Why data protection essential in pre-employment screening is
Pre-employment screening can help organisations make informed decisions and manage risks. At the same time, it involves collecting and assessing information about candidates. Employers therefore need to ensure that each background check has a clear and legimate purpose, is relevant to the position, does not go further than necessary and is based on an appropriate legal basis. Candidates should also be clearly informed about how their personal data is used.
A well-designed screening process helps organisations meet their legal obligations while creating a fair and transparent experience for candidates.
The legal basis for pre-employment screening in Germany
There is no single legal basis that automatically applies to every background check. The appropriate legal basis depends on the type of check, the position and the reason why the information is needed.
In Germany, personal data may be processed where this is necessary to decide whether an employment relationship should be established. Depending on the circumstances, other legal bases under the GDPR may also apply, for example where processing is required by law or where the employer has a legitimate interest.
When legitimate interest is used, organisations need to consider whether the screening is necessary and whether the candidate’s rights and interests outweigh the organisation’s interest in carrying out the check.
Consent may also be relevant in certain situations. However, because of the relationship between an employer and a candidate, particular attention must be paid to whether consent is genuinely given freely. For this reason, the legal basis should be assessed for each type of screening check rather than applying one general approach to the entire screening process.
Data minimisation and purpose limitation in pre-employment screening
One of the key GDPR principles is data minimisation. This means that organisations should only collect information that is necessary for the role and for the purpose of the screening.
The appropriate level of screening can therefore differ significantly between positions. A check that is justified for a senior financial role, for example, may not be necessary for another type of position. Screening should therefore always be proportionate to the responsibilities and risks associated with the role.
The same principle applies once the information has been collected. Personal data obtained for a specific background check should only be used for the purpose for which it was obtained for a specific background check should only be used for the purpose for which it was collected, unless there is another valid legal basis for further use.
Candidates’ rights during pre-employment screening
Candidates retain their GDPR rights throughout the screening process. Organisations must therefore be transparent about how personal data is used and make it possible for candidates to exercise their rights where applicable.
Candidates have the right to receive clear information about how and why their personal data is processed and may request access to the personal data held about them. They may also request that incorrect or incomplete information is corrected. In certain circumstances, candidates can request deletion of their data or ask for the processing to be restricted.
Clear communication about these rights helps candidates understand the screening process and contributes to a transparent recruitment experience.
Storage and deletion of screening data
Screening data should not be kept indefinitely. Personal data may only be stored for as long as it is necessary for the purpose for which it was collected or where there is another valid reason to retain it.
The appropriate retention period depends on the type of screening information, the purpose for which it was collected, the outcome of the recruitment process and any applicable legal requirements or limitation periods.
Once there is no longer a valid reason to keep the information, it should be deleted. Organisations should therefore have clear retention and deletion rules in place for candidate and screening data.
Transparency in pre-employment screening: What candidates need to know
Candidates should understand what happens to their personal data during the screening process. Organisations must therefore provide clear and accessible information about the processing.
Candidates should be informed about who is responsible for processing their data, why the screening is being carried out, which legal basis applies and what types of personal data are processed. They should also receive information about who may receive their data, how long it will be retained and what rights they have under the GDPR. Where personal data is obtained from third parties, information about the source may also need to be provided.
The exact information and timing depend partly on whether personal data is obtained directly from the candidate or from another source. Providing this information is clearly an important part of a transparent and compliant screening process.
GDPR-compliant pre-employment screening with DISA
Managing background screening across different roles, checks and legal requirements can be challenging. DISA supports organisations with structured pre-employment screening processes designed to support compliance with the GDPR, the BDSG and the requirements of the German market.
With more than 25 years of experience in employment screening, DISA helps organisations manage the screening process while keeping candidate privacy and transparency at the centre. Our screening processes are designed to ensure that checks are relevant to the role and that personal data is handled securely throughout the process.
Clear candidate communication, structured processes and screening tailored to the requirements of each position help organisations avoid unnecessary or disproportionate checks while maintaining an efficient recruitment process.
Frequently asked questions about pre-employment screening and data protection
Pre-employment screening is permitted in Germany provided that the requirements of the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG) are met.
Each check must be based on an appropriate legal basis, serve a clearly defined purpose and be necessary and proportionate for the relevant position. Candidates must also be informed transparently about the processing of their personal data before screening begins. Where these requirements are met, pre-employment screening can be carried out in a GDPR-compliant and legally compliant manner.
Yes. Employers are required to inform candidates transparently about the processing of their personal data before pre-employment screening begins.
This includes, among other things, the purpose of the screening, the legal basis, the personal data being processed and the candidate’s rights under the General Data Protection Regulation (GDPR). Transparent communication is not only a legal requirement but also helps build trust and contributes to a GDPR-compliant pre-employment screening process.
Screening results may only be stored for as long as they are required for the relevant purpose. Once the data is no longer needed and there are no legal or contractual retention obligations, it must be deleted.
Organisations should therefore establish and document clear policies for the storage and deletion of screening data to ensure compliance with the General Data Protection Regulation (GDPR).