How to choose a background check company: 7 criteria

How to choose a background check company: 7 criteria 

A good background check company is licensed to screen people, keeps candidate data secure and in the EU, follows the GDPR, delivers on time, fits into your hiring tools and charges in a way you can predict. Those seven criteria separate a provider you can rely on from one that creates legal risk or slows your hiring down.

Screening touches some of the most sensitive data you will ever handle: identity documents, employment history, qualifications and sometimes criminal records. If your provider gets it wrong, you remain responsible as the employer. This guide explains what to check for each criterion and which questions to ask before you sign.

1. License to screen

Check first that the company is legally allowed to investigate people in the country where you hire. Without the right license, the screening itself can be unlawful, and the results may be unusable.

The rules differ by country:

• Netherlands: an organization that investigates people for a client needs a license as a private investigation agency under the Private Security Organizations and Detective Agencies Act (Wpbr). The license comes with a POB number that the company must show on its website and documents.
• United Kingdom: criminal record checks run through the Disclosure and Barring Service (DBS), using a registered body or an umbrella body for standard and enhanced checks.
• United States: a background check company acts as a consumer reporting agency and must comply with the Fair Credit Reporting Act (FCRA).

Ask for the license or registration number and verify it in the public register yourself. If the company uses partners in other countries, ask how those partners are licensed too.

2. ISO 27001 certification

ISO 27001 shows that an independent auditor has checked how the company manages information security. For a provider that stores passports, diplomas and reference reports, it is the clearest single proof that security is organized, not improvised.

A logo on a website is not enough. Ask for the certificate and check three things:

• Scope: the certificate should cover the screening service and the systems that hold candidate data, not just one office or department.
• Certification body: the auditor should be accredited by a national accreditation body, such as the Dutch Accreditation Council (RvA) or UKAS.
• Version and validity: current certificates follow ISO/IEC 27001:2022. Certificates run for three years, with surveillance audits in between, so check the expiry date.

3. EU hosting

If you hire in Europe, candidate data is safest when it is stored and processed inside the EU or EEA. Transfers outside the EU are allowed under the GDPR, but only with extra safeguards, and they add legal complexity you then have to document and defend.

Ask where the data is stored, where backups are kept and where support staff can access it from. Then ask for the list of sub-processors: the hosting provider, email service and any partner that performs checks abroad. A company can host in Frankfurt and still send data to a US analytics tool.

Where data does leave the EU, ask which transfer mechanism the provider relies on, such as an adequacy decision (for example, the EU-US Data Privacy Framework) or standard contractual clauses.

4. Turnaround time

Turnaround decides whether screening fits your hiring timeline or delays every start date. Ask for realistic times per type of check, not a single headline figure.

Some checks are fast because the provider controls them, such as an ID document check. Others depend on third parties: former employers who need to answer reference questions, universities that confirm a diploma, or government bodies that issue criminal record certificates. International checks usually take longer.

Good questions to ask:

• What is your average turnaround per check type, and how long do the slowest 10% take?
• What happens when a referee or school does not respond?
• Can my team and the candidate see the status of each check in real time?
• Do you charge extra for urgent cases?

5. GDPR compliance

Under the GDPR, you as the employer are the controller and the background check company is your processor. That means you stay accountable for how candidate data is used, so the provider's practices become your risk.

A compliant provider will:

• Sign a data processing agreement that meets Article 28 of the GDPR.
• Collect only the data needed for the role, rather than running every check on every candidate.
• Handle criminal record data only where the law allows it. Article 10 of the GDPR sets strict limits; in the Netherlands, for example, the usual route is a Certificate of Conduct (VOG) issued by the government agency Justis.
• Inform candidates clearly and help you respond when they ask to see, correct or delete their data.
• Apply fixed retention periods and delete data when they end.

Ask the provider whether it can support your data protection impact assessment (DPIA). Screening on a large scale, or screening that involves criminal records, often requires one.

6. Integrations

Integrations decide how much manual work screening adds to your recruiters. Without them, someone copies candidate details from one system to another, chases statuses by email, and uploads report by hand.

Check whether the provider connects with the applicant tracking system (ATS) or HR system you already use. If there is no ready-made connection, ask about an API and webhooks, so your developers can start checks and receive results automatically. For larger teams, single sign-on (SSO) and user roles matter too, so you control who sees which reports. Ask for documentation and a demo of the integration in action, not just a logo on a partner page.

7. Pricing model

The pricing model matters as much as the price. Background check companies usually charge in one of three ways:

• Per check: you pay for each individual check, such as an ID check or a reference check. Flexible, but costs vary with each hire.
• Per package: you pay a fixed price for a set of checks per role or risk level. Easy to budget and consistent across candidates.
• Subscription or credits: you pay upfront for a volume of screenings. Often cheaper per screening, but only if you use what you buy.

Ask what is not included in the quoted price. Common extras are international checks, government fees, urgent processing, set-up or integration costs and re-screening existing staff. Then calculate the total for the number of hires you expect in a year, not the cost of one check.

How to compare background check companies

Shortlist two or three providers and send each the same questions in writing. Written answers are easier to compare and become part of your supplier file:

• What is your license or registration number to screen people, and in which countries?
• Can you send your ISO 27001 certificate, including its scope?
• Where do you store candidate data, and who are your sub-processors?
• What are your average and slowest turnaround times per check type?
• Can you share your data processing agreement and standard retention periods?
• Which ATS and HR systems do you integrate with, and do you offer an API?
• What will screening cost for our expected annual volume, including all extras?

Then test the candidate to experience yourself. Run one screening on a colleague and see how clear the invitation is, how easy it is to upload documents on a phone and how quickly questions are answered.

Frequently asked questions

• What does a background check company do?

A background check company verifies information about job candidates on behalf of employers. Typical checks include identity, right to work, employment history, education, references and, where the law allows, criminal records.

• Is a background check company the same as a screening agency?

Yes. "Background check company", "pre-employment screening provider" and "screening agency" describe the same type of service. In Dutch, the common term is screenings bureau.

• Can a background check company check criminal records in the Netherlands?

Not directly. In the Netherlands, criminal record screening runs through a Certificate of Conduct (VOG) issued by Justis. A screening company can help you request it and track it alongside the other checks.

• Which criterion matters most?

The license and GDPR compliance come first, because they determine whether screening is lawful at all. Turnaround, integrations and pricing then decide which compliant provider suits your hiring process best.

Conclusion

Choose a background check company on proof, not promises: a verifiable license, a valid ISO 27001 certificate, EU hosting, a solid data processing agreement, realistic turnaround times, working integrations and a price you can predict. Ask every provider the same seven questions, and the right choice usually becomes clear.