Background checks for international hiring: a compliance guide

Running a background check on a candidate in your home market feels routine. Running one on a candidate in another country is a different exercise entirely. What you are allowed to check, when you can check it, how you must handle the data, and what the candidate must consent to all vary by jurisdiction. In some countries, checks that are standard practice elsewhere are restricted or outright prohibited.

If you are hiring internationally, understanding these differences is essential. Getting it wrong can delay your hire, expose you to data protection penalties, or create legal liability before the employment relationship has even started.

In the US, pre-employment screening is a well-established industry. Criminal records, credit history, education verification, employment history, drug testing, and social media screening are all common, and there is a developed legal framework (including the Fair Credit Reporting Act) governing how these checks are conducted.

Outside the US, the picture changes. Many countries restrict what employers can verify, and the restrictions are often tied to the principle of proportionality. The check must be relevant to the role, and the employer must be able to justify why it is necessary.

In Germany, employers can ask about criminal history only where the role genuinely requires it, and the candidate has the right to answer untruthfully about spent convictions. In France, criminal record checks are limited to specific regulated professions. In Japan, employers rarely conduct formal background checks, and social norms discourage intrusive screening processes.

The starting point in any international hire should be to ask what is legally permitted in the candidate’s country before deciding what to check.

Criminal record screening is one of the most common pre-employment checks, but it is also one of the most restricted outside the US.

In the UK, the Disclosure and Barring Service (DBS) provides criminal record checks at different levels depending on the role. Basic checks are available for any role, but standard and enhanced checks are restricted to positions involving regulated activities such as working with children or vulnerable adults. Employers who request a higher level of check than the role warrants risk breaching the Rehabilitation of Offenders Act.

In the EU, GDPR and national implementing legislation create additional constraints. Criminal record data is classified as a special category under GDPR Article 10, meaning that processing is only permitted where authorised by law. In practice, this limits criminal record checks to roles where national legislation explicitly allows them.

In Canada, employers can request a criminal record check, but the Canadian Human Rights Act prohibits discrimination based on a pardoned offence. Several provinces have additional protections for candidates with criminal records.

In Brazil, criminal record checks are generally permitted, but employers who refuse to hire a candidate solely based on a criminal record risk claims of discriminatory practice under Brazilian labour law.

The pattern across jurisdictions is consistent. Criminal record checks are permitted in specific circumstances, but blanket screening of all candidates regardless of role is either restricted or carries legal risk.

In the US, employer credit checks are common for roles involving financial responsibility. The FCRA requires the candidate’s written consent, and several states have additional restrictions.

Internationally, credit checks for employment purposes are far less common and in many jurisdictions are effectively prohibited.

In the UK, credit checks are available through credit reference agencies, but the Information Commissioner’s Office (ICO) guidance is clear that they should only be used where financial probity is directly relevant to the role. Running a credit check on a candidate for a non-financial position is difficult to justify under data protection law.

In Germany, credit checks for employment purposes are generally not permitted. The Schufa (Germany’s main credit reference agency) does not provide employment screening reports, and requesting financial information from a candidate beyond what is directly relevant to the role risks violating the Bundesdatenschutzgesetz (Federal Data Protection Act).

In Australia, employers can only conduct credit checks for roles that involve financial dealings, and the candidate must provide explicit consent.

Employers accustomed to running credit checks as standard should expect that this practice will not transfer to most international markets.

GDPR and equivalent data protection frameworks fundamentally affect how background checks can be conducted on candidates based outside the US.

The core principles are lawfulness, purpose limitation, data minimisation, and transparency. Applied to background screening, this means that you need a lawful basis for processing the candidate’s personal data (consent alone may not be sufficient in an employment context where there is a power imbalance), you can only collect information that is proportionate to the role, and you must inform the candidate about what data you are collecting and why.

In the EU, this creates practical requirements. Candidates must receive a privacy notice before any screening begins. The employer (or their screening provider) must be able to demonstrate that each check is necessary and proportionate. Data must be stored securely and deleted when no longer needed for the stated purpose.

Cross-border data transfers add another layer. If your screening provider is based in the US and the candidate is in the EU, you need a valid data transfer mechanism in place. Standard contractual clauses, adequacy decisions, or binding corporate rules may be required depending on the circumstances.

In countries with their own data protection frameworks, such as Brazil’s LGPD, South Korea’s PIPA, or India’s DPDP Act, similar principles apply with local variations.

The practical takeaway is that data protection compliance is not a secondary consideration in international background screening. It is the framework within which all screening activity must operate.

Verifying a candidate’s qualifications and employment history sounds simple. In practice, it varies by country.

In some countries, universities and former employers respond promptly to verification requests. In others, cultural norms, privacy laws, or administrative processes make direct verification slow or impossible.

In China, education verification is available through the China Higher Education Student Information and Career Center (CHESICC), but the process requires the candidate’s cooperation and can take several weeks. In Germany, former employers are legally required to provide a reference (Arbeitszeugnis), but the content follows a formalised structure that is deliberately neutral, making it difficult to assess actual performance.

In Japan, contacting a candidate’s current or former employer without their explicit permission is considered a serious breach of professional etiquette and could expose the employer to legal action.

In India, verification is common and widely accepted, but response times from institutions and former employers vary and third-party verification agencies are often used to manage the process.

Employers should budget additional time for international education and employment verification and should always secure the candidate’s explicit consent before contacting any third party.

Before screening any international candidate, take the following steps.

First, identify what checks are legally permitted in the candidate’s country for the specific role you are hiring for. Do not assume that your domestic screening package applies elsewhere.

Second, assess whether each check is proportionate. Can you demonstrate why it is necessary for this particular role? If you cannot, the check may not be lawful.

Third, ensure that your privacy notices and consent forms meet local requirements. A single global consent form is unlikely to satisfy the specific requirements of every jurisdiction.

Fourth, choose screening providers who understand the legal requirements in each country. An international provider with local expertise will be able to advise on what is and is not permitted.

Fifth, build additional time into your hiring process. International background checks consistently take longer than domestic ones, and rushing the process increases the risk of non-compliance.