In the US, two federal frameworks govern employment background checks. The Fair Credit Reporting Act (FCRA) sets the process when you use a screening company: written notice, written permission and specific notices before and after any adverse decision. Federal anti-discrimination law, enforced by the EEOC, governs how you use what you find. States and cities add limits on top, especially on criminal records.
It surprises many employers that checking someone's background isn't illegal in itself. The EEOC says that, apart from certain restrictions on medical and genetic information, it's not illegal to ask about an applicant's background. What creates legal risk is the process you follow and how you use the results.
The FCRA process, step by step
The Federal Trade Commission enforces the FCRA. Its joint guidance with the EEOC says these steps apply when you get a report from a company in the business of compiling background information:
Before you run the check
- Tell the applicant or employee you might use the information for employment decisions. The notice must be in writing and in a stand-alone format; it can't be part of the job application.
- If you're ordering an 'investigative report' based on interviews about character or reputation, also tell them they can ask for a description of the nature and scope of the investigation.
- Get their written permission. If you want to run checks throughout their employment, say so clearly and conspicuously.
- Certify to the screening company that you've given notice, got permission and won't misuse the information in violation of equal opportunity laws.
Before you take adverse action
Before rejecting an applicant or firing an employee because of the report, give them a notice that includes a copy of the report you relied on, and a copy of 'A Summary of Your Rights Under the Fair Credit Reporting Act'. The FTC explains why: giving notice in advance lets the person review the report and explain any negative information.
After you take adverse action
Then tell them, orally, in writing or electronically, that they were rejected because of information in the report; give the name, address and phone number of the company that sold it; say that company didn't make the decision and can't explain it; and tell them they can dispute the report's accuracy and get an additional free report from the company within 60 days.
What the EEOC says about using results
The EEOC's rules apply however you got the information, including a search you ran yourself. You must comply with federal laws that protect people from discrimination based on race, color, national origin, sex, religion, disability, genetic information (including family medical history) and age (40 or older).
- Apply the same standards to everyone. Checking only applicants of one race for criminal records is evidence of discrimination.
- Don't ask medical questions before a conditional job offer.
- Except in rare circumstances, don't try to get genetic information, including family medical history, and don't use it if you have it.
- Take special care with background problems that may be more common among people of a certain race, color or national origin, such as criminal records, because a blanket rule can be discriminatory in effect.
Here's the sourced insight that catches small employers: the FTC and EEOC guidance says personnel and hiring records, including every application whether or not the person was hired, must be kept for one year after they were made or after a personnel action was taken, whichever is later. After that, you must dispose of background reports securely. Keep first, then destroy safely.
State and city limits
Many states and cities go further than federal law, especially on criminal history. California's Fair Chance Act is a good example of how far that goes:
| California rule | What it requires |
|---|---|
| Who's covered | Public and private employers with five or more employees |
| Timing | No conviction questions or consideration until after a conditional offer |
| What can't be considered | Arrests not followed by conviction, completed diversion programs, and sealed, dismissed or expunged convictions |
| Withdrawing an offer | An individualized assessment, written notice, a copy of the report and at least five business days to respond |
Because these rules vary, the FTC and EEOC also advise reviewing the laws of your state and municipality before you start. Our roundup of background check services compares screening providers that build the FCRA steps into their process, and our E-Verify guide covers the separate federal work eligibility check.
UK: DBS checks and filtering
In the UK, criminal record checks run through the Disclosure and Barring Service (DBS). The DBS filtering guide explains that some old or minor cautions and convictions are 'protected': they don't need to be disclosed, and if they are, employers can't take them into account. Convictions resulting in a custodial sentence are always disclosed on Standard and Enhanced certificates, as are specified serious offences. The current filtering rules apply to certificates issued on or after 28 October 2023.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
For the separate legal duty to check someone can work in the UK at all, see our right to work check guide.
A compliant background check checklist
- Decide which checks each role needs, and write down why.
- Use a stand-alone written disclosure and get written consent.
- Run checks after a conditional offer where state or local law requires it.
- Send the pre-adverse action notice with the report and the FCRA summary of rights.
- Give the person time to respond, and consider what they send.
- Send the adverse action notice with the required details.
- Keep the records for at least a year, then dispose of reports securely.
The verdict
Background checks are legal and often sensible, but the law cares about process and fairness. Follow the FCRA steps every time you use a screening company, apply the same standard to every candidate, wait for the conditional offer where state law requires it, and keep records for the required year before destroying them securely. The pre-adverse action notice is the step most often skipped, and it's the one that protects you most.
If screening is part of your process, this guide to video interview software weighs up tools for interviewing candidates by video.
Frequently asked questions
What law governs employment background checks?
In the US, the Fair Credit Reporting Act governs checks run through a screening company, and federal anti-discrimination laws enforced by the EEOC govern how results are used. States and cities add their own limits.
Do employers need written permission for a background check?
Yes, when using a screening company under the FCRA. You must give a written, stand-alone notice and get the person's written permission before the check.
What is a pre-adverse action notice?
A notice given before rejecting someone because of a background report. It must include a copy of the report and 'A Summary of Your Rights Under the Fair Credit Reporting Act', so the person can review and explain it.
How long must employers keep background check records?
The FTC and EEOC guidance says hiring records must be kept for one year after they were made or after a personnel action, whichever is later, and background reports must then be disposed of securely.
