Guide and template for businesses that recruit
Background check routine
This guide is for organisations that want a clear and consistent approach to background checks when hiring. The first part explains what a background check is and why it matters. The second part is a template you can fill in and use as your own routine.
What is a background check?
A background check is a verification of information a candidate has provided, and of other relevant information, before hiring or assignment. It's usually done late in the recruitment process, when you've found the candidate you want to move forward with.
A background check can consist of one or more of these checks:
-
Identity verification -
Previous names check -
Verification of education -
Verification of employment -
CV gap check -
Reference check -
Open source search -
Specific source search -
Business interests -
Country affiliation check -
Credit check -
Criminal record certificate
Which checks are relevant is decided by the organisation based on the role.
Why is background checking important?
A hire is one of the most important decisions a business makes. The person hired gains access to colleagues, customers and systems, and often to assets or sensitive information. Yet the decision largely rests on what the candidate has stated in their CV, application and interview.
A background check means the decision doesn't rest on trust alone. It can reveal information that doesn't add up — for example, a degree that wasn't completed, or a role described differently from how it actually was. Just as important, it confirms what is accurate, so you can hire on a better foundation.
A consistent routine also creates a better process for candidates. Everyone is treated equally, they know what's happening, and findings are assessed fairly.
How to do it properly
- 1 Define the purpose. Why are you conducting background checks, and what should they contribute to?
- 2 Assess roles and checks. Determine which roles require checks and which controls to use. Only necessary information should be collected.
- 3 Establish legal basis. Where legitimate interest applies, the balancing of interests should be documented.
- 4 Inform the candidates. Ideally in the job advert, and always before the check begins.
- 5 Choose implementation. Conduct the checks yourself or use a supplier. If using a supplier, a data processing agreement must be in place.
- 6 Decide how findings are handled. Allow the candidate to explain before making a decision.
- 7 Set retention period. Information must not be stored longer than necessary.
- 8 Write it down. Gather everything in a written routine and review it regularly. The template in part 2 will help you with this.
Common mistakes
- All candidates receive the same check, without assessing whether the checks are necessary.
- The candidate isn't informed about the background check before it starts.
- No one is responsible for reviewing findings, so they sit there or get interpreted differently.
- Results are stored in multiple systems and never deleted.
Legal framework
The organisation is the data controller for the background check and must have a legal basis under GDPR Art. 6. Only information necessary for the purpose may be collected, cf. Art. 5, and the candidate must be informed, cf. Art. 13 and 14. The Working Environment Act and the Equality and Anti-Discrimination Act further limit what information an employer may request from applicants. A criminal record certificate may only be required where there is a legal basis. A credit check requires a specific legal basis that the employer has assessed and documented. Biometric data in document-based identity verification additionally requires the candidate's explicit consent, cf. Art. 9.
Ready to create your own routine?
The custom routine template guides you through ten steps.
The routine writes itself as you answer, and can be downloaded as a PDF.
Free template · 10 steps
Custom routine template
This template helps your organisation create its own background check routine for recruitment.
Takes about 15 minutes. You'll receive the finished routine as a PDF by email.
Link sent. Check your inbox.
Section 1 of
10
·
We've sent you a link. Your answers are saved in this browser.
Points to consider
- What tasks and responsibilities the position involves
- Access to assets, finances, systems or sensitive information
- Whether the position involves a particular position of trust, for example with children, patients or customers
- Whether law or regulation requires a check, for example a criminal record certificate
- Whether a less intrusive check provides sufficient grounds
A criminal record certificate can only be required when there is a legal basis.
Credit checkCredit checks require a legal basis, in practice a legitimate interest with a documented balancing of interests. According to the Data Protection Authority, the conditions are typically met when all these points apply.
- The position has a senior function.
- The position involves significant financial responsibility.
- The credit check is only conducted on applicants who are being considered in the final stage of the recruitment process.
Checks that may reveal information about criminal offences, health, political views, religion or similar require special consideration.
If you conduct the checks yourself, you should consider who has the competence and time, how sources are contacted, and how results are documented consistently for all candidates.
What
Where
Data retention period
The organisation should avoid storing copies of the results in more places than necessary.
Your routine is ready
A copy has been sent to
Job title
Checks
(0 selected)
Where
Data retention period