosure and why. Our onboarding form is a good place to start, as it's transparent about who has access to the information and how it's stored. Nobody likes surprises, and people deserve to know where their information is going.

Explain how the information will be protected. Where's it stored? Who can access it? What happens if they move to a different team or get promoted?

Also consider post-interview disclosure where possible. Make the hiring decision based on skills and experience, then handle disclosure separately with the safeguarding team afterwards.

Step 2: After someone joins

The information stays with the safeguarding team and HR. It doesn't go into the general personnel file where anyone processing a promotion or internal move might see it. If someone needs the information later, maybe for a role change that requires different vetting, the safeguarding team reviews whether it's actually relevant.

Step 3: When disclosure happens (by the individual or otherwise)

This is where your bullying and harassment policies come in. Make it clear from day one that stigma, harassment or gossip about anyone's background is unacceptable. Treat it as a culture issue, not a conviction issue. The question isn't about someone's past, it's about how your team behaves in the present.

Getting It Right: Available Tools and Support

Getting disclosure handling right doesn't have to be complicated, but it does require intention.

Start by reviewing your onboarding process. Are you clear with new hires about who will know about their disclosure and why? Does your personnel file system keep conviction information separate from general HR records?

Consider making the Disclosure Toolkit Calculator available on your careers page or in application materials. It’s a free tool that helps individuals work out when their conviction becomes 'spent' and whether they need to disclose it for a specific role. This removes ambiguity for applicants and signals that you're an inclusive employer.

Check your bullying and harassment policies. Do they explicitly cover situations where someone's background becomes workplace gossip? Have you set out how your employee can raise concerns and who will support them? Are managers trained to quickly shut down stigma and harassment? These policies need to be more than just documents in a drawer.

Think about how role-based risk assessment (covered in our HARD Framework guide) informs who needs to know what. Not every role requires the same level of disclosure or vetting. Understanding the actual risks helps you make proportionate decisions about information sharing.

For more details on building inclusive hiring practices into your organisation, our step-by-step guide to hiring ex-offenders walks through the entire process. And if you want comprehensive training on disclosure handling, our R3 e-learning course covers everything from compliance to culture change.