You can't sign a blanket yes to a customer's background-check clause, because Article 10 of the EU GDPR lets a private company handle criminal-offence data only where EU or national law allows it. We'd send back a role-scoped offer: the check each country permits, with the person showing you the certificate and you keeping no copy, plus a written attestation from any vendor that supplies contractors.
Can you run criminal-record checks on every engineer?
Not as a blanket rule. Article 10 of the GDPR says data on criminal convictions and offences may be processed only under the control of an official authority, or where EU or Member State law authorises it with safeguards. On that wording, a customer clause isn't that authorisation. It can ask for a check, but we'd read it as unable to make the check lawful.
Separately, only an official authority may keep a full register of convictions. That governs who holds a register, not what you may see. And because the authorisation sits in national law, a check that's fine in one country isn't automatically fine in the next. The wider map is in our guide to the legal requirements for hiring developers in Europe.
What each country allows
| Country | Can you ask | How it works in practice |
|---|---|---|
| UK | DBS allows a basic check for any role | Person applies; you see the result |
| Poland | Where a statute requires a clean record | Otherwise the person's own declaration |
| Hungary | Yes; balancing test unless a statute requires it | Person shows the certificate; no copy |
| Spain | Unsettled; courts differ in approach | One court overturned a fine |
UK: a basic check is open to any role
The government's DBS guidance for employers says a basic check is available for any position or purpose. It costs GBP 20 and shows unspent convictions and cautions. DBS covers England and Wales, and Disclosure Scotland covers Scotland. The applicant applies directly, or you use a Responsible Organisation, which needs the applicant's consent.
Standard and enhanced checks are different. You can only request them if the role is entitled to an exempted question, and knowingly asking for a higher level than the law allows is unlawful. The guidance doesn't name software engineering among those roles, so plan on basic. Tell the customer you'll arrange a basic check for UK staff, and that anything higher needs them to show which exemption covers the role.
Poland: only where a statute requires it
UODO, Poland's data protection authority, published recruitment slides for employers in 2018. They say the criminal register may be queried where a statute requires a clean record for the post, under Art. 6(1)(10) of the National Criminal Register Act. The examples are teachers, Border Guard officers and detectives. Data the employer may ask for reaches it through the person's own declaration, under Labour Code Art. 22^1 para 3.
We'd read that as leaving a software role without a basis for a register extract. Offer the customer a signed declaration, and ask them to name the legal basis if they want an extract.
Hungary: allowed on a balancing test
In a 2019 consultation reply (NAIH/2019/1073), the Hungarian authority NAIH said that where a statute requires the certificate, Art. 6(1)(c) covers it. Without one, the employer relies on legitimate interest after a documented balancing test, together with Art. 9(2)(b), which covers employment-law obligations. The employer may ask the person to present the certificate (the erkölcsi bizonyítvány) but may not copy it. NAIH's reply isn't binding, but it's the regulator's view.
Tell the customer you'll ask for the certificate to be shown and keep the balancing-test note on file. That answers the clause without building a store of certificates.
Spain: a court has overturned a fine, and the position is unsettled
The law firm ECIJA reported that Spain's National High Court overturned the AEPD's EUR 2m fine against Amazon for requiring a no-criminal-record certificate from courier candidates. The court held the requirement proportionate for couriers with access to customers' data, and treated a clean certificate as favourable information, not Article 10 data.
In plain terms, a clean certificate may not count as criminal-offence data in Spain. That's one court's view, it isn't a general authorisation, and a 2022 Supreme Court labour ruling took a different approach. The decision may also be reviewed. Spain is the one country here where we wouldn't commit to a check for engineers. Tell the customer the position is unsettled and that you'll supply a written attestation instead.
Contractors you don't employ
The pattern across the countries above is that the person gets and shows their own certificate: in the UK the applicant applies, in Hungary they present it, and in Poland they declare. Recording only pass or fail is our practice, and NAIH's no-copy rule fits it. Three kinds of contractor sit on top of that.
- Your own freelancer on a B2B contract: our practice is the same. The Polish slides address employers and candidates, and the Hungarian reply employers and employees, so how either applies to a B2B contractor is open. Ask counsel before relying on it for a specific contractor.
- An employer-of-record's engineer: they have an employer, so ask the EOR for the same attestation a vendor gives.
- A vendor's engineers: the vendor is their employer. It runs the check under its own national law and attests to you in writing. In our judgment that's cleaner than you collecting anything, and it keeps criminal-record data out of your systems.
HighCircl's first vetting stage is background and experience verification; ask any vendor, us included, to say in writing which checks that covers. The vetting guide sets out the other screening stages.
Romania, Slovakia, Slovenia, Serbia and anywhere else
Start with the national data protection authority's website and search for "criminal record" with "employer". Then read the criminal-register authority's page on who may request an extract and for what purpose. Finish with a local lawyer who has handled employment screening.
Serbia is outside the EU, so its own data protection law applies there, not the GDPR. Check what it says about criminal-record data before you offer the customer anything for Serbian engineers.
What to send back to the customer
Don't sign the clause as written. Reply with five things:
- Scope: only roles with production or customer-data access.
- The check per country, as set out above.
- Person-supplied certificates, as described above.
- Vendor attestations, as described above.
- A question: if the customer cites a standard such as BS 7858, which clause do they mean, and does an attestation or a basic-check equivalent satisfy it?
Here's how it plays out for a hypothetical 30-person SaaS company in the UK. A bank customer says all personnel with production access, contractors included, need a criminal-record check. The team with access is UK employees, two B2B contractors in Poland, one in Hungary and an engineer from a Spanish vendor.
- UK employees: a basic DBS check each, GBP 20, which they apply for themselves.
- Poland: no basis we can point to for a software role, so a signed declaration.
- Hungary: a short balancing-test note, then the contractor shows the certificate and you log pass or fail.
- Spanish vendor engineer: the vendor attests in writing under its own check, and the reply notes that Spanish law is unsettled.
The covering note gives the check per country, the roles in scope, and the question about the standard. It's a longer reply than "yes", and it's one the company can keep.
What this means for your next enterprise deal
The decision is what you commit to in the questionnaire or contract before you sign. A "yes, all personnel" promises something the law in some countries won't let you deliver, and an auditor can ask for the evidence later. Commit instead to the roles with access, the check per country and who supplies it.
Before the deal reaches procurement, work out which countries your people sit in and which of them are vendor staff. Then write the reply once and reuse it. The questionnaire rows around it (access, offboarding, devices) are covered in answering the contractor rows on a security questionnaire, and the rest of the contracting and GDPR guides sit in the compliance hub.
FAQ
Can an employer require a criminal record check under GDPR?
Only where EU or national law authorises it with safeguards, or under an official authority. On Article 10's wording, a customer's contract clause isn't that authorisation, so what's allowed depends on the country and the role.
Is a basic DBS check enough for a customer's background-check clause?
DBS allows a basic check for any role, for GBP 20, and it shows unspent convictions and cautions. Whether it satisfies your customer depends on what their clause says, so ask which standard they mean.
Can I ask a freelancer in Poland for a certificate of no criminal record?
UODO's 2018 slides tie register queries to posts where a statute requires a clean record, and otherwise to the person's declaration. They address employers and candidates, so how that applies to a freelancer is open. We'd offer a signed declaration and ask the customer for the legal basis if they want more.
What is BS 7858 and does it apply to software contractors?
Ask the customer which clause of the standard they want applied, and what it requires for people you don't employ, before you agree to it. Don't accept it as a blanket term.
Can I keep a copy of the certificate?
In Hungary, NAIH said in 2019 that the employer may ask for the certificate to be presented but may not copy it. Elsewhere, we'd follow the same practice and record only pass or fail.
Sources
- EUR-Lex: Regulation (EU) 2016/679 (GDPR), Article 10
- GOV.UK: DBS check requests, guidance for employers
- NAIH: consultation reply NAIH/2019/1073 on criminal-record certificates
- UODO: employer recruitment guide (2018)
- ECIJA: National Court overturns AEPD fine on Amazon for requiring no-criminal-record certificates