You can verify the data provided by the candidate as well as check publicly available records.

Verification may also include checking the authenticity of the documents submitted during the recruitment process. 

According to the President of the Personal Data Protection Office, obtaining information about a candidate from a previous (or current) employer by an employer requires the candidate's consent.

Regarding other so-called ordinary data, the basis for processing will be the legitimate interest of the controller (Article 6(1)(f) GDPR). 

We believe that the information provided by the candidate that he or she has never had a criminal record is not data relating to criminal convictions and offences, as referred to in Article 10 of the GDPR. Thus, also such information can be processed on the basis of the controller's legitimate interest.

In each case, however, background screening should be justified for the specific position or responsibilities of the prospective employee.

This tool cannot be applied arbitrarily to all job groups, but should be used taking into account the principles of proportionality and adequacy, i.e. it will be unacceptable, for example, to verify the number of dependents or past illnesses.  

Find more in the PRO HR October 2022.