Employers may conduct employee background checks in China when each check is necessary for the role, directly connected to the proposed employment relationship, transparent to the candidate and carried out through lawful sources. Identity, relevant education, professional qualifications and employment history are usually the most defensible checks. Criminal records, credit or financial information, health data, biometrics and broad social-media reviews require much greater caution.
A candidate’s consent is not a blank authorization. China’s Personal Information Protection Law requires a lawful basis, a clear purpose, minimum necessary collection, transparency and security. An excessive or irrelevant check does not become proportionate because the candidate signed a form.
This guide covers screening of candidates and employees, not corporate due diligence or general medical examinations.
China’s Legal Framework for Employment Background Checks
China does not have one statute listing a standard screening package for every employer. The lawful scope is built from employment law, personal-information rules, equal-employment protections, criminal-record restrictions and cross-border data requirements.
| Legal source | Key rule | Employer implication |
|---|---|---|
| Labor Contract Law, Article 8 | An employer may ask for basic information directly related to the employment contract. | Document why every question or check is relevant to the role. |
| Personal Information Protection Law | Processing must be lawful, necessary, purpose-limited, transparent and secure. | Use a written scope, candidate notice, access controls, vendor terms and deletion rules. |
| Employment Promotion Law | Recruitment must provide equal opportunities and must not be discriminatory. | Exclude irrelevant personal characteristics and protected-status information. |
| Public Security criminal-record query rules | Unit queries require legal or administrative-regulation support concerning occupational prohibitions. | Employers do not have unrestricted police-record access. |
| Cross-border data rules | Overseas transfers can trigger notice, separate consent, impact assessment and transfer-mechanism requirements. | Review overseas headquarters and foreign-vendor access before sharing reports. |
Article 8 is a limit as well as an information right: the employer’s inquiry must remain directly related to the labor contract. It does not authorize a broad personal investigation, and the PIPL still governs collection, verification, sharing, retention and deletion.
What Information May an Employer Check?
Identity
An employer may verify that the candidate is the person named in the application and that information needed for the proposed contract is accurate. Use only the document fields required for verification. Do not collect unrelated household information or treat an identity document as permission to search unrelated databases.
Education and Professional Qualifications
Degree, diploma, license and professional-certificate checks are generally defensible when the qualification is required or materially relevant to the position. Verify the stated institution, qualification and completion status through a lawful channel. A check is harder to justify when the credential has no meaningful connection to the work.
Employment History and References
Employers may verify relevant employers, dates, job titles and responsibilities, subject to an appropriate notice and processing basis. Reference questions should remain job-related. Requests for confidential performance files, compensation details or personal opinions require caution. Screening should align with the records later collected through the China employee onboarding process.
Criminal Records
Criminal-record screening is restricted. A company should not promise a universal “police database check” or assume a vendor can lawfully obtain records for any vacancy. Review occupational restrictions for the specific job first. Foreign-national work-permit documentation is separate; see the guide to a criminal background certificate for a China work permit.
Credit and Financial Information
Financial screening is high-risk and should not be routine. It may be considered for a narrowly defined role involving substantial financial authority or regulated responsibilities, but a specific justification is still required. Debt, credit and bank-account information can be highly intrusive, and financial-account information is sensitive personal information under the PIPL. Role relevance alone does not create lawful access to an individual’s personal credit report.
Health Information and Biometrics
Medical and health information and biometric identifiers are sensitive personal information. They should not be included in a general screening package. Collection requires a specific purpose, sufficient necessity, strict safeguards and applicable separate consent. Any statutory occupational-health examination should be handled as a separate legally reviewed workflow.
Public Online and Social-Media Information
Public availability does not make all online information fair game. Lawfully public information may be processed only within a reasonable scope, with additional requirements where processing significantly affects the individual. Avoid private accounts, family or lifestyle information, protected-characteristic inferences and decisions based on lawful conduct unrelated to the job.
Generally Permissible, Restricted and High-Risk Checks
| Category | Examples | Employer approach |
|---|---|---|
| Usually lower-risk when role-related and necessary | Identity, relevant education, required qualifications, stated employment dates and job titles | Give notice, use lawful sources, collect necessary fields and document the job connection. |
| Restricted | Evaluative references, criminal records, detailed compensation history and consequential online information | Confirm a specific need, lawful access route and decision rule; let the candidate respond. |
| High-risk | Credit or financial history, health data, biometrics, private social-media content and broad family-status searches | Do not conduct routinely. Obtain local legal review and reject the check if necessity cannot be demonstrated. |
Candidate Notice, Consent and Sensitive-Information Requirements
Before screening, give the candidate a clear notice identifying the processor, contact details, processing purpose and method, information categories, retention approach, recipients and the procedure for exercising rights. Distinguish employer processing from processing by a vendor or overseas recipient.
The employer must identify an appropriate processing basis. Depending on the facts, processing may be necessary for steps toward an employment contract or may rely on another PIPL basis. Where consent is used, it must be informed, voluntary and explicit. Separate consent may apply to sensitive information, provision to another independent processor and cross-border provision.
Sensitive information may be processed only for a specific purpose with sufficient necessity and strict protection. The candidate must be told why it is necessary and how processing may affect their rights. Consent does not override necessity or minimum-scope requirements.
Candidates have statutory rights involving knowledge, decision-making, restriction or refusal, access, correction and deletion. Assign a practical contact channel to receive and handle requests.
A pre-employment authorization should not be treated as indefinite permission for continuous monitoring. Any later check involving an employee needs a fresh, documented purpose, updated transparency steps and a scope proportionate to the current role or event.
Step-by-Step Compliant Screening Workflow
- Define the position risk. Identify the duties, assets, systems and regulated obligations that make a check necessary.
- Create a role-specific matrix. Do not apply the same package to every employee. Record the purpose of each item.
- Check equal-employment risk. Remove criteria that may be discriminatory and are not objectively job-related.
- Select lawful sources. Use candidate documents, institutions, former employers, competent authorities or approved vendors.
- Issue the candidate notice. Explain scope, recipients, retention, rights and any overseas access.
- Obtain required authorization or separate consent. Avoid blanket language covering every possible search.
- Verify only approved items. Do not expand the search because additional data is available.
- Review accuracy and relevance. Separate verified facts from comments, database matches and opinions.
- Let the candidate respond. Resolve identity, date, translation and other reasonable discrepancies.
- Close the file. Record the decision, restrict access and delete information when it is no longer required.
Screening records should fit the company’s wider China HR documentation requirements, with clear ownership among recruitment, local HR, legal and the hiring manager.
Criminal-Record Checks: Access Is Legally Limited
Under the public security rules, an individual may query their own criminal record or authorize another person. A unit may query a current or prospective worker only where the request complies with laws or administrative regulations addressing occupational prohibitions, and the application must identify the supporting legal provision.
This is narrower than a general preference for “trustworthy candidates.” Where no occupational-prohibition rule applies, the employer should not claim direct police access. Asking for a candidate-provided certificate still requires a role-related purpose and proportionate handling. Results must remain confidential and cannot be reused for another purpose.
How to Handle Discrepancies Fairly
A discrepancy should not automatically cause rejection. Names may be transliterated differently, former employers may have changed legal names, titles may be translated loosely and dates may differ because sources record different events.
Verify the source and identity, explain the material issue and allow supporting documents or clarification. Base the decision on the relevance and seriousness of the verified fact, not a vendor label such as “red flag.” An invalid required license may be decisive; a minor difference in an old internal title may not be.
Screening-Vendor Due Diligence and Contract Controls
A vendor does not transfer compliance responsibility away from the employer. Verify its legal entity, data sources, access permissions, security controls, storage locations, subcontractors and deletion process. Employers using recruiters should also review how China recruitment agencies and job sites collect and transfer candidate information.
A processing agreement should define the purpose, term, method, information categories, safeguards, rights support, incident duties, return or deletion and subcontracting restrictions. The employer should supervise the vendor rather than rely on a general compliance promise.
Sharing Reports With Overseas Headquarters
Sending a report to an overseas parent, storing it in a foreign HR system or enabling foreign-vendor access can trigger cross-border requirements. Map what leaves China, why the recipient needs it, whether sensitive information is included and who can access it.
The PIPL requires an applicable transfer condition, safeguards for the overseas recipient, specific notice and separate consent. The 2024 rules adjust when a security assessment, standard contract or certification may be required or exempted, but do not remove notice, separate-consent, impact-assessment and security duties. The applicable route depends on the organization, data category, volume and purpose.
Retention, Access Control and Deletion
There is no universal fixed retention period for every employment background check. Personal information should generally be kept for the shortest time necessary to achieve the stated purpose unless another law or administrative regulation requires otherwise.
Set a schedule for successful and unsuccessful candidates, distinguish the hiring decision from raw source material and avoid keeping full reports indefinitely. Limit access to people who need the result. Do not store sensitive attachments in ordinary email chains, shared drives or unrestricted applicant notes.
Deletion duties may apply when the purpose is achieved, the period expires, consent is withdrawn where it is the basis, or processing is unlawful. Include vendor copies, exported files and overseas-system records in the deletion workflow.
Employer Checklist for Background Screening in China
- Connect every check to a documented duty or risk of the position.
- Collect only information relevant to the employment decision.
- Use a clear notice and identify the processing basis.
- Apply separate-consent and heightened-protection controls where required.
- Do not assume access to criminal, credit, medical or private online records.
- Use consistent, non-discriminatory criteria for comparable candidates.
- Allow candidates to correct or explain material discrepancies.
- Control vendor data sources, security, subcontracting and deletion.
- Review cross-border requirements before reports are accessible overseas.
- Restrict access and delete data when the purpose no longer requires it.
Legal-Review Triggers
- The role involves an occupational prohibition or regulated qualification.
- The check includes criminal, financial, health, biometric or other sensitive information.
- The employer proposes private social-media or broad litigation searches.
- A vendor cannot explain its data source or legal access route.
- Candidate reports will be accessible outside mainland China.
- A negative result may drive offer withdrawal or action against an employee.
FAQs About Employee Background Checks in China
Are employee background checks legal in China?
Yes, when a check has a lawful basis, is directly related to employment, necessary, proportionate, transparent and based on lawful sources. Employers should not use one unrestricted package for every role.
Is candidate consent always required?
Not every activity relies solely on consent because the PIPL provides several bases. Where consent is used, it must be informed, voluntary and explicit. Separate consent may be required for sensitive information, another recipient or overseas transfer. Consent does not legalize an excessive check.
Can an employer obtain a candidate’s police criminal record?
Employers do not have unrestricted access. A unit query must meet public security rules and be supported by a specific law or administrative regulation concerning occupational prohibitions.
Can employers review a candidate’s social-media accounts?
Public information may be processed only within a reasonable, job-related scope. Employers should not access private content, collect irrelevant details or decide based on protected characteristics or lawful conduct unrelated to the role.
Can a China background-check report be sent overseas?
Potentially, but overseas sharing can trigger PIPL and cross-border obligations. Review necessity, notice, separate consent, impact assessment, recipient safeguards and the applicable transfer route before access is granted.
Support With Compliant Recruitment in China
Screening should connect with job design, sourcing, offer approval and onboarding rather than operate as a standalone database search. HROne’s China recruitment services support foreign employers with local sourcing, initial candidate screening, shortlist coordination and hiring workflows. Contact HROne to discuss a China hiring requirement.
This article provides general information and is not legal advice. Lawful scope depends on the role, industry, data types, sources, processing arrangement and transfer structure. Role-specific screening should receive local legal review before implementation.
