Criminal-record checks in recruitment: the Article 10 GDPR special rule

An employer wants an applicant to provide a criminal-record certificate. The question is not simply whether the document can be uploaded. Information about criminal convictions and offences is subject to a special rule under Article 10 GDPR. The fact that a role is sensitive does not, by itself, answer whether the check is lawful.

This article explains how to assess the request in recruitment. It focuses on the actual job, the additional protection required by Article 10 GDPR, the necessary scope, the handling of the certificate and an accountable decision process. Biometric access controls, general employee-data permissions, data protection impact assessments and retention periods are separate subjects.

Article 10 GDPR covers personal data relating to criminal convictions and offences and related security measures. Such information cannot be processed merely because it appears useful for a hiring decision. Article 10 requires processing under the control of official authority or processing authorised by Union or Member State law that provides suitable safeguards for the rights and freedoms of the data subject.

A criminal-record certificate therefore cannot be treated like an ordinary CV detail. The assessment depends on the document, the concrete purpose and the legal basis for the check. The question whether the employer only views the certificate or stores a copy is part of the same assessment.

The special rule applies beyond the moment of the request. It also matters for internal sharing, filing, the decision on the application and any later use of the information. The employer should describe the process before the first request, not only after a dispute.

Every processing operation first needs a legal basis under Article 6(1) GDPR. For data about convictions and offences, that first level is not enough. Article 10 adds further conditions. The assessment should therefore identify both levels and connect them to the same specific role.

A general consent clause in an application form or a reference to legitimate interests does not automatically remove the Article 10 issue. Nor does a general internal security policy. The organisation must assess whether Union or relevant Member State law permits the processing for this purpose and which safeguards protect the applicant’s rights.

The answer may differ with the duties, responsibility and applicable special rule for the role. An employer should not infer from an earlier hiring practice that every similar applicant may be asked for a certificate. The actual job and the legal basis must remain traceable.

Before asking for the certificate, the organisation should describe the job in practical terms. Which duties are performed, what position of trust exists and which concrete risk is the information meant to assess? The clearer the purpose, the more reliably necessity and scope can be evaluated.

A request to every applicant can lose its connection to the role. This is especially true where the duties have no understandable link to the information requested. HR should therefore avoid asking for more than the specific purpose requires and record why a general routine check is not being used.

The choice of document also matters. The employer should ask whether a limited confirmation is sufficient or whether a complete certificate is genuinely required. Unnecessary details must not be processed simply because they appear on the form. Scope belongs in the same record as purpose.

Criminal-offence information should not sit in a recruitment folder that everyone can open. The employer should define who receives the certificate, who may view it and who makes the professional decision. HR, managers and external providers do not automatically need the same access.

The record should show the reason, the role, the legal bases, the scope of the request, the information given to the applicant and the outcome. Articles 5(2) and 24 GDPR require demonstrable responsibility. Article 32 GDPR also requires safeguards appropriate to the risk of the processing.

Possible measures include separate permissions, personal accounts, traceable access logs and a restricted storage location. A shared inbox or uncontrolled forwarding to several decision-makers makes review harder. The article on documenting technical and organisational measures provides a useful related framework.

Before providing the certificate, the applicant should understand why it is needed, which role is concerned and how the information will be used in the selection process. A person should not learn about the processing only through an unexpected email or an unclear upload form.

The information should also identify the responsible organisation, the recipients or recipient categories and the main rules for handling the document. It must fit the actual procedure. A general privacy notice does not replace a clear explanation of the immediate recruitment step.

If a recruitment agency or another business is involved, the roles and transfers need a separate assessment. The information should not conceal who actually receives the certificate or whose decision it supports. A change to the selection process requires a fresh review.

If the job connection or the additional legal protection is missing, the employer should not continue to request the certificate as a routine. First assess whether the selection process can be conducted lawfully and fairly without this information. A less intrusive alternative should be evaluated against the actual duties rather than simply asserted.

If an applicant refuses to provide the certificate, distinguish the lawfulness of the request from the consequences for the application. The organisation should not apply an automatic outcome without considering the documented purpose, legal basis and actual requirements of the role. The decision must not rest on unclear or unnecessary additional information.

An entry in a certificate does not automatically answer whether the person is suitable. The role, the applicable safeguards and the information genuinely needed for the decision must be assessed. The outcome should therefore follow a controlled, access-limited process rather than an unexplained note in the application file.

General security wording instead of a role connection: The organisation asks every applicant for a certificate without describing the duties and risk.

Article 6 is confused with Article 10: A general legal basis is recorded, but the additional rule is not assessed.

Full copy without necessity: The complete document is stored even though a narrower confirmation might be enough.

Too many recipients: The certificate is sent to a shared mailbox or several managers although one responsible function needs it.

Automatic outcome: Providing no certificate, refusing it or showing an entry triggers a standard rejection without an individual assessment.

Start with the job description and identify the specific duty for which criminal-offence information might matter. Then record which data are actually needed, who receives them and how the recruitment decision will be documented.

Assess Article 6 GDPR and Article 10 GDPR separately. The record should show what supports the additional permission and which safeguards protect the applicant. If one of these questions remains open, obtain a focused legal assessment before making the request.

The final file should contain clear applicant information, a limited transfer route, personal access and a consistent decision record. For general access requests and copies of personal data, see the related article on Article 15 GDPR access requests. Its framework does not replace the special check for criminal-record certificates.

We review the connection to the role, the Article 6 and Article 10 GDPR assessment, the necessary scope, applicant information and internal access and decision rules. Send us the job description, the planned recruitment process and the proposed information text. Receive new articles and legal guidance from the firm through BRANDaktuelle Rechtsnews. Subscribe to the newsletter.