https://www.gov.uk/guidance/transgender-applications
The DBS offers two choices - you can either put both identities on the normal form and have both names listed on the certificate.
OR
You can use their phone line so that only the newest name appears on the certificate.
What they don’t seem to have realised is that a nefarious person could just do neither of the two government offered options but can attempt an option 3, use only the new identity on the normal form and hope that nothing found in the records check connects the new name with the old name!
And privacy regulations relating to GDPR and GRCs can be leveraged to severe ALL the connections between identities in databases - eg the NHS doesn’t change the sex marker on existing records, instead it issues a completely new NHS number in the new name and sex (some trans people have had issues with hospitals requesting payment for A&E services because the new record looks like that of a recent immigrant - no childhood health records visible and a newly minted NHS number issued to an adult, rather than an older number issued to a newborn!). The completely new NHS number thing came about as part of the GRA legislation, but in practice you don’t actually need a GRC to get a new NHS number, nor do you need to have a Gender Dysphoria diagnosis or have started any gender related medical interventions - you can just request it via your GP reception desk team and they have to send it on to a centralised service.
Presumably when the new NHS number thing was dreamt up it was imagined to be a last step after a diagnosis of transsexualism, 2 years ‘in role’ and genital surgery - nowadays a new NHS number seems to be a very early step for most transitioners and that means it could be utilised by someone as part of setting up a new identity (and erasing an old one) for nefarious reasons, even if they don’t actually intend on medical or surgical intervention.