The Employer’s Guide To PDPA Compliant Employee Background Checks In Malaysia

In Malaysia, running a background check on a job candidate is a routine HR step, but much of what a background check turns up is sensitive personal data under the PDPA and collecting it therefore carries a higher consent standard than ordinary recruitment information.

To help businesses remain compliant in their hiring processes, this guide covers: 

• which parts of a background check are sensitive personal data 
• what consent is actually required, and when to obtain it 
• how to keep the check proportionate to the role 
• what to do when a third-party screening vendor collects the data first 

For the wider set of obligations across the employment lifecycle, see our guide to employee data privacy in Malaysia. 

Otherwise, let’s begin. 

Why a background check is a PDPA issue 

Processing personal data begins the moment an application is received, and in conducting a background check, an employer moves from data the candidate volunteered to data the employer goes out and obtains. 

Additionally, this data often comes from third parties without the candidate’s knowledge. 

That shift is what makes it a compliance question and makes the employer the data controller for everything collected, including material supplied by a screening vendor, and remains responsible for how that data is obtained, how it is stored, and how long it is kept. 

Which parts are sensitive personal data? 

This matters because sensitive personal data requires explicit rather than ordinary consent. 

Even when relying on candidate self-declaration instead of third parties, it is still collecting sensitive personal data and still needs explicit consent and a genuine justification. 

Mistakes with obtaining consent 

Our guide to PDPA consent in Malaysia covers what makes consent valid at length, but in the context of background checks for hiring, three things tend to go wrong. 

Consent buried in the application form 

A single line at the bottom of a general application form authorising “all necessary checks” is weak for ordinary data and inadequate for sensitive data.  

Consent must be distinguishable from other matters, which means a separate, clearly identified consent for the background check. 

Treating consent as perpetual

Consent obtained for pre-employment screening does not extend to re-screening an existing employee two years later. If the employer intends to run periodic checks during employment, that should be addressed separately. 

Running background checks too soon 

If background checks are run at the application stage, the employer collects sensitive personal data on every applicant, including the large majority who will never be hired.  

Running checks only after a conditional offer has been made limits that collection to the one candidate the employer actually intends to engage, which is easier to justify as proportionate and reduces the volume of sensitive data the business has to secure and eventually delete.  

Proportionality of data collection 

The PDPA requires that personal data collected is not excessive in relation to the purpose. Applied to background checks, the question is not whether a check is available but whether this role genuinely warrants it. 

This can create a chicken-and-egg problem where: 

1. Running one full screening panel across every hire is administratively simple, but it means collecting sensitive personal data on people whose roles never justified it.  
2. Narrowing the panel too far creates the opposite problem, where the check no longer tells the employer what it needed to know. 

The practical answer is to settle this in the recruitment policy rather than on a case-by-case basis. Group roles into a small number of tiers, decide once which checks apply to each tier and why, and apply that consistently.  

HR then administers a clear standard instead of making a fresh proportionality judgment on every hire, and the employer has a documented rationale if the approach is ever questioned.  

This sits naturally within the organisation’s wider corporate governance framework, alongside its other internal policies. 

When a vendor collects the data first 

Most employers engage a screening agency, which means the vendor is frequently the first point of collection and holds the candidate’s data before the employer ever sees it. 

The employer remains the data controller, which carries three practical consequences: 

1. Due diligence before engagement. Confirm how the vendor obtains data, what it stores, where, and for how long. A vendor obtaining information through informal or undisclosed channels creates exposure for the employer, not just for itself. 
2. A written agreement. Covering permitted use, security measures, breach notification, and deletion at the end of the engagement. Following the 2024 amendments, data processors carry direct security obligations of their own, but this does not displace the employer’s responsibility. 
3. Consistency between the vendor’s consent form and yours. If the vendor collects consent on the employer’s behalf, that wording needs to match what the employer actually intends to do with the result. 

See our guide to the PDPA Security Principle for what vendor due diligence should cover. 

Handling an adverse finding 

Background checks are not always right, and the PDPA Data Integrity Principle requires personal data to be accurate, complete, not misleading, and up to date, and a decision made on an uncorrected error is a decision made on a false basis.  

This means giving the candidate the opportunity to see an adverse finding and respond before the employer makes a final decision. Where a candidate disputes a finding, record the dispute and how it was resolved.  

That record is what demonstrates the employer took reasonable steps rather than acting on the first result it received. 

How long to keep data 

Background check results can be among the most sensitive material an employer holds about a candidate, and the PDPA data retention principle asks businesses to make a reasoned judgment about how long each category of data is actually needed. 

There is rarely a good reason to hold on to this data indefinitely, and here are some general best practices: 

1. Unsuccessful candidates. Retain for a short defined period after the process concludes, commonly around 6 to 12 months, then delete. 
2. Successful candidates. Consider whether the full report needs to be retained at all, or whether a record that the check was completed and cleared is sufficient. 

A practical checklist 

These sit within a broader PDPA compliance framework and should be reflected in the employer’s internal recruitment and data protection policies:

1. Decide which checks each role actually needs and record why, rather than applying one panel to every hire. 
2. Use a separate, specific consent form for the background check, not a line in the application form. 
3. Obtain explicit consent where criminal record or health information is involved. 
4. Run checks at conditional offer stage to limit how many candidates’ sensitive data you hold. 
5. Carry out due diligence on the screening vendor and put a written agreement in place. 
6. Give candidates a chance to respond to adverse findings before acting on them. 
7. Set and apply a retention period, and keep a summary rather than the full report where that is sufficient. 

PDPA compliance in 90 days 

We advise Malaysian employers on the data protection side of recruitment, including drafting background check consent forms, reviewing screening vendor agreements, advising on which checks are proportionate for a given role, and setting retention periods for candidate and employee records. If you are putting a screening process in place or want an existing one reviewed, book a consultation with us.