Pre-employment screening of candidates: reducing risk for your business

Hiring is not only about assessing professional skills. A new employee gains access to internal information, clients, finances, documents and business processes. This is why pre-employment screening can be an important element of protecting a business.

At the same time, this is an area where it is easy to cross a line. The volume of information that can technically be collected about a person from open sources is far greater than the volume an employer is entitled to collect and act upon. Screening a candidate is therefore always a double task: identify the risks that matter, without breaching labour law or personal data legislation.

Why screen candidates at all

A strong CV and a successful interview do not always give the full picture. Screening helps confirm the information a candidate has provided and identify potential risks before the employment relationship is formalised.

This matters most for roles involving finances, physical assets, confidential information, access to client databases, or managerial authority.

The logic is the same as in counterparty due diligence before signing a contract: checking at the entry point costs far less than dealing with the consequences once a person already has access to the company’s assets and information.

What can be checked

Depending on the role and level of responsibility, screening may include:

• confirmation of previous employers and professional experience;
• verification of education and claimed qualifications;
• analysis of open state registers;
• enforcement proceedings or court disputes, where relevant to the role;
• links to companies, sole proprietorships or other legal entities;
• potential conflicts of interest;
• reputational risk checks in open sources;
• accuracy of key information stated in the CV.

The main open sources used are the Unified State Register of Legal Entities and Sole Proprietors (company participation, sole proprietor status, directorships), the Unified State Register of Court Decisions, the Unified Register of Debtors and the State Register of Sanctions.

The purpose is not to collect as much information about a person as possible, but to assess the risks that actually matter for the specific position.

Where the line runs

Screening must be lawful and proportionate to the purpose of hiring. Not all information that can technically be found may or should be used when making a personnel decision.

Ukrainian law sets several fairly specific limits here.

The list of documents an employer may require is closed

Article 24 of the Labour Code of Ukraine sets out the documents a person must submit when concluding an employment contract: a passport or other identity document, an employment record book or employment history data, and — in cases defined by law — documents on education or professional training, health status, military registration and others.

Article 25 of the Labour Code expressly prohibits requiring from applicants information about their party or national affiliation, origin, registration of place of residence or stay, and documents whose submission is not provided for by law.

That last part is the one most often ignored in practice. Requiring a certificate of no criminal record, consent to a “database check” or documents on personal assets is lawful only where the law establishes such a requirement for that position or activity. There is no general right of an employer to demand such documents for internal screening purposes.

Criminal conviction data is a separate category

Part 1 of Article 7 of the Law of Ukraine “On Personal Data Protection” prohibits processing personal data on racial or ethnic origin, political, religious or ideological beliefs, membership of political parties and trade unions, criminal convictions, as well as data concerning health, sexual life, biometric or genetic data.

Exceptions are set by the law itself. Obtaining information about a candidate through closed law-enforcement records is therefore not a grey area but a direct violation — for the party disclosing the data and for the party requesting it alike.

The lawful source of information on criminal record is an extract the person obtains about themselves, and only where the law permits an employer to require it.

The scope of data must match the purpose

Part 3 of Article 6 of the Law “On Personal Data Protection” requires that the composition and content of personal data be relevant, adequate and not excessive in relation to the defined purpose of processing.

In practice: the screening of an accountant with signing authority and the screening of a candidate with no access to funds cannot be identical. A uniform “just in case” check applied to every vacancy does not meet the non-excessiveness test.

Consent and notification

The grounds for processing personal data are set out in Article 11 of the same law; for candidate screening, the practical ground is the candidate’s consent. Article 12 requires informing the person about the data controller, the composition and purpose of collection and their rights — at the moment of collection where data is obtained from the person, or within thirty working days where it is obtained from other sources.

Consent should therefore be separate, clear and specific: stating which categories of data are checked, for what purpose, and how long the results are retained.

Prohibition of discrimination

Article 2-1 of the Labour Code prohibits any discrimination in employment, including on grounds of age, sex, health status, family and property status, place of residence, trade union membership and other characteristics unrelated to the nature of the work.

Article 11 of the Law of Ukraine “On Employment of the Population” additionally prohibits stating such requirements in vacancy announcements and offering work only to women or only to men, except for specific work.

The consequence for the screening procedure is straightforward: information that cannot lawfully support a personnel decision should not be collected in the first place.

Liability

Breaches of personal data legislation carry administrative liability under Article 188-39 of the Code of Ukraine on Administrative Offences, including for failure to observe data protection procedures resulting in unlawful access to data or violation of the data subject’s rights. Supervision in this area is exercised by the Ukrainian Parliament Commissioner for Human Rights.

There is also a reputational risk: a candidate who learns of a disproportionate check may file a complaint, and such a story sits poorly with future hiring.

Three levels of screening

In practice it is convenient to scale screening to the level of access the employee will receive.

Basic — for most line positions: identity confirmation, verification of education and previous experience, a basic register check for links to companies.

Extended — for roles with access to funds, inventory, client databases or personal data: additionally court disputes, enforcement proceedings, company participation, indications of conflicts of interest with the company’s existing counterparties.

In-depth — for management roles and positions with signing authority: full analysis of corporate links, reputational checks in open sources, sanctions screening, and review of previous employers from a conflict-of-interest perspective.

When an in-depth check is particularly justified

An extended background check is worth considering where the candidate applies for a management role, or will work with finances, contracts, procurement, personal data, trade secrets, or will hold significant authority within the company.

For a business, such a check is not distrust of the candidate but one of the instruments of risk management.

What to do with the results

Screening results are themselves personal data and are subject to the same rules. A few practical guidelines:

• retain results for a limited period, and only for candidates who were hired or where retention is necessary to protect the company’s interests;
• record the personnel decision against professional criteria, not against facts that cannot lawfully be used as grounds;
• do not disclose screening materials to third parties without a separate legal basis;
• set the procedure out in an internal policy — this disciplines the process and serves as evidence of lawfulness in the event of a dispute.

What may change

The rules in this area are under review. Draft Law No. 8153 “On Personal Data Protection”, intended to align Ukrainian legislation with EU requirements, was adopted at first reading on 25 November 2024 and is being prepared for second reading. It provides, among other things, for substantially higher penalties and expanded obligations for data controllers.

As of September 2026, Law No. 2297-VI remains in force in the wording cited above. Screening procedures should be revisited once the new law is adopted.

How ARGUS can help

ARGUS Consulting group carries out screening of candidates and employees using open sources and available registers.

The client receives structured information on the risk factors identified and recommendations on what to consider before making a personnel decision. We also help set up the procedure itself — the consent form, the internal policy and retention periods — so that it complies with personal data legislation.

Planning to hire for a position of responsibility? Contact ARGUS Consulting group — we will help you check the candidate before the risk becomes a problem for your business.

Legal basis and registers

• Labour Code of Ukraine — Art. 2-1 (equality of labour rights, prohibition of discrimination), Art. 24 (documents on conclusion of an employment contract), Art. 25 (prohibition on requiring certain information and documents)
• Law of Ukraine “On Personal Data Protection” No. 2297-VI — Art. 6 (general requirements, non-excessiveness), Art. 7 (special categories of data), Art. 11 (grounds for processing), Art. 12 (notification of the data subject)
• Law of Ukraine “On Employment of the Population” No. 5067-VI — Art. 11 (protection against discrimination in employment, requirements for vacancy announcements)
• Code of Ukraine on Administrative Offences — Art. 188-39 (violation of personal data protection legislation)
• Draft Law “On Personal Data Protection” No. 8153 — adopted at first reading on 25.11.2024, being prepared for second reading
• Unified State Register of Legal Entities and Sole Proprietors · Unified State Register of Court Decisions · Unified Register of Debtors · State Register of Sanctions

Legal position stated as of 1 September 2026.