The screening matrix says the role gets a certificate of conduct and a credit check. Then someone asks the question that stops the meeting: may we actually run this, for this role, in Germany? ISO 27001 A.6.1 answers with its proportionality clause — checks are bounded by applicable law, regulations and ethics — which means the honest ISO answer to every legality question is “ask German law first”. This guide does that per check category: identity, qualifications, employment history, references, certificate of conduct, credit, sanctions and adverse media, social media — each with its legal basis, its proportionality test, and what to document. The mechanics of the legal bases live in the GDPR/BDSG legal-basis walkthrough; this guide is the decision layer on top of it.
ISO sets the floor, German law the ceiling
A.6.1 requires screening before employment and proportionality to risk — that is the floor. German law sets the ceiling: § 26 BDSG permits processing of employees’ personal data only where necessary for the employment relationship (a provision whose standalone status has been doubted since the CJEU’s C-34/21 judgment, so the necessity of each check is what carries it — documented, per role), § 7 AGG forbids discrimination, and the works-constitution framework makes parts of the screening process co-determined: §§ 94, 95 BetrVG for questionnaires and selection guidelines, § 87(1) No. 6 BetrVG for technical devices intended to monitor conduct or performance. The priority rule for every check is therefore mechanical: if German law does not permit the check for this role, it does not matter that the SoA lists it or that the auditor expects it — the control is satisfied by a documented, lawful programme, not by an unlawful check. That rule, applied consistently, is also what makes the screening matrix auditable: every cell is either lawful for the role or marked out of scope with a reason.
The per-check decision table
| Check category | Legal basis | Typical trigger roles | Proportionality test | Document what |
|---|---|---|---|---|
| Identity | § 26 BDSG necessity | Every in-scope role | Verify, don’t collect more | ID check note |
| Qualifications | § 26 BDSG necessity | Every in-scope role | Job-relevant certs and degrees only | Verification result |
| Employment history | § 26 BDSG necessity | All roles, depth by tier | Plausibility over surveillance | CV check note |
| References | Consent (§ 26(2) BDSG) | Enhanced and privileged tiers | Role-relevant, recent referees | Reference notes |
| Certificate of conduct | § 30 BZRG (simple); § 30a BZRG (extended) | Trust-critical roles | Necessity under § 26; extended only where a statute entitles | Certificate + necessity note |
| Credit | Consent under § 26(2) BDSG | Finance-critical roles only | Direct money-handling exposure | Consent + decision note |
| Sanctions, PEP, adverse media | Art. 6(1) GDPR (c)/(f); sanctions law where applicable | Regulated and risk roles | Necessity per role; human review for hits | Screen result + review note |
| Social media | § 26 BDSG, narrow | Rarely proportionate | Professional networks only where work-relevant | Search scope + result note |
The table is the shortcut; the sections below explain each row’s judgment call — because the judgment call is what the DPO, the works council and, if it ever comes to it, a court will ask about.
Identity, qualifications, employment history: the safe baseline
These three are defensible for nearly every in-scope role, which is why they form the standard tier in the matrix. Identity verification is the least contentious check that exists: the employer may verify who it is employing, and the documentation standard is “verify, don’t collect more” — a note that identity was checked, not a copy of every supporting document. Qualifications follow the job: degrees and certificates the role requires may be verified; the hobby licence from five years ago may not. Employment history is a plausibility check, not surveillance: gaps and overlaps get flagged, the candidate gets to explain, and the note records what was asked and answered. Necessity is documented once per role category in the matrix, not re-argued per hire.
Certificate of conduct: when it holds up
The Führungszeugnis is the classic A.6.1 check for trust-critical roles — and the classic misjudgment when used outside them. The legal frame: anyone aged 14 or over may apply for a simple certificate under § 30 BZRG, and whether the employer may require it follows from the general necessity test for the role — typically trust-critical positions in banking, security or care, with the requirement announced in the job posting. The extended certificate under § 30a BZRG is different: it exists only where a statute refers to it or for work with children and young people, and it requires the employer’s written confirmation of that entitlement. Simply wanting “more security” is not a legal basis, and requesting certificates for every hire fails the necessity test per check. The distinction between a police clearance certificate and a full background check is set out in police clearance certificate vs background check.
Credit checks: narrow but defensible
Credit checks on employees are legal in Germany only in a narrow band. The proportionality test runs on opportunity for abuse: a role with direct access to money and payment flows can justify a bounded credit check where an analyst role with no such access does not — even if the analyst’s job title sounds more “financial”. Where defensible, consent under § 26(2) BDSG is required and must be genuinely informed; the check itself should be bounded (score bands rather than raw bureau data, no unnecessary detail). The banking-sector version of this line is walked in pre-employment screening in banks under § 26 BDSG.
Sanctions, PEP and adverse media
List checks run on data from public registers and sources, but publicly available data remains fully GDPR-covered — the intrusion is not zero, it is in what you do with a hit. The proportionality anchor sits in the role: sanctions-related duties (regulated sectors, compliance functions) bring list checks into scope naturally; a standard office role does not. What the category demands unconditionally is human review on hits: false positives are common (name collisions especially), and an automated “match” that nobody reviewed is both a GDPR problem and a hiring-process problem. PEP screening in the strict sense is an anti-money-laundering tool aimed at customers and business partners; on employees it appears as part of a broader risk check, not as a statutory duty of its own. The mechanics of PEP screening and the EU/OFAC/UN sanctions lists compared are covered in depth in their own posts; here the decision rule matters: necessity for the role, reviewed by a human, documented with the clearing.
Social-media lookup and the Fragerecht limits
The social-media lookup is where A.6.1 programmes most often quietly overstep. The defensible version is narrow: professional networks (LinkedIn, Xing) where the candidate has published their own professional profile are work-relevant information; private profiles are as a rule not. The limit is not etiquette but the necessity of the data collection: information from the private sphere has no place in the employment decision unless it has direct, documented relevance to the role. Two duties travel with even the lawful lookup: the duty to inform the candidate what was collected and considered (transparency under Art. 13/14 GDPR), and the documentation of what was searched, where, and what was found. The practical rule for the matrix: name the network, name the scope, record the result — and when in doubt, don’t. The boundaries are walked in social-media screening and its legal limits, the underlying question culture in what employers may ask.
Works council: which provision bites when
Where a works council exists, background screening meets co-determination at several points — each with its own provision. Standardised questionnaires and self-disclosures require the works council’s consent under § 94 BetrVG; if check results co-determine hiring, transfer or dismissal, you are writing selection guidelines under § 95 BetrVG; and software-supported screening of employees can trigger § 87(1) No. 6 BetrVG, the co-determination right for technical devices intended to monitor conduct or performance — a provision whose scope for screening constellations is disputed, with Federal Labour Court case law traditionally reading “monitoring capability” broadly, so assume co-determination in case of doubt. Getting this wrong does not just strain the relationship: an implemented procedure that ignored these rights creates a liability trail and can force rework. The codetermination process, timing and the works council’s options are set out in works-council codetermination and background screening.
The screening matrix as the legality record
Every legality decision above ends in the same place: a cell in the screening matrix that says which check runs for which role, on what basis, and why it is proportionate. That is what makes the matrix the audit artifact the ISO auditor samples and the record the DPO defends — one document that answers “may we run this?” before the question is asked. If the matrix is the what, this guide is the why; the two are designed to be read together with the A.6 personnel-security explainer for the control’s exact wording.
Frequently asked questions
Can we ask about checks in the interview?
The interview follows the Fragerecht: questions need a legitimate, job-relevant basis, and the candidate may answer inadmissible questions untruthfully without consequences. Practically: announce the screening programme in the posting, reference the matrix in the interview, and don’t improvise questions the matrix wouldn’t justify.
What if the candidate refuses consent?
Consent must be genuinely voluntary — building adverse consequences into a refusal undermines the consent itself, so the refusal cannot simply be scored against the candidate. The workable path: consent-based checks (references, credit) do not run without consent, the role’s risk assessment documents which checks were completed and which were not, and the decision is made on the documented record. Necessity-based checks (identity, quals) don’t depend on consent; a candidate who refuses to verify identity has answered a different question.
The check comes back incomplete or with a finding — now what?
ISO/IEC 27002:2022 names the path: restrict access, delay onboarding, or end the engagement in the extreme — the record needs the finding, the review (human, not automated), the decision and its basis. An undocumented adverse outcome is a worse audit finding than the adverse outcome itself.
This article provides general information and does not constitute legal advice.