The impact of the GDPR on background screening in the UK

This paper seeks to focus on the practical implications of General Data Protection Regulation (GDPR) compliance for employers who conduct pre-employment vetting. While it is primarily focused on the employer, it does also give mention to the vetting companies themselves. The focus is on the main areas of impact of the GDPR and is not an exhaustive analysis of the topic. These include: (1) lawful basis for processing; (2) the use of criminal record checks; (3) contracts and legal obligations of employers; (4) data subject (candidate) rights; and (5) data retention. Particular focus is given to material changes from the existing Data Protection Directive to GDPR and how employers and vetting companies may need to adapt their existing processes and procedures to maintain compliance.