Personal Data in Background Checks and Criminal Record Screening

This page is a translation of the original Portuguese text, provided for convenience. It deals with Brazilian law. If there is any discrepancy, the Portuguese version prevails. Read the original in Portuguese

Background checks are a common market practice, but using personal data in the process requires strict compliance with the LGPD (Brazil’s General Personal Data Protection Law) to avoid serious privacy violations.

What a background check is and why it involves sensitive personal data

A background check (verificação de antecedentes) is the collection and analysis of information about an individual in order to assess risk before a hire, a business partnership, or a financial transaction. The practice is increasingly widespread in Brazil and covers everything from confirming basic registration data to searching criminal records, court cases, credit history, and professional references. What many organizations still do not fully grasp is that this procedure, by its very nature, handles categories of personal data that call for extra care under the Lei Geral de Proteção de Dados Pessoais (LGPD), Brazil’s General Personal Data Protection Law.

A typical background check includes registration data (name, CPF, address), financial data (credit score, delinquencies reported to credit bureaus), court data (civil and criminal cases) and, in some cases, data the LGPD classifies as sensitive, such as labor union membership or occupational health records. Each of these categories has its own processing rules, and combining them in a single report significantly increases the potential harm to the data subject in the event of misuse or a leak.

Personal data due diligence goes beyond simple screening. The organization conducting the background check must define the specific purpose of the collection in advance, identify the applicable legal basis, limit the scope of the information to what is strictly necessary, and keep the information secure throughout the entire processing life cycle. Skipping any of these steps can lead to administrative liability before the Autoridade Nacional de Proteção de Dados (ANPD), Brazil’s National Data Protection Authority, as well as individual and class action lawsuits.

Legal bases that apply to background checks

One of the most controversial points in conducting background checks is identifying the legal basis that authorizes the processing of the personal data involved. The LGPD sets out ten grounds that legitimize data processing, and choosing the wrong one can compromise the entire operation. In background checks, the legal bases most commonly invoked are the data subject’s consent, performance of a contract (or preliminary procedures related to a contract), the controller’s legitimate interest, and the regular exercise of rights in judicial or administrative proceedings.

Consent may seem like the most intuitive solution, but it has important weaknesses in this setting. In employment relationships, for example, there is a power imbalance between employer and candidate that can undermine the voluntariness of consent and potentially make it invalid. A candidate who refuses a background check fears (rightly so) being dropped from the hiring process. That amounts to a veiled form of coercion, which is incompatible with the freely given consent the law requires.

The legitimate interest basis, provided for in Article 7, item IX of the LGPD, tends to be sturdier in these situations. It works best when accompanied by a Relatório de Impacto à Proteção de Dados Pessoais (RIPD), a data protection impact assessment, and by a balancing test showing that the controller’s interests do not override the data subject’s fundamental rights. Organizations that take this approach are generally able to justify the need for a background check more consistently, especially when the position or transaction involves concrete risks (fiduciary roles, access to confidential information, large-scale financial transactions).

A legitimate background check is not one that collects as much information as possible. It is one that collects only what is strictly necessary for the stated purpose, with an appropriate legal basis and transparency toward the data subject.

For any sensitive data included in the check, the LGPD imposes even stricter limits. Article 11 restricts the processing of such data to specific situations, and consent, when used, must be given in a prominent manner and refer to specific purposes. Collecting criminal records, for example, is justified only when the law expressly provides for it or when the nature of the work calls for that check in a proportionate and reasonable way.

LGPD principles applied to the due diligence process

Background checks must strictly observe the principles listed in Article 6 of the LGPD, which serve as interpretive guideposts for all processing of personal data. Below are the principles most relevant to this activity and their practical implications.

Purpose and suitability

The purpose principle requires that data collected for a background check serve legitimate, specific, explicit purposes that have been communicated to the data subject. It is not enough to say in general terms that the check is meant to ensure “security” or “reduce risk.” The organization must specify which risks it intends to mitigate and show that the information collected is compatible with that stated purpose. A company that runs a criminal background check to fill an administrative assistant position, with no specific justification tied to the role, will likely violate the suitability principle.

Necessity and data minimization

We regard the necessity principle (also known as data minimization) as the most challenging in background check practice. It requires that processing be limited to the minimum necessary to achieve its intended purpose. This means the organization must assess, item by item, whether each piece of data requested is truly indispensable. Pulling the credit history of a candidate for a position that carries no financial responsibility, for example, is excessive and disproportionate collection.

Transparency and free access

Data subjects have the right to know that they are undergoing a background check, what information is being collected, which sources are being consulted, and how the results will be used in decision-making. Transparency is not just a legal obligation. It also builds trust between the parties. We have observed that organizations that clearly communicate their screening procedures tend to face fewer challenges and less litigation.

Legal risks and best practices in background checks

Conducting background checks improperly can have significant legal consequences on several fronts. Administratively, the ANPD can impose sanctions ranging from warnings to fines of up to 2% of the company’s revenue (capped at R$ 50 milhões per violation). In labor law, discriminatory screening can amount to moral damages, especially when it leads to the unjustified rejection of candidates based on information irrelevant to the job. In civil law, misusing personal data in due diligence can create an obligation to pay compensation for violating the data subject’s privacy and honor.

To reduce these risks, we recommend a set of best practices that we consider essential for any organization that conducts background checks on a regular basis.

First, it is critical to draft an internal background check policy that clearly defines which checks are performed for each type of position or transaction, which legal bases support each category of inquiry, and what objective criteria will be used to evaluate the results. This policy should be reviewed periodically and be accessible to the employees responsible for the process.

Second, preparing a Relatório de Impacto à Proteção de Dados Pessoais (RIPD) is strongly recommended, especially when the background check involves sensitive data or large-scale processing. The RIPD documents the risk analysis, the mitigation measures adopted, and the balance between the controller’s interests and the data subject’s rights, serving as an accountability tool before the ANPD.

Third, setting retention periods is indispensable. Data collected during a background check should not be kept indefinitely. For unsuccessful candidates, we recommend deleting the data within a reasonable period after the hiring process ends (while respecting any limitation periods for legal challenges). For employees who are hired, relevant data may be kept for the duration of the employment contract and deleted afterward, in compliance with the applicable legal deadlines.

Finally, information security deserves special attention. Background check reports concentrate highly sensitive information about data subjects and should be protected with strict access controls, encryption, and access logs. Sharing these reports should be limited to the professionals directly involved in the decision, avoiding unnecessary circulation of personal information within the organization.

The role of the data protection officer (DPO) in background checks

The encarregado de proteção de dados pessoais, or data protection officer (DPO), plays a strategic role in structuring and overseeing background check processes. The DPO advises the organization on the applicable legal bases, reviews internal background check policies, assesses the proportionality of the checks performed, and serves as a communication channel among the organization, data subjects, and the ANPD.

When data subjects who feel harmed by a background check file a complaint, the DPO must be prepared to demonstrate that the process was compliant. That means presenting documentation that proves the legal basis used, the purpose of the collection, the security measures adopted, and adherence to the minimization principle. The absence of this documentation can significantly worsen the organization’s position in any inspection or lawsuit.

The regulatory trend, both in Brazil and in international jurisdictions, points to progressively stricter compliance requirements for due diligence processes involving personal data. Organizations that get ahead of these requirements by investing in data governance and structured background check processes are better protected against the regulatory and reputational risks inherent in this activity.

This topic is directly related to data mapping, which we cover in a dedicated article.

This topic is directly related to retention and deletion of personal data, which we cover in a dedicated article.

As informações deste artigo são de caráter informativo e não substituem consulta jurídica individualizada. Cada caso possui particularidades que exigem análise específica.