21 September, 2026
Can employers carry out background checks?
Yes, employers can carry out background checks as part of the recruitment process. There is no general prohibition on checking information about a candidate, but which checks are appropriate and permitted depends, among other things, on the information being checked, the purpose of the check and the role in question.
A background check may, for example, involve verifying a candidate’s identity, education or employment history. For certain roles, other checks may also be relevant, such as a credit check or criminal record check.
Can employers carry out the background check themselves?
Yes, employers can carry out certain parts of a background check themselves. However, it is important to bear in mind that a background check involves the processing of personal data and may include information of a sensitive nature. Any personal data collected and processed as part of the check must therefore be handled in accordance with the GDPR.
Who can check information about criminal offences?
When a background check includes information about criminal offences, specific rules apply. This type of personal data is covered by Article 10 of the GDPR and cannot be freely processed by private companies.
Public authorities may process such information where there is a legal basis for doing so. Private organisations require specific legal grounds for the processing. This may, for example, be provided for by law or regulation, or through a specific permit from the Swedish Authority for Privacy Protection (IMY).
It is important to check what each permit covers, as the conditions may differ between providers.
DISA Global Solutions has a permit from IMY to process personal data relating to criminal offences as part of pre-employment background checks.
Want to learn more about how the GDPR affects background checks during recruitment?
In our white paper, GDPR-compliant background checks, we explain the fundamental rules for processing personal data and provide practical guidance on what employers need to consider.
Can an external provider carry out background checks?
Yes, employers can engage an external background screening provider to carry out all or part of the background check. This can be a good option for organisations that want a structured and consistent process, as well as access to specialist expertise across different types of checks.
However, engaging an external provider does not change the requirements for how candidates’ personal data may be processed. Background checks must still be carried out in accordance with the GDPR and any other rules that apply to the information being checked.
Membership of Bakgrundskontrollföretagen (BKF)
When choosing a provider, it is important to check whether the company is a member of Bakgrundskontrollföretagen (BKF). BKF is the Swedish industry association for companies that work professionally with background checks and sets common requirements for its members.
As a member, a company must follow BKF’s ethical guidelines, including:
- Safeguarding the integrity of all parties.
- Treating all information confidentially.
- Providing services to clients such as companies, public authorities and organisations.
- Reporting only relevant information.
- Not reporting sensitive information that could form the basis for discrimination.
- Having established policies and procedures for handling and processing personal data in accordance with the GDPR.
- Having appropriate technical and organisational security measures in place to protect personal data.
DISA Global Solutions is a member of BKF and follows the association’s common standards and ethical guidelines.
Frequently asked questions
Yes. The candidate must be informed about the processing of their personal data, including what information is being processed, why it is being processed and how it will be used. We recommend that employers are transparent from the outset, including in the job advert, that a background check forms part of the recruitment process.
It depends on the organisation, the role and how the check is carried out. Information relating to criminal offences is subject to specific rules under Article 10 of the GDPR.
No, consent is not always required. However, there must be a lawful basis under the GDPR for processing the candidate’s personal data. For private-sector employers, this may, for example, be a legitimate interest, where the employer’s need is balanced against the candidate’s right to privacy.
This depends on the purpose of the check and the role in question. Checks should be relevant to the role, and the personal data processed should be limited to what is necessary.
Want to learn more about background checks?
Do you have questions about which background checks are right for your organisation or how to create a structured process? Fill in the form and we’ll get in touch.