Hiring has gone global. A company in Dubai recruits an engineer based in Germany, a US firm onboards a consultant from Ireland, and an Indian business opens a delivery centre in Poland. Each of these hires involves checking a person's identity, education and work history, and each one can bring the European Union's General Data Protection Regulation (GDPR) into play.
GDPR has been in force since May 2018, yet background verification (BGV) remains one of the places where organisations most often stumble. This article explains why GDPR matters to screening, how it changes the way checks should be run, and what a sensible compliance approach looks like.
Why GDPR reaches beyond Europe
GDPR is not limited to companies based in the EU. It applies to organisations established in the EU, and also to organisations elsewhere that process the personal data of people in the EU in connection with offering goods or services or monitoring behaviour. For a verification request about a candidate located in Europe, the rules can follow the data wherever it travels.
That is why a screening provider and the employer who engages it both need to understand the regulation, even when neither has an office in Europe.
The core ideas, in plain language
GDPR is built on a set of principles that apply to every stage of a verification file:
- Lawfulness, fairness and transparency. There must be a valid legal basis for processing, and candidates must be told what is happening to their data.
- Purpose limitation. Data gathered for a specific check should not be reused for unrelated goals.
- Data minimisation. Collect only what is relevant and necessary for the role.
- Accuracy. Records must be correct and kept up to date.
- Storage limitation. Data should not be kept longer than needed.
- Integrity and confidentiality. Appropriate security must protect the data.
- Accountability. Organisations must be able to demonstrate that they comply, not simply claim it.
Choosing the right legal basis
One of the first questions in any European screening programme is: why are we allowed to process this information? GDPR offers several legal bases, and the ones most often considered in hiring are legal obligation, legitimate interests and, in limited cases, consent.
Consent deserves special care in an employment setting. Regulators have long expressed concern that consent given by a job applicant may not be truly voluntary, because there is an obvious imbalance of power between candidate and employer. Many organisations therefore rely on a documented legitimate interests assessment or on a legal requirement, while still giving candidates clear notice. The right answer depends on the country and the type of check, so local legal advice is worth having.
Where background verification gets sensitive
Criminal record checks
Information about criminal convictions and offences receives special protection under GDPR. In general, processing it must either be carried out under official authority or be authorised by EU or Member State law with suitable safeguards. Rules differ markedly between countries, and in some places employers may only request a certificate where the role legally justifies it. A single global "criminal check for everyone" policy is risky.
Special category data
Health, ethnicity, religion, trade union membership and similar categories are subject to stricter conditions. Screening processes should avoid collecting these unless there is a clear, lawful need, and should make sure that free-text fields, reference responses and uploaded documents do not quietly pull such data into the file.
Automated decision-making
If a screening outcome is produced entirely by an automated process and has a significant effect on a candidate, GDPR gives that person protections, including the ability to request human review. AI-assisted verification can still be used well, as long as a human remains meaningfully involved in decisions that affect someone's job prospects.
What candidates can ask of you
GDPR gives individuals a set of rights that apply directly to screening records:
- Access to the personal data held about them and information about how it is used.
- Rectification of inaccurate data.
- Erasure in certain circumstances.
- Restriction and objection in specific situations.
- Portability where applicable.
Employers and their verification partners should be able to respond to these requests within the one-month period the regulation sets, which means knowing where every copy of a candidate's file sits.
Responsibilities shared between employer and provider
In most arrangements, the employer is the controller, deciding why and how data is used, while the verification company is a processor, acting on the employer's instructions. GDPR requires a written agreement between the two that covers the subject matter, security measures, sub-processors, assistance with individual rights and deletion or return of data at the end of the relationship.
Two further points deserve attention:
- Breach notification. A personal data breach that poses a risk to individuals generally has to be reported to the supervisory authority without undue delay and, where feasible, within 72 hours. Processors must alert controllers promptly, so contracts should spell out how quickly.
- International transfers. Sending verification data from the EU to a country without an adequacy decision requires an approved safeguard, such as Standard Contractual Clauses, together with an assessment of the risks. Verification of overseas degrees or past employers often involves exactly this kind of movement.
The cost of getting it wrong
Regulators can impose fines of up to €20 million or 4 percent of worldwide annual turnover, whichever is higher, for the most serious infringements. Beyond fines, the practical damage can include halted hiring programmes, damaged candidate trust and difficult conversations with clients who rely on you to protect their people's data.
A practical checklist for screening in Europe
- Map every data flow in your verification process, including where data is stored and who can see it.
- Document your legal basis for each type of check and each country.
- Give candidates a clear, concise privacy notice before collecting anything.
- Scale the checks to the role, and drop any that are not justified.
- Run a data protection impact assessment where the screening is large-scale or involves higher-risk data.
- Put compliant processor agreements in place and review sub-processors.
- Set retention periods and confirm that deletion really happens.
- Prepare a simple process for access, correction and erasure requests.
- Train recruiters and HR teams, since human error causes many incidents.
- Test your breach response plan so the 72-hour window is realistic.
Privacy and speed can coexist
Some employers worry that privacy rules will slow hiring down. In our experience the opposite tends to be true. A process with clear consent, targeted checks and clean records produces fewer disputes, fewer re-checks and faster onboarding. Candidates also notice when an organisation treats their information with care, and that shapes how they see the employer.
How Quinfy supports compliant global screening
Quinfy provides background verification across more than 45 countries, supported by ISO 27001, ISO 9001 and SOC 2 Type II certifications. Our platform is designed so that candidate consent, access controls and data handling are part of the verification journey. If you are building or reviewing a screening programme that touches Europe, we would be glad to talk through your requirements.
This article is for general information and does not constitute legal advice. Requirements vary by country and by situation, so please consult qualified legal counsel before finalising your screening policies.
About the author: Prathap P is a Senior Sales Manager at Quinfy, an AI-native background verification company helping employers verify talent across the globe.
