GDPR background checks: the legal basis for each check

Employers in Europe may run background checks under the GDPR, but every check needs its own legal basis, and criminal record checks need more than that. Article 6 decides whether you may process a candidate's data at all. Article 10 adds a separate test for criminal records: the processing must be authorized by EU or national law, or carried out under the control of an official authority.

This guide sets out the legal basis for the six checks employers ask about most: identity, criminal record, references, education, credit and sanctions lists. It explains why consent rarely works in recruitment and how to build a screening process that will stand up to a data protection authority. National rules differ, so the country section at the end shows where local law changes the picture.

What the GDPR requires before any background check

Every check has to pass two tests: it needs a lawful basis under Article 6, and it must respect the principles in Article 5. Criminal record data and sensitive data face extra rules on top.

Article 6: a lawful basis for every check

Article 6(1) lists six lawful bases. In pre-employment screening, three do the work:

• Legal obligation (Article 6(1)(c)). A law requires the check. Examples are right-to-work checks, a mandatory criminal record certificate for childcare roles, and integrity screening that financial supervisors require.
• Legitimate interests (Article 6(1)(f)). You have a genuine interest, such as confirming that a finance director really holds the degree on their CV. The check must be necessary for that interest, and the candidate's rights must not outweigh it. Record this balancing test in a legitimate interests assessment (LIA).
• Steps before a contract (Article 6(1)(b)). This covers what you need to make a job offer and carry out the contract, such as contact and payroll details. It does not stretch to extra vetting.

The basis is chosen per check, not per candidate. A single screening can rest on a legal obligation for identity, legitimate interests for references, and a national law for the criminal record.

Article 10: the extra test for criminal records

Article 10 says data on criminal convictions and offences may only be processed under the control of an official authority, or where EU or national law authorizes it with appropriate safeguards. A comprehensive register of convictions may only be kept by an official authority.

For a private employer, this means legitimate interests alone is never enough for a criminal record check. You also need a national provision that allows it. That is why most European countries route criminal checks through a government certificate that the candidate requests, such as the Dutch VOG, the German Führungszeugnis or the UK DBS check.

The scope of Article 10 is wider than many employers assume. In 2021 the Court of Justice of the EU held that "criminal offence" is an EU-wide concept (case C-439/19). So court records, news reports about alleged crimes and online search results about offences are Article 10 data too, not just conviction certificates.

Article 9: sensitive data you should not collect

Article 9 prohibits processing health data, ethnic origin, religion, political opinions, trade union membership, biometric data and data on sex life or sexual orientation, subject to narrow exceptions. Background checks should not touch these categories. Watch for them in references, social media searches and identity document scans.

The principles behind every check

• Purpose limitation and data minimization (Article 5). Only run checks that are relevant to the role and collect only what the check needs.
• Transparency (Articles 13 and 14). Tell candidates which checks you will run, why, which sources you use and how long you keep the results, before you start.
• Storage limitation (Article 5). Delete screening data when it is no longer needed.
• No purely automated rejections (Article 22). A person must review a negative result before it decides the outcome.
• Impact assessment (Article 35). A DPIA is required for large-scale processing of Article 10 data, and many national authorities list employee screening as high-risk processing.
• National employment rules (Article 88). Member states may set specific rules for employee data, so local law can be stricter than the GDPR.

Why consent is rarely the right legal basis

Consent feels like the safe option, but in recruitment it usually is not valid. Under the GDPR, consent must be freely given, and a candidate who wants the job is not in a position to refuse.

The European Data Protection Board says so directly. Its Guidelines 05/2020 on consent state that the employment relationship creates an imbalance of power, and that consent from current or future employees is unlikely to be freely given. Employees can give free consent only in exceptional cases.

Consent has two further weaknesses. A candidate can withdraw it at any time, which would stop a check halfway. And under the GDPR itself, consent does not satisfy Article 10: a criminal record check still needs a legal authorization. Some national laws accept explicit consent as a condition for criminal data, but the power imbalance makes it fragile there too.

What to do instead:

• Base each check on a legal obligation or legitimate interests, and document why.
• Inform the candidate clearly and early. Ask them to confirm in writing that they have read it, and call this an acknowledgement, not consent.
• Let the candidate request their own criminal record certificate, so the data reaches you through the route national law provides.
• Consent still has a narrow place. Keeping a rejected candidate's details for future vacancies is a common example, because refusing has no effect on the current application.

The legal basis for each background check

Identity and right to work

Legal basis: legal obligation (Article 6(1)(c)).

Employers must confirm who they hire and, for non-EU nationals, that they may work. The EU Employer Sanctions Directive (2009/52/EC) requires employers to check that third-country nationals hold a valid residence permit and to keep a copy for the duration of employment. Tax and payroll laws add their own identification duties.

Watch out for national identification numbers. Article 87 lets member states restrict their use, so only record a national ID number where a law asks for it. Keep a copy of the ID document only where a law requires one, and mask fields you do not need where national rules allow.

Criminal record

Legal basis: legal obligation or legitimate interests (Article 6), plus a legal authorization under Article 10.

This is the check with the strictest rules. In most countries, the lawful route is a certificate that the candidate requests from a government body, which checks the record against the risks of the role. For some jobs, such as work with children, in education or in security, the certificate is mandatory by law.

Do not search court records, news archives or the internet for convictions yourself unless national law allows it. Remember that reports of alleged crimes are Article 10 data too. If a screening company handles criminal data for you, check that it holds the authorization national law requires. In the Netherlands, for example, it needs a license under the Private Security Organizations and Detective Agencies Act.

Where a candidate has lived abroad, they can usually request a certificate from those countries as well. Record that the certificate was presented and what the outcome was, rather than storing a copy, unless a law requires the copy.

References

Legal basis: legitimate interests (Article 6(1)(f)).

Reference checks are generally accepted, provided you keep them proportionate. Contact referees the candidate has named, or tell the candidate before you contact anyone else. Limit your questions to work performance and conduct in the role.

Never ask about health, sickness absence, pregnancy, union membership or other Article 9 data. The referee is a data subject too, so give them basic information about how you will use their answers. Keep a short factual summary, not a full transcript.

Education and qualifications

Legal basis: legitimate interests (Article 6(1)(f)), or legal obligation for regulated professions.

Verifying the diplomas and certificates a candidate claims is proportionate for most roles where the qualification matters. For regulated professions, such as doctors, nurses, lawyers and auditors, checking the official professional register is often a legal duty.

Check only the qualifications the candidate has listed or the role requires. Verify them with the issuing institution or an official register, not with unofficial databases.

Credit and financial history

Legal basis: legitimate interests (Article 6(1)(f)), for a narrow set of roles only.

A credit check is the hardest check to justify. It is defensible for roles with real financial exposure, such as signing authority, cash handling, treasury or access to client funds, and where financial-sector integrity rules apply. For most other roles it fails the necessity test.

Many countries restrict access to credit bureau data to lending decisions, so an employer may not be allowed to use it at all. Where a check is justified, use the narrowest source, such as a public insolvency register, and look only for findings relevant to the role, not a general credit score.

Sanctions lists

Legal basis: legal obligation (Article 6(1)(c)), with legitimate interests as the fallback.

EU sanctions regulations, such as Council Regulation (EU) No 269/2014, prohibit making funds or economic resources available to listed persons. Paying a salary to a listed person would breach that prohibition, so screening new hires against the EU consolidated sanctions list is a common compliance step.

The regulations do not prescribe screening itself, which is why some organizations rely on legitimate interests instead. That is also the basis for checking non-EU lists, such as the US OFAC list. Name matches often produce false positives, so verify any hit with additional identifiers before acting, and never reject a candidate on a name match alone.

How to run a GDPR-compliant background check

• Set a screening profile per role. Decide which checks each role needs based on its risks, and write down why. A warehouse role and a treasury role should not get the same screening.
• Record the legal basis for each check. Note the Article 6 basis, complete an LIA where you rely on legitimate interests, and identify the national provision that covers any criminal record check.
• Run a DPIA where required. Screening at scale, or any processing of Article 10 data on a large scale, calls for a data protection impact assessment before you start.
• Inform candidates early. Mention screening in the vacancy text, and give a privacy notice covering the checks, sources, retention periods and the candidate's rights.
• Screen late in the process. Check only the preferred candidate, ideally after a conditional offer, so you do not collect data on people you will not hire.
• Use official sources. Let the candidate request their own criminal record certificate, and verify qualifications and sanctions hits against official registers and lists.
• Let the candidate respond. Share any negative finding and give the candidate a chance to explain before a person makes the decision.
• Put a processing agreement in place. If a screening provider runs checks for you, sign an Article 28 data processing agreement. Confirm it holds any national license it needs and where it stores data.
• Delete on time. Remove data on unsuccessful candidates soon after the procedure closes; the Dutch authority, for example, advises four weeks. For new hires, keep only the outcome needed in the personnel file.
• Restrict access. Limit screening results to the people who make the hiring decision and store them securely.

Country rules: where national law changes the picture

The GDPR sets the framework, but Article 10 and Article 88 leave key choices to member states. The biggest difference is how a criminal record check works.

Rules on credit checks, retention periods and which roles require screening also vary. Check the national rules for each country where you hire.

In the Netherlands, the criminal record check runs through the VOG, and the Dutch Data Protection Authority (AP) advises deleting the data of unsuccessful candidates four weeks after the procedure ends. Read more about what Article 10 GDPR means for a VOG check or about employment screening.