# Background Check Privacy Workflows

## Workflow 1: Role-Based Necessity Assessment

```
START: Determine appropriate background checks for a role
│
├─ Step 1: Right-to-work verification
│  └─ Required for ALL roles (legal obligation). No proportionality assessment needed.
│
├─ Step 2: Reference verification
│  ├─ Standard for most roles: 2 professional references
│  └─ Personal character references: generally disproportionate
│
├─ Step 3: Qualification verification
│  ├─ Required where qualifications are a condition of the role
│  └─ Professional registration checks where applicable (medical, legal, engineering)
│
├─ Step 4: Criminal record check
│  ├─ Is there a legal obligation or regulatory requirement for this role?
│  │  ├─ YES → Proceed with legally mandated check level
│  │  └─ NO → Continue
│  ├─ Does the role involve:
│  │  ├─ Working with children or vulnerable adults? → Enhanced DBS / extended Führungszeugnis
│  │  ├─ Financial responsibility? → Basic DBS / standard Führungszeugnis
│  │  ├─ Access to high-value assets? → Basic DBS
│  │  ├─ Security clearance? → Per national security vetting framework
│  │  └─ None of the above? → Criminal record check NOT justified
│  └─ Document role-based justification
│
├─ Step 5: Credit check
│  ├─ Does the role involve financial decision-making or handling money?
│  │  ├─ YES → Credit check may be justified (Art. 6(1)(f) with balancing test)
│  │  └─ NO → Credit check NOT justified
│  └─ Document role-based justification
│
├─ Step 6: Social media screening
│  ├─ Is this a public-facing senior role? [If No → Do not screen]
│  ├─ Limited to publicly available professional profiles? [Must be Yes]
│  ├─ Candidate informed of screening? [Must be Yes]
│  ├─ Special category data NOT recorded? [Must be Yes]
│  └─ Conducted at latest possible stage? [Must be Yes]
│
└─ END: Document the proportionality assessment. Apply only justified checks.
```

## Workflow 2: Criminal Record Check Process

```
START: Criminal record check authorised for the role
│
├─ Step 1: Candidate notification
│  ├─ Inform candidate that a criminal record check will be conducted
│  ├─ Explain the level of check (basic, standard, enhanced)
│  ├─ Explain how the information will be used
│  └─ Obtain candidate acknowledgment
│
├─ Step 2: Conduct check
│  ├─ UK: Submit DBS application or check DBS Update Service
│  ├─ DE: Request candidate provide Führungszeugnis
│  ├─ FR: Request candidate provide Bulletin No. 3
│  ├─ NL: Request candidate apply for VOG with employer-specified screening profile
│  └─ Other: Follow national procedure
│
├─ Step 3: Review result
│  ├─ CLEAR (no relevant convictions):
│  │  ├─ Record: certificate reference number, date, result (clear)
│  │  ├─ Do NOT retain a copy of the certificate
│  │  └─ Proceed with employment
│  │
│  ├─ NOT CLEAR (relevant conviction disclosed):
│  │  ├─ STOP: Do NOT automatically disqualify the candidate
│  │  ├─ Assess individually considering:
│  │  │  - Nature and seriousness of the offence
│  │  │  - Relevance to the specific role
│  │  │  - Time elapsed since the offence
│  │  │  - Pattern or isolated incident
│  │  │  - Candidate's explanation and rehabilitation evidence
│  │  ├─ Give the candidate an opportunity to discuss the result
│  │  ├─ Document the assessment and decision
│  │  └─ Automatic disqualification policies are UNLAWFUL
│  │
│  └─ BARRED LIST (enhanced check reveals barring):
│     ├─ Candidate cannot be employed in the regulated activity
│     └─ This is a legal prohibition, not a discretionary decision
│
├─ Step 4: Data retention
│  ├─ Record only: certificate reference, date, result (clear/not clear)
│  ├─ Do NOT retain a copy of the certificate itself
│  ├─ Delete after 6 months if candidate not hired
│  └─ Retain reference number for duration of employment if hired
│
└─ END: Check complete. Document process and outcome.
```

## Workflow 3: Unsuccessful Candidate Data Deletion

```
START: Candidate not hired after background check
│
├─ Step 1: Identify all background check data held
│  ├─ Application form and CV
│  ├─ Reference responses
│  ├─ Criminal record check reference number and result
│  ├─ Credit check result (if applicable)
│  ├─ Social media screening notes (if applicable)
│  └─ Interview notes and assessment scores
│
├─ Step 2: Apply retention period
│  ├─ Standard retention: 6 months from hiring decision
│  ├─ Extended retention: 12 months if discrimination claim risk identified
│  └─ No retention in general candidate database for future recruitment
│
├─ Step 3: Execute deletion
│  ├─ Delete from recruitment system (ATS)
│  ├─ Delete from email (recruiter and hiring manager mailboxes)
│  ├─ Delete physical documents (shred)
│  ├─ Delete from shared drives or collaboration platforms
│  └─ Verify deletion across all systems
│
├─ Step 4: Record deletion
│  ├─ Log that data was held and deleted (not the data itself)
│  └─ Deletion certificate retained in privacy records
│
└─ END: Candidate data deleted per retention schedule.
```