Protecting Candidate Information During Background Screening

Collect only what the workflow needs

Start with the service ordered and collect the minimum information required to complete it. Avoid adding sensitive fields to ordinary forms simply because the system can store them.

Use separate, authorized workflows for background screening, Form I-9, payroll, benefits, and other purposes rather than reusing data without review.

Use secure transmission

• Use the provider’s secure candidate portal for sensitive identifiers.
• Do not request Social Security numbers or report copies through ordinary email.
• Avoid uncontrolled shared folders and local downloads.
• Confirm how integrations protect and limit transferred data.

Limit user access

Grant report access only to people who need it for the authorized employment purpose. Separate the ability to order, view, administer users, and change packages where the system supports it.

Remove access promptly when duties change or employment ends. Review users periodically and investigate unusual access.

Define retention and secure disposal

The organization should have a documented retention schedule based on applicable legal, contractual, and business requirements. Keeping reports indefinitely can create unnecessary exposure.

The FTC Disposal Rule addresses proper disposal of consumer-report information. Secure disposal can include approved deletion, destruction, or vendor processes appropriate to the medium.

Ask vendors practical questions

• Which data is collected and why?
• Where can users access or export reports?
• How are candidate disputes and corrections handled?
• What account controls and logs are available?
• How are subprocessors and integrations managed?
• How does the provider communicate an incident?

Prepare for mistakes and incidents

Create a simple escalation path for misdirected information, unauthorized access, lost devices, incorrect recipients, or suspicious account activity. Preserve necessary records, limit further exposure, and involve qualified security, privacy, and legal personnel.

For provider selection, read How to Evaluate a Background Check Provider.