Consent that stands up
Every candidate must give informed, specific, and revocable consent before any check begins. That means telling them exactly which checks you'll run, what data you'll process, who will see the results, and how long you'll retain them. A checkbox at the bottom of an application form isn't enough.
Minimisation
Only collect what the check requires. If you're verifying employment, you don't need banking history. If you're verifying NYSC, you don't need medical records. Every field on your intake form should map to a lawful, specific purpose.
Retention with an end date
Results should have a defined retention period tied to the hiring decision. If you didn't hire the candidate, most check outputs should be deleted within a short, documented window. If you did hire them, retention should mirror your broader HR data policy.
Subject rights
Candidates can request access, correction, and deletion. Your process must be able to respond within statutory timelines. Build the workflow before you receive the request, not after.
What we do differently
- ✓Consent workflows built into every check request
- ✓Purpose-tagged data collection so nothing extra is captured
- ✓Defined retention schedules with automated cleanup
- ✓Documented subject-rights response process
Talk to us
If you want a background check partner already set up for NDPA compliance, start a conversation. We'll respond within one business day.