Background Check

What can a background check include?

A background check draws on sources chosen for a particular decision. An employment review might confirm a person's stated qualifications, examine a particular record, or do both. Each component answers a narrower question than “Has this person passed a background check?”

Identity, work history, education, and credentials

Identity information helps connect a claimed job, qualification, or record to the person being considered. A name alone can point to someone else: the FTC's guidance for employment screening companies gives a wrong-person record with a different middle name or date of birth as an accuracy example. Confirming identity for a search does not, by itself, establish permission to work or satisfy a separate eligibility check.

Work history and education are separate facts to verify. A hiring team might need to confirm a stated employer and period of work, or whether a claimed qualification was awarded. The FTC and EEOC describe work history and education among the information a US employer might seek, but that list does not make either check necessary for every role. The request should identify the particular claim and a source able to confirm it. Confirmation of one job or award says nothing about unrelated periods of work, performance, or other qualifications.

For a UK doctor role, the General Medical Council's online register gives current registration information; a certificate issued earlier shows the status at that earlier date. The register also shows whether the doctor holds a licence to practise. A buyer should match the entry to the intended person and check both facts needed for the role. Neither a generic report nor an old certificate establishes current licence status merely by naming the person. This is a UK medical-register example, not a method that automatically applies to every profession.

Criminal records and other role-specific sources

A criminal-record check searches a defined record system, under rules that depend on the place and the role. For example, England and Wales use different DBS check levels, with eligibility limits on the more detailed levels. Germany's certificate of conduct concerns entries in its register; an enhanced certificate has specified purposes and requires a written request confirming eligibility. Neither product is a general search of every possible criminal record. Before ordering one, identify the relevant country, the record source and the level the role permits.

Other sources address other tasks. A role involving driving may give the buyer a reason to request a motor-vehicle record, while that source may have little to say about a role with no driving duties. In the US, a credit report describes credit activity, such as account balances and payment history. The CFPB lists a credit check as one possible employment-screening input, separate from criminal records or employment history. Its availability does not mean every hiring decision calls for it, nor does the report alone establish a person's overall financial trustworthiness.

A reference is another distinct source. In UK recruitment, an Acas work-reference request can ask a former employer to confirm a stated position and employment dates; a more detailed reference depends on what the referee agrees to provide. Acas advises seeking the applicant's permission before contacting a current employer, and a referee is not necessarily obliged to answer. A reference therefore has a different source and limit from an official criminal certificate, and employee-reference practice should not be assumed mandatory for a self-employed contractor engagement.

The FTC and EEOC also list social media as information a US employer might seek. An accessible post still needs a reliable connection to the person and a reason it bears on the work; its visibility alone does not justify routine collection. In the EU, processing criminal-conviction data has additional legal conditions, so mere availability of a record is not authority to collect it.

Drug or alcohol testing is another possible component, not a routine part of the term “background check.” The CFPB's profile of one screening company lists it alongside driving records; that describes a service offering, not a rule for every job. A buyer should decide whether the actual duties and applicable rules call for that separate test before requesting it.

Permission to work is a different question from criminal history or qualifications. Where the UK Home Office's prescribed right-to-work process applies to a working arrangement, a general screening report or DBS certificate does not by itself complete that process. The contractual scope and available method require their own assessment.

Public-record search versus an employment report

A direct record lookup, a consumer people-search report, and a report assembled for an employment decision may repeat the same item, but each obtains or presents it differently. A direct request tells you what the named system returned: for example, Pennsylvania's state-police search uses Pennsylvania law-enforcement records and excludes federal records. The FTC explains that US people-search sites may combine bought broker data, public social-media information and government records into a report. Such a report can repeat an official record without being the originating record, so check its cited source and match to the person. A screening company preparing an employment report may combine still other inputs, including credit, criminal, public-record and work-history checks, as the CFPB explains. None of these routes guarantees a complete personal history.

For US hiring, a consumer-facing label or the use of public records does not by itself settle whether a third-party report is covered by the Fair Credit Reporting Act. The FTC says a company furnishing reports for hiring may be a consumer reporting agency even if it does not call itself one; covered reports containing courthouse records still have FCRA duties. The provider's activity, the report and its intended use need to be assessed for the particular applicant or employee decision. When an employer obtains a covered report from a screening company, the FTC and EEOC require a stand-alone disclosure and written permission beforehand. A direct government-record request does not automatically follow that same route, and independent-contractor coverage needs its own analysis. Before an adverse decision based on a covered report, the employer must provide the person with a copy and Summary of Rights; later notice and dispute steps are separate.

Suppose an online result appears to match a candidate by name. Before treating it as grounds to reject them, check the underlying source and identifying details, then establish whether the service and intended use fall within the covered employment-report process. The FTC identifies wrong-person criminal entries as a report-accuracy problem. In the covered report route, the person can dispute inaccurate or incomplete information with the reporting company; a public-site screenshot does not by itself establish that the same correction route applies.

How does a background check work?

First identify the question and an appropriate source. The requester then provides the information needed to search for the right person and reviews what that source returned. Required notices depend on the type of check and where it is used.

Define the purpose and choose the sources

Before ordering anything, identify the decision, the role's actual duties and the fact that could inform it. If someone will drive for work, a driving-record source may answer a relevant question. If the concern is a claimed professional credential, a criminal-record search will not confirm it. A useful request names the fact to check, the country or record system that holds it, and the reason the result matters; it does not ask for every item in a vendor's package.

The chosen source also determines what the check can establish. For an England or Wales role, GOV.UK ties the level of a DBS criminal check to role eligibility. If a UK doctor role calls for confirmation of a current licence, the General Medical Council's register answers that credential question more directly than a criminal certificate. Those are separate enquiries, even when a business orders both. Where a prescribed right-to-work process applies to a defined UK working arrangement, that process needs its own route rather than a substitute general report.

Purpose also limits what personal information the requester should collect. In the UK, the ICO's current data-protection principles require a specified purpose and data limited to what is relevant and necessary for it. The EU framework likewise calls for a legal basis and purpose-limited, necessary data, with additional conditions for criminal-conviction information. A public record's availability does not settle whether a particular business should collect or use it. The planned decision, source and applicable rules must be identified first.

Collect information and confirm identity

The person and the requester provide the identifiers that the chosen source actually needs. Those details connect the enquiry to the intended individual and, where relevant, to the records for an address or period of residence. Requirements differ by route. For example, a person requesting their own basic DBS check in England or Wales must prove their identity through GOV.UK One Login and provide five years of address history. That is the input for this particular check, not a document list for every background search.

A name match needs checking before a result is treated as the person's history. The FTC describes a US screening report that attached another person's conviction despite a different middle name or date of birth. The requester should use the source's available identifiers to resolve an uncertain match, rather than assuming a name hit is conclusive. Proving who someone is also leaves separate qualification and work-eligibility questions open.

The notice and permission step depends on how the information will be obtained and used. For a covered US applicant or employee report from a background-screening company, the FTC and EEOC require a stand-alone written disclosure and written permission before the employer obtains the report. That procedure is not a universal form for direct public-record requests or every contractor engagement. Nor does permission for one report by itself establish a legal basis to collect any sensitive data: in the EU, criminal-conviction information has additional conditions. Select the route and its rules before asking the person for information.

Review results and resolve discrepancies

Read each result against the question that prompted the check. Identify the underlying source, when its information was recorded or confirmed, and whether the identifiers match the intended person. A name-matched criminal item with a different date of birth or middle name needs further checking; the FTC identifies wrong-person convictions as an accuracy problem in US employment screening reports. The next step is to examine the source record and the report's match, rather than treating an uncertain hit as a final finding.

Accuracy and the hiring decision are separate questions. In the covered US report route, the person can dispute inaccurate or incomplete information with the reporting company. The employer still has to assess what a verified item means for this role. US federal guidance calls for equal treatment and job-related assessment when using background information; a criminal entry alone should not be treated as an automatic rejection rule. A disputed public-source item may require a different correction route, so the requester should find where the information originated rather than promising that a screening company can erase every copy.

When a US employer is considering an adverse decision based on a covered third-party report, the FTC and EEOC say the person must receive the report and FCRA Summary of Rights before that decision. If the employer then takes the action, a separate notice and dispute information follow. This decision-stage sequence is distinct from the permission required before obtaining the report; it should not be applied automatically to every direct search or contractor engagement.

How should a business choose checks for an employee or contractor?

Choose each check for the work, its location and the question the source can answer. An employee or contractor label alone does not identify the right record source or settle which local rules apply. The actual engagement and decision determine which components belong in a screening request.

Limit the scope of personal-data collection

For a UK screening purpose, the ICO's current data-protection principles require a specified purpose and personal data that is relevant and limited to what is necessary for it. This makes source selection a question about the data a check will expose as well as the answer it might provide. A public record or social post can be accessible without every detail in it being needed for a hiring decision.

The EU framework also requires a legal basis and purpose-limited, necessary processing. Criminal-conviction information has additional conditions under that framework. Defining a purpose or obtaining a person's permission does not alone make every category of sensitive information available for collection. The applicable rule and the person's actual engagement need to be examined before the request is made.

For example, before ordering a broad public-record or social-information package for a UK role, name the precise decision it would inform and the facts needed to make it. If the question is whether a UK doctor's licence is current, the GMC's medical register answers that narrower question; unrelated personal history can be left out of the request. This is a way to apply purpose and data minimisation to the chosen source, not a categorical ban on public-record checks.

Match each check to the role and location

Map each proposed check to a duty or eligibility requirement, then identify the source available in the place where the work will be done. A role involving driving can raise a motor-vehicle-record question; a US credit report describes credit activity and answers a different one. For an England or Wales criminal-record check, the DBS level depends on the role's eligibility. The mere availability of any of these sources does not make it relevant to every role or give the requester authority to obtain it.

For contractors, the actual arrangement also matters. Requesting a background check does not decide whether the person falls within an employment-law category or which rules govern the use of their data. For example, Germany's current BDSG §26 addresses applicants and specified employee-like groups; whether a particular independent contractor is covered cannot be read from the word “contractor” alone. The business must assess the engagement and the applicable basis before using an employment-data route.

A generic contractor screening order may miss a separate UK right-to-work requirement. Under the Home Office checklist updated 1 October 2026, the prescribed-check route includes a defined individual sub-contractor: an individual contracts with one person to provide work or services, while that person contracts with a third party to provide or arrange those services and the individual does not contract with that third party. A business engaging someone through an intermediary should compare the actual contract chain with that definition, alongside the checklist's employment and worker-contract categories. Other contractual arrangements require a separate look at the Home Office employer guide's extended-liability rules; the individual-subcontractor provision does not cover every independent contractor.

Where the checklist's prescribed route applies, the employer must use an available manual-document, Home Office online or registered digital-verification method to establish its statutory excuse; it must give the individual a reasonable opportunity to use an available prescribed method rather than insist on one preferred method. A generic background report or DBS criminal certificate does not itself perform that right-to-work check. Separately, a DBS request needs its own role-based eligibility assessment. The two branches answer different questions even when both are relevant to one engagement.

Caption: UK Home Office checklist updated 1 October 2026. The individual-subcontractor definition is specific; other contracts need separate analysis. A DBS criminal check has distinct role-eligibility rules and does not replace right-to-work steps. UK Home Office: Employers' right to work checklist · GOV.UK: Criminal record checks by role

Plan for cross-border record gaps

Map the periods and countries the chosen source can actually cover. A domestic criminal certificate can answer a local record question while leaving a period abroad unexamined. In the UK, GOV.UK explicitly says a DBS check does not cover time a person lived outside the UK. For a candidate who previously lived in another country, identify that period before interpreting the DBS result; GOV.UK points to the country of residence or its embassy as a possible next source, without guaranteeing that a suitable certificate can be obtained.

A German certificate of conduct under BZRG §30 concerns the applicant's entries in the federal register. A separate European-certificate route under §30b applies under specified nationality conditions, and information from another state depends on that state's response. An ordinary German certificate should therefore not be described as a complete foreign-history search. That does not mean every German certificate excludes every foreign entry.

For each relevant foreign period, the buyer should ask which authority holds the records, whether a lawful and available route exists, and what the returned document would cover. An “international” package label cannot answer those source questions by itself. Record any unsearched period as a limit of the result, then make the role decision with that limit visible rather than treating a local no-record response as worldwide clearance.

What can a background-check result fail to prove?

A result describes what the chosen source returned for the identifiers used. It can be accurate within that scope while leaving other records, periods or questions untested. Before treating a clear or adverse result as conclusive, check what was searched and how the person was matched.

A no-record result has a source and geographic limit

“No Record” means the queried system returned no matching entry under its search rules. It does not establish that the person has no history in every other system. The practical question is which custodian, jurisdiction, record type and identifiers produced the answer.

The limit is concrete in Pennsylvania. Its State Police criminal-history service can return “No Record,” but it searches Pennsylvania law-enforcement records and excludes federal records. A person could therefore receive that response even though the service did not ask a federal or another state's source. The response makes no assertion about those unsearched systems; it also does not imply that such a record exists there.

In the UK, GOV.UK says a DBS check does not cover time lived outside the UK. If the role decision needs to account for such a period, identify it and assess whether an appropriate country-specific route is available. For any negative result, note the record system, its geography and the period or identifiers used before deciding whether another relevant source is needed. A broader check still needs its own purpose and lawful basis.

Reports can be incomplete, outdated, or matched to the wrong person

A report can contain an item yet still misstate what it says about the person today. In US employment screening, the FTC flags wrong-person convictions, duplicate entries and expunged or sealed records as accuracy concerns. A shared name is not enough to confirm a match when stronger identifiers, such as middle name or date of birth, differ. Duplicate or old entries also call for a check of the originating record and its date before anyone relies on the report's summary.

A disputed item should be traced to its source record and any report that copied it. A US people-search site may assemble broker, social-media and public-record information, while an employment screening company may prepare a report for a specific hiring use. If an item is unclear, identify where it originated, compare that record with the report's identifiers and current status, and ask the service or source how to contest an error. The fact that information appears in more than one place does not prove that every copy is current or belongs to the same person.

For a covered US employment report, a person can dispute inaccurate or incomplete information with the reporting company. The employer should take that accuracy question into account before relying on a disputed item for its decision. A screenshot from a public site or a different country's certificate may require a different correction route. No single request guarantees deletion of every online copy; establish the source and the applicable rights before promising a remedy.

Timing and lookback vary by source and jurisdiction

There is no single completion time for a “background check.” Each requested component follows its own source process, and a request needing further investigation can take longer. Pennsylvania's state criminal-history service, for example, says some online no-record results return immediately, while a request marked under review may take two to four weeks. Those are estimates for that service, not a timetable for a multi-source employment report, a DBS check or a search in another country.

“How far back?” also has several meanings. It may refer to the records a custodian holds, what a particular certificate displays, or what an applicable rule permits a requester to receive or use. In England and Wales, a basic DBS check shows unspent convictions and conditional cautions, while more detailed levels can show spent records for eligible roles. Germany's BZRG §33 sets periods after which certain convictions no longer appear on a certificate of conduct, subject to its exceptions. Neither example supplies a worldwide number of years for all criminal searches, and a certificate-inclusion rule is a different question from retention of the underlying record.

Even an application input can be mistaken for a lookback limit: an England or Wales basic DBS applicant supplies five years of address history, which does not mean the certificate covers exactly five years of criminal history. Before setting an expected start date or buying a package, ask which components are included, which source and region each covers, what is still pending, and what inclusion or reporting rules govern the result. Record those answers separately instead of treating a provider's overall estimate or a single year count as the meaning of every check.

Which rules and rights change by jurisdiction?

The rules depend on where the decision is made, which source supplies the information and who is being checked. A US employment report, an England or Wales DBS certificate and a German certificate of conduct have different access rules and consequences. Identify the applicable route before treating a screening result as grounds for a decision.

United States: third-party reports and fair decisions

When a US employer obtains a covered applicant or employee report from a business that compiles background information, the Fair Credit Reporting Act adds steps before and after the report. The FTC and EEOC say the employer must give a stand-alone written disclosure and obtain written permission before ordering it. The provider's label or use of public records does not automatically remove FCRA duties: the FTC says a company furnishing hiring reports may be a consumer reporting agency even if it does not describe itself that way. A direct government-record request and an independent-contractor engagement each need their own scope assessment; neither should be assumed to follow this exact report route.

After receiving a report, the employer should inspect the identifiers and source behind an adverse item. The FTC gives a wrong-person conviction as an accuracy concern for screening companies. Separately, EEOC guidance requires equal treatment of applicants and employees when using background information, regardless of how it was obtained. A policy that excludes people for certain criminal records can raise a job-relatedness and disparate-impact problem in the circumstances the EEOC describes. The business should assess the item against the actual role and apply its standards consistently instead of letting a report hit make the decision automatically.

If the employer is considering an adverse action based on a covered third-party report, the FTC and EEOC require a copy of the report and the FCRA Summary of Rights before the decision. The person can then review the information and explain a negative item. If the action is taken, the employer gives a separate notice identifying the reporting company and the person's dispute rights; the person may dispute inaccurate or incomplete report information with that company. These steps apply to the covered US report decision, and state or local rules may add requirements. Build the notice and review points into the workflow before setting up an automatic rejection based on a report result.

Caption: This sequence concerns covered US applicant or employee reports from a screening company. Separate notice and dispute information follows an adverse decision. Direct record searches and contractor arrangements need their own scope analysis. FTC and EEOC: Background checks for employers · FTC: Employment screening company accuracy duties · FTC: Employer background checks and applicant rights

United Kingdom: criminal checks and right-to-work routes

For roles in England and Wales, the DBS check level changes both the information shown and who is eligible to request it. A Basic check shows unspent convictions and conditional cautions. Standard adds spent convictions and other specified cautions and warnings; Enhanced can add local police information considered relevant to the role, and an Enhanced check with barred lists adds whether the person is barred from that work. The more detailed levels require an eligible role. Scotland and Northern Ireland use separate criminal-check routes, so an England and Wales DBS description should not be treated as one UK-wide application process.

For work in England or Wales, a person can request their own Basic DBS certificate and show it to a prospective hirer. The GOV.UK self-employed guidance also allows an eligible paid self-employed person or “personal employee” to apply for an Enhanced check or Enhanced check with barred lists when the role qualifies; an engaging organisation may apply on behalf of an eligible self-employed person. That exception does not give every contractor access to every level. Even an appropriately issued DBS certificate does not cover time the person lived outside the UK, so the requester must identify any relevant foreign period separately.

The Basic application is distinct from a subject access request (SAR) for personal records. In the UK, a business must not require a person to obtain and hand over a relevant criminal-history record through a SAR for employee recruitment, continued employment or a contract for services; an enforced SAR can be a criminal offence. Making the engagement conditional on the SAR result, or pressuring the person to supply it, can amount to a requirement. A person may request their own information voluntarily, but a DBS SAR returns information DBS still holds from earlier processes, not an updated DBS certificate or a check for employment use. If criminal screening is needed, identify the appropriate official check and role eligibility instead of asking the applicant or contractor for SAR results. An employer's request for an appropriate Basic certificate is a separate route from enforced subject access.

Right to work has a different trigger and purpose. The Home Office checklist updated 1 October 2026 includes employment and worker contracts and a defined individual-subcontractor arrangement. For the latter, compare the contract chain: the individual contracts to provide services to one person, that person contracts with a third party to provide or arrange those services, and the individual does not contract with the third party. If the arrangement falls within the checklist, the employer follows an available prescribed manual, Home Office online or registered digital-verification route before work starts to establish its statutory excuse. The individual must have a reasonable opportunity to use a prescribed method available to them; the employer cannot force one preferred method. Other contractual arrangements require the employer guide's extended-liability analysis.

The decisions remain separate for a self-employed or intermediary-supplied worker. Eligibility for an Enhanced DBS check says nothing by itself about whether the Home Office's defined contract chain is present. A DBS criminal certificate answers a criminal-record question; a prescribed right-to-work check addresses work permission. Order and interpret each only after establishing its own purpose and route.

Germany and EU: employment data and criminal-record limits

For screening subject to the EU GDPR, the business needs a specified purpose, an appropriate legal basis and data limited to what is necessary for that purpose. The European Data Protection Board explains that criminal-conviction information has additional Article 10 conditions: processing must be under official-authority control or authorised by domestic law. A person's agreement to be checked does not by itself authorize a business to collect every criminal record or other personal detail it can find.

Germany adds a defined employment-data route. Under the current German BDSG §26, employment-related data processing is tied to necessity for decisions about establishing or carrying out the relationship. The section includes applicants and specified employee-like persons, including people treated as such because of economic dependence. A contractor's label alone does not establish whether that section covers the engagement. Before requesting records, determine the person's actual status, the purpose of the decision and the applicable legal basis; do not treat §26 as a blanket permission to investigate unrelated history.

A Führungszeugnis under BZRG §30 is issued on application about the applicant's entries in the German register. An enhanced certificate under §30a requires a qualifying statutory or minors-related purpose and a written request confirming the conditions. For a role involving work with minors, the buyer should first establish whether that enhanced route applies, then ask for the certificate appropriate to that purpose. These certificates are defined record products, not a general permission to inspect all criminal information or a guarantee of worldwide coverage; a separate European-certificate pathway under §30b has its own nationality conditions and depends on another state's response.

Can you check your own background?

Yes. Choose the source for the fact you want to inspect: no single personal report confirms every job, qualification, criminal record or work-eligibility status. Ask which record or report a prospective hirer intends to use, then check the source's route for seeing your own information and correcting an error. A self-requested document may answer a narrower question than the business's required check.

For work in England or Wales, a person can request their own Basic DBS certificate. The application uses GOV.UK One Login to prove identity and asks for five years of address history. The person can show the certificate to a prospective hirer, but Basic displays a different set of information from a role-eligible Standard or Enhanced check. It does not replace a higher-level check where that is the route required for the role, nor does it cover time lived outside the UK. Scotland and Northern Ireland have their own application routes.

You can also make a voluntary subject access request to the DBS to see information it still holds about you. A DBS SAR result may reflect an earlier application; it is not updated to become a current DBS certificate and should not be used for employment purposes. In the UK, a hirer must not require someone to obtain and hand over a relevant criminal-history record through a SAR for recruitment, continued employment or a contract for services. Making work conditional on the SAR result, or pressuring someone to supply it, can amount to an enforced SAR and a criminal offence. If the hirer needs criminal screening, identify the official check appropriate to the role. Asking a person to obtain and show a Basic DBS certificate through its separate application route is distinct from requiring a SAR result.

In the US, you can request the information an employment-screening consumer reporting company already holds about you, using that company's access route. This is useful for checking names, dates and source records before a hiring decision. Many screening companies have no file on a person until an employer orders a report, however, so an advance request may return nothing and cannot guarantee a copy of a future employer-specific report. When an employer asks you to authorize screening, ask which company it will use; review that company's file when available and dispute any inaccurate information with it.

A direct record request is another, narrower route. For example, the Pennsylvania State Police offers a mail-only Individual Access and Review request for a person to examine their own Pennsylvania criminal-history information. Its subject-only request form states “NOT FOR EMPLOYMENT PURPOSES”. The response covers Pennsylvania law-enforcement records, not federal records, and does not substitute for the state's employment-purpose criminal-history check. Other states and sources have their own access routes.

Rights tied to a covered US employment report also provide a way to see and challenge the result of an employer's check. If an employer is considering an adverse decision based on a report from a screening company, it must provide the report and FCRA Summary of Rights before deciding. If the employer then rejects the person, the person can dispute inaccurate or incomplete information with the reporting company and request an additional free report within 60 days of the decision. Compare the report's identifiers and source dates with the underlying record before relying on it. Those rights concern the covered report route; a public website or direct government record may have a different access and correction process.

In Germany, a person can apply for a certificate of conduct concerning their own register entries. Its contents are bounded by that certificate's rules. An enhanced certificate has separate purpose and request conditions, so possession of an ordinary certificate does not establish eligibility for every regulated role or complete foreign-history coverage.

Before handing any result to a business, confirm which source, check level and date it will accept for the actual engagement. An online people-search screenshot may repeat an official record without being the originating record, and the US FCRA status of a third-party hiring report depends on the provider, report and intended use. A self-check helps you find a discrepancy early; it does not guarantee that the hirer's required process has been completed or that every online copy of an error can be removed.