Criminal Background Check for Employment: When to Require It
Discover how to decide when a criminal background check makes sense for a role, using clear criteria while respecting the rights of every candidate.
Before asking whether a company can require a criminal background check for employment, answer four questions about the role: what the information is for, what risk the role involves, how that risk relates to the job, and what will happen to the result. This test helps you avoid excessive collection, discriminatory decisions and improper use of personal data.
Criminal background check for employment: start with the role, not the document
The right question is whether this information is necessary to protect a specific activity or whether it is being collected out of habit. In Brazil, the requirement may be legitimate when there is a concrete connection between the job duties, the level of trust involved and the risk the organization needs to manage. The nature of the role is the starting point, not a generic policy applied to every opening.
Consider an infrastructure administrator with privileged access to servers, credentials and production data. The relevant risk is unauthorized access to critical environments, so the analysis should be limited to what helps assess that risk. In a finance role that handles funds, the focus may be the connection between the position's trusted responsibilities and the controls defined for it. Direct contact with vulnerable people requires attention to the nature of that contact, without treating the job category as automatic authorization.
A certificate is not proof of character, absolute integrity or professional performance. It also does not turn every record into an automatic bar to employment. The result must be understood, confirmed when necessary and compared with the role's actual responsibilities. The next sections organize the decision around four questions: purpose, connection to the role, proportionality and governance.
The four question test for deciding whether the requirement is justified
Before adding a criminal background check to the hiring process, document the answers below. They help turn a general security intention into a verifiable criterion for that specific role. They also prevent the certificate from being requested simply because it has always been part of the procedure.
- 1Define the purposeWhat specific decision will the information support? The objective should be to reduce a legitimate risk, such as unauthorized access to funds, restricted data or critical environments, rather than simply learning about the candidate's past.
- 2Connect it to the roleWhich activities involve trust, funds, personal data, infrastructure, vulnerable people or decision making that affects others? Describe the connection between the information sought and the role's actual tasks, including the level of access and how often that exposure occurs.
- 3Test proportionalityIs there a less intrusive alternative? Is the depth of the check compatible with the risk? A broad search for a role without relevant access may be excessive, while a critical role may require a more precise scope and appropriate sources.
- 4Establish governanceWho will see the result, for how long, under which criteria and for what decision? Without access controls, a record of the analysis and a retention period, the collection loses its operational justification.
If the company cannot answer one of these questions objectively, the next step is to review the requirement rather than collect the document as a precaution. This formalization also prevents each manager from interpreting a result differently. The decision record should explain why the role presents a particular risk, which information is necessary and how a discrepancy will be handled. For more on data scope, timing and interpretation, see the key considerations for pre employment background checks.
How to read the result without turning a record into a veto
A search result can bring together situations with very different meanings. A record, an investigation, a case and a conviction should not be treated as synonyms. The table organizes the distinction, but it does not replace source confirmation, identity verification or legal analysis of the specific case.
| Situation | What it indicates | Decision caution |
|---|---|---|
| Incident or entry | Information recorded in a source. | Does not prove authorship or responsibility. |
| Investigation or inquiry | An inquiry that is still underway. | Is not equivalent to a case or conviction. |
| Pending case | An allegation under judicial review. | Does not yet represent a final decision. |
| Final conviction | A decision after all appeals are exhausted. | Requires analysis of currency and relevance. |
An incident or entry is simply recorded information. It may result from a namesake, a registration error or a report that did not lead to responsibility being established. An investigation or inquiry is still in the fact finding stage. A pending case contains an allegation submitted to the courts, not a final decision. Even a final conviction, after all appeals are exhausted, must be examined in light of its currency, context and connection to the role's duties.
The company should confirm identity using appropriate data, verify the source and allow the candidate to clarify any discrepancy. The analysis should also consider the time elapsed, known circumstances, the nature of the event and the role's concrete risk. A candidate background check service only produces useful information when these elements are handled carefully.
Criminal background checks and LGPD in hiring
LGPD does not authorize unrestricted searches. Before the search, the company needs to define its purpose, legal basis, necessity, scope and transparency requirements. A legal basis does not remove the principles of purpose, adequacy, necessity, security and non discrimination. It also does not allow the company to collect more information than the decision requires.
- ✓Document the purpose of the search, the role's risk, the sources consulted and the fields that are actually necessary.
- ✓Tell the candidate about the collection, use and purpose, and provide channels for clarifying discrepancies.
- ✓Restrict access to people authorized to participate in the decision and record who viewed or shared the result.
- ✓Define a disposal deadline or event, protect against copies and prevent reuse for another opening.
A decision record can show that the search was conducted for a role with privileged access to production data, identify the specific risk, list the necessary sources and fields, name the authorized people and establish disposal at the end of the process. The same record should prohibit reuse of the result for another opening without a new justification. If the operation involves another jurisdiction, validate the legal basis, applicable rights and local rules with legal counsel. You can also review Agence's privacy policy to understand its approach to personal data.
Frequently asked questions about criminal background checks
Can an employer require a criminal background check during hiring?
It may be requested when the nature of the role justifies it, provided the company explains the purpose, respects necessity and handles the result proportionally. The requirement should not be an automatic step for every opening.
What jobs may require criminal background checks?
There is no universal list. Roles involving meaningful access to funds, data, critical environments or vulnerable people may justify the analysis when the risk is connected to actual duties and properly documented.
Can a criminal record prevent employment?
Not automatically. You need to consider the legal status, currency, relevance to the role, opportunity for clarification and proportionality of the decision.
Can requiring a criminal background check be discriminatory?
There may be a discrimination risk when the requirement is indiscriminate, based on subjective criteria or used to reject someone without a connection to the job. A documented purpose and individualized assessment reduce that risk.
How does LGPD apply to criminal background checks?
The company must define a legal basis, purpose, necessity, transparency, restricted access, retention and disposal. LGPD does not authorize the unlimited collection, storage or sharing of information.
Apply a safer background check
The decision starts with the nature of the role and ends with an individualized assessment of the result. When the test shows that a check is necessary, you should already have defined the purpose, the risk connected to the role, the search scope and the people authorized to access the information.
Agence's background check service carries out searches for candidates, partners and suppliers within the defined scope. The team receives the checking parameters, conducts the verification and handles the information with control and context to support your decision, without turning an isolated result into an automatic veto.
This keeps the analysis connected to the activity you need to protect and reduces the risk of indiscriminate collection, exposure or mistaken interpretation. Talk to a specialist when you need a check with a clear purpose and appropriate information handling.
