Background Checks When Hiring: What's Allowed

TL;DR: Background checks are a valuable tool for managing hiring risk — but what you can check, when you can check it, and how you must handle the results varies significantly across 7 countries. Getting this wrong can expose you to data protection penalties, discrimination claims, and unfair hiring challenges. This guide explains the rules.

Disclaimer: MmowW Scrib🐮 is a document preparation service, not a law firm. We do not provide legal advice. This guide is for general informational purposes only. Background check rules vary significantly by jurisdiction and are subject to change. Always consult a qualified employment solicitor or attorney for advice specific to your situation.

What You Need to Know

Background checks fall into several categories, each with different legal rules:

1. Criminal history checks — checking for past convictions
2. Credit / financial checks — checking creditworthiness or financial history
3. Reference checks — contacting previous employers
4. Qualification and credential verification — confirming stated qualifications
5. Right-to-work verification — confirming the legal right to work
6. Social media screening — reviewing online presence
7. Identity verification — confirming the candidate is who they claim to be

The core principles that apply across all 7 countries:

• Consent — candidates must generally be informed and consent to background checks
• Proportionality — checks must be relevant to the role and risks involved
• Data protection — background check data is personal (and often sensitive) data and must be handled under applicable data protection law
• Non-discrimination — background check policies must not disproportionately exclude protected groups without justification

How It Works

Criminal History Checks

Criminal record checks are among the most sensitive — and most regulated — type of background check. The ability to refuse employment based on criminal history varies significantly, and blanket exclusions of candidates with any criminal record are often unlawful.

Key concepts:

• Spent convictions — in most jurisdictions, convictions that occurred sufficiently long ago and for which the person has served their sentence become "spent" and generally cannot be taken into account
• Relevance test — criminal records should be considered only where relevant to the role (e.g., a fraud conviction may be relevant for a finance role; a minor driving offence typically is not)
• Right to disclose — in most jurisdictions, candidates are required to disclose unspent convictions; asking about spent convictions is restricted

Universal best practice: Conduct criminal record checks after a conditional offer — not before. This approach (often called "ban the box") gives candidates the opportunity to demonstrate suitability before criminal history is considered.

Credit / Financial Checks

Credit checks are permitted for certain roles but should not be a default part of every hiring process.

When credit checks may be appropriate:

• Roles with direct access to company funds or financial accounts
• Finance, treasury, or senior accounting positions
• Roles with authority to approve payments above a certain threshold

When credit checks are generally not appropriate:

• Any role where the candidate does not have access to financial assets
• General employment screening unrelated to financial responsibility

Reference Checks

Reference checks are almost universally permitted, subject to data protection rules. However, what former employers can say about a departed employee is restricted in some jurisdictions.

What you can do:

• Contact referees provided by the candidate (with their consent)
• Ask about the candidate's performance in their previous role
• Verify employment dates and job title

What former employers must consider:

• Factual references are generally safe (employment dates, job title, reason for leaving)
• Providing a false or misleading reference can expose the former employer to liability
• Refusing to provide any reference at all is generally permitted
• In the UK, a poor reference must be fair, accurate, and not misleading

Best practice:

• Always obtain candidate consent before contacting referees
• Ask structured, role-relevant questions
• Document reference check results

Qualification and Credential Verification

Verifying that a candidate holds the qualifications they claim is legitimate and important — particularly for regulated professions.

Always verify:

• Professional registrations (medical, legal, financial, educational)
• Degree qualifications (particularly where a specific degree is a genuine requirement)
• Trade qualifications and licences

How to verify:

• Contact the awarding institution directly
• Use professional body registers (e.g., Solicitors Regulation Authority in UK, Bar Association in US/Canada)
• Use verification services (particularly useful for international qualifications)

Right-to-Work Verification

Right-to-work verification is mandatory (not optional) before employment commences in all 7 countries.

This is covered in detail in our First Employee Hiring Checklist. In brief:

• Verify documents proving the candidate's right to work before their first day
• Keep copies of the documents verified
• Create a record of the date of verification

Social Media Screening

Social media screening occupies a legally grey area. It is not formally regulated in most jurisdictions but carries significant risk:

• You may discover protected information (pregnancy, religion, disability, sexuality) that you cannot lawfully use in your selection decision
• If you reject a candidate after viewing their social media profile and they can show you saw protected information, discrimination claims become difficult to defend
• GDPR / data protection laws restrict using personal data (including social media content) in ways the individual would not expect

If you conduct social media screening:

• Have a clear, written policy
• Conduct screening after the offer stage (not before)
• Document what you looked at and why it was relevant
• Never make decisions based on protected characteristics you discover
• Consider having a person not involved in the hiring decision conduct the review

Data Protection Rules for Background Checks

Background check data — particularly criminal record information and health data — is classified as sensitive personal data requiring higher protection under GDPR (EU/UK), the Privacy Act (AU/NZ), and equivalent legislation.

Key obligations:

• Inform candidates before conducting any background check (privacy notice)
• Obtain explicit consent for sensitive data processing
• Use data only for the purpose for which it was collected (hiring assessment)
• Retain background check data only as long as necessary
• Provide the candidate access to their own background check data on request
• Delete or anonymise background check data once it is no longer needed

Common Mistakes to Avoid

1. Conducting criminal checks before a conditional offer

"Ban the box" laws in many US states and good practice guidelines in the UK, Australia, and Canada require criminal history questions to be deferred until after a conditional offer. Asking about criminal history too early excludes candidates before they have the chance to demonstrate their suitability.

2. Blanket exclusion of candidates with any criminal record

An automatic policy of excluding all candidates with a criminal record — regardless of the offence, its relevance to the role, or how long ago it occurred — may constitute indirect discrimination in most jurisdictions.

3. Not obtaining informed consent

Conducting a credit or criminal background check without the candidate's knowledge and written consent violates data protection law in the UK, EU, Australia, New Zealand, and Canada. In the US, the FCRA requires specific written disclosure and authorisation before a consumer reporting agency runs a background check.

4. Using background check results inconsistently

If you apply credit checks only to candidates from certain backgrounds, or criminal record checks more rigorously to some candidates than others, you create discrimination risk. Background check policies should be applied consistently to all candidates for equivalent roles.

5. Keeping background check data indefinitely

Background check data should be deleted or anonymised once it is no longer needed — typically within a few months of the hiring decision. Retaining sensitive data indefinitely creates compliance risk.

Next Steps

1. Identify which background checks are genuinely required for each role type in your business
2. Develop a written background check policy covering what you check, when, and how you use results
3. Create a candidate consent form for background checks
4. Conduct criminal record checks after conditional offer — not before
5. Train hiring managers on consistent application of the background check policy
6. Consult a qualified employment solicitor or attorney to review your background check practices

Frequently Asked Questions

Q: Can I Google a job candidate?

A: You can — but you may inadvertently discover protected information (health conditions, religion, pregnancy) that you cannot lawfully use in your selection decision. If you conduct online research, have a clear policy, document what you found, and consider having someone not involved in the hiring decision conduct the research. Never make selection decisions based on protected information discovered online.

Q: What if a candidate refuses to consent to a background check?

A: You can require background checks as a condition of employment for roles where they are proportionate and relevant. If a candidate refuses to consent, you may be unable to proceed with the appointment. However, for roles where the background check is not genuinely necessary, refusing employment because a candidate will not consent to an unnecessary check may be challenged.

Q: How long can I keep background check records?

A: Data protection law in the UK, EU, Australia, and Canada requires that personal data is kept only as long as necessary. For background check data, this is typically a few months after the hiring decision. Specific criminal record information should be deleted promptly. Consult a qualified employment solicitor or attorney or data protection specialist for your jurisdiction.

Q: What is the adverse action process in the US?

A: Under the FCRA, if you intend to take adverse action (reject a candidate) based on a background check from a consumer reporting agency, you must: (1) provide a "pre-adverse action notice" with a copy of the report and a summary of rights; (2) wait a reasonable time (typically 5 business days) for the candidate to dispute inaccuracies; (3) if proceeding, provide a final adverse action notice. Failing to follow this process violates the FCRA and can result in significant penalties.

Useful Resources

• 🇬🇧 UK: DBS — Disclosure and Barring Service
• 🇫🇷 France: CNIL — Employment data protection
• 🇸🇪 Sweden: Integritetsskyddsmyndigheten (IMY)
• 🇦🇺 Australia: ACIC — National Police Checks
• 🇳🇿 New Zealand: NZ Police — Vetting service
• 🇨🇦 Canada: RCMP — Criminal record checks
• 🇺🇸 USA: EEOC — Criminal history in hiring

How MmowW Scrib🐮 Can Help

Our Employment Checker provides an overview of background check requirements and restrictions by country and role type.

Track key hiring deadlines and right-to-work verification requirements with our Filing Deadlines tool.

Use our Cost Calculator to factor background check costs into your total hiring budget.

Remember: MmowW Scrib🐮 prepares documents — it does not provide legal advice. A qualified employment solicitor or attorney should review your background check policy and practices.

Loved for Safety. MmowW Scrib🐮 — Document preparation made simple across 7 countries.

Loved for Safety.