Many HR teams assume that checking everything is the safest option. When it comes to background checks in Germany, that assumption often backfires legally.


Validato, a provider of global background checks and human risk management, warns against running every available screening module on every candidate. It is not just excessive. It can be legally challenged.

The Rule: Proportionality

German law is clear on this point. Section 26 of the Federal Data Protection Act (BDSG) requires that any check on an employee or applicant be suitable, necessary, and proportionate to the actual risk of the role.


In short: just because information can be collected does not mean it should be.

What Companies in Germany Actually Use

Validato offers more than 18 screening modules, including:


• Identity verification

• Criminal record checks

• Education and employment history

• Financial integrity checks

• Sanctions and PEP list screening


In practice, German companies typically use only four to five of these per role. A bank cashier faces different checks than a developer with no access to funds or sensitive systems.

Let the Job Decide the Checks

The module selection should follow the job description, not the other way around.


Access to company funds makes a financial integrity check easy to justify. No such access makes it hard to defend.


Validato recommends documenting this reasoning for each position type. That way, if a labor court or data protection authority ever asks, the company can show exactly why each check was necessary.

Most Red Flags Are Not Fraud

Validato reports that 15 to 20 percent of flagged issues come from misunderstandings or errors in official records, not intentional deception. That is one more reason to give candidates a chance to explain before any check leads to a rejection.

A Practical Path Forward

For regulated industries like financial services, energy, and IT, Validato recommends defining and documenting the module selection once per position type, rather than requesting everything for every new hire.


Validato's pay-as-you-go model lets companies select only the modules a role actually needs, with no subscription. Candidate data is permanently deleted in accordance with customer requirements, but no later than after 120 days, supporting Germany’s data minimization requirements.


Screen smarter, not bigger. Contact Validato today to get started.