Running Background Checks on International Hires Under GDPR

GDPR requires a specific legal basis for processing background check data, and consent alone is often a weak basis in an employment context, since a candidate's consent isn't considered fully freely given when there's a power imbalance with the employer. Legitimate interest, or a specific legal obligation in regulated roles, is often the stronger basis, but it needs to be documented and specific to the role, not a blanket policy applied to every hire regardless of position.

Work with local counsel to document the legal basis for each category of check you run, criminal record, credit, employment verification, since they may need different justifications depending on the role and the country, and a basis that holds up for one category won't automatically cover the others.

Data minimization is a core GDPR principle, which means a background check process that runs every available check on every candidate regardless of role is itself a compliance risk, not just an over-cautious habit. A finance role handling company funds may justify a credit check. A marketing role almost certainly doesn't.

Build role-based check tiers rather than one standard package for every hire, and be prepared to explain why a specific check was run for a specific role if a candidate or a regulator asks.

Background check data shouldn't sit in your systems indefinitely once a hiring decision is made, especially for candidates who weren't hired. Set a specific retention period, tied to a legitimate purpose like defending against a discrimination claim, and delete the data once that period passes rather than keeping everything by default because deleting it feels like extra work.

This applies to rejected candidates' background check data specifically, since that's the category most likely to sit around unnecessarily once a hiring decision has already been made.

A few patterns that create real GDPR exposure:

• Running the same standard background check package on every candidate regardless of country or role
• Treating candidate consent as sufficient legal basis without documenting a stronger basis for the employment context
• No retention policy, or one that exists on paper but isn't actually followed for rejected candidates
• Using a background check vendor that isn't itself GDPR-compliant in how it processes and stores the data

Each of these is worth a direct conversation with your background check vendor and local employment counsel before extending the process to a new country.

Your own legal basis and retention policy don't fully protect you if the background check vendor itself isn't handling the data compliantly, since you remain responsible as the data controller even when a vendor processes the data on your behalf. A compliance platform like Vanta or Drata isn't a background check vendor, but it's useful for documenting that your vendor due diligence and data processing agreements are actually in place and reviewed.

Get a signed data processing agreement with any background check vendor before sending them a single EU or UK candidate's data, not after the fact. Ask the vendor directly where the data is stored and processed, since that answer affects your own cross-border transfer obligations on top of the underlying check itself.