Employee Background Checks in the Philippines: What You Can Verify, What You Cannot, and How to Stay Lawful

The Boundary Is the Data Privacy Act: Start With Your Lawful Basis

A background check is, in legal terms, the collection and processing of personal data. The Philippine Data Privacy Act requires a lawful basis for any processing and imposes three principles at the same time:

• Transparency: the individual must know what you collect, why, who receives it and how long you keep it;
• Legitimate purpose: the purpose must be lawful and declared in advance — you cannot repurpose a CV for something else;
• Proportionality: collect only the minimum that is genuinely necessary for this role's assessment. Probing a warehouse supervisor's household finances and social circle is the textbook failure.

In recruitment, the safest and most commonly used basis is the candidate's express consent. Note carefully that the Act treats a category of information as sensitive personal information, with a higher bar — and that category includes health, religious and political affiliation, marital status, age, education, and information about proceedings for any offence committed or alleged, along with government-issued numbers such as social security and tax identifiers. In other words, the two checks you thought were the most routine — verifying a degree and checking for a criminal record — sit squarely inside sensitive data and require a solid basis and written authorisation.

Two further points that get overlooked:

1. Engaging a screening vendor does not outsource responsibility. You are the personal information controller and the vendor is a processor: you need a processing agreement covering purpose limitation, security measures and deletion, and you answer for what the vendor does.
2. The individual holds rights: to be informed, to access, to correct, to object, to erasure, and to remedies for damage. A screening report is not simply your internal asset — the candidate is entitled to know what your decision rested on.

This is general guidance, not legal advice; consult a licensed Philippine lawyer on your specific situation.

The Written Authorisation: One Page That Decides Whether Any of This Is Lawful

A line buried at the bottom of the application form saying the applicant consents to any necessary investigation will not do. Valid consent must be freely given, specific, informed and evidenced. A workable authorisation states:

• Who conducts the check: your company, or a named third-party provider;
• The scope, itemised: clearance certificates, academic verification, confirmation of dates and position with prior employers, professional registration status, public-source business information. List them; do not write and any other necessary information;
• Purpose: use limited to assessing this application;
• Recipients: which internal roles will see the result (normally HR and the hiring manager), and whether it will be shared with a client or parent company;
• Retention and deletion: how long results are kept for hired and non-hired candidates, and the commitment to delete or anonymise afterwards;
• The candidate's rights: how to access, correct, object and withdraw consent, and what withdrawal means for the application;
• Signature and date, with a copy handed to the candidate.

Practical cautions: do not bundle the authorisation into the onboarding pack for retrospective signing — a check performed before authorisation is unauthorised processing. Do not use one form to authorise open-ended ongoing monitoring; periodic re-checks during employment need their own notice. And do not ask candidates to waive all claims — sweeping waivers may not hold in the data protection context and make you look as though you expected trouble.

One very common scenario: the candidate is still employed and does not want you contacting their current employer. That is entirely reasonable. Handle it by carving out the current employer in the authorisation, agreeing to verify only after an offer is extended or after the candidate resigns — rather than making a quiet call. Quiet calls that surface cost you the candidate and can also cost you a complaint.

A consent form with this many elements, in both English and Chinese? → hiring compliance documents and screening

What You Can Actually Verify

Clearances: NBI and police certificates

The standard document is the NBI Clearance issued by the National Bureau of Investigation, obtained under the local employment purpose. The key point: the individual applies for it and receives it, then submits it to you — the employer does not run the search on the candidate's behalf. Many foreign employers get this backwards. Where the system flags a record belonging to someone with a similar name, the application moves to a verification status with a later release date; that is routine and does not mean the applicant has a record. City or municipal police and barangay certificates cover a narrower base and are usually supplementary. Requiring a clearance for a role is fine, provided it is applied consistently to every candidate for that role.

Credentials and professional registration

A photocopied diploma proves little. Academic records are verified with the school registrar, and regulated professions require checking the current standing of the professional registration — active, suspended or cancelled matters far more than the certificate itself. Foreign qualifications need the authentication chain checked end to end.

Prior employment

What you can verify is factual: dates of employment, position held, and whether separation was a resignation. Route this through the former employer's HR rather than the ex-supervisor, and frame questions as closed, answerable items. Performance opinions, character assessments and the real reason someone left belong to the grey area covered in the next section.

Public-source information

Corporate registrations, professional registers, published case notices and public professional profiles are fair to review. The test remains necessary connection to the role: checking that a finance manager candidate has held comparable positions is reasonable; trawling their personal life is not.

What You Must Not Do

• Calling a former employer without authorisation for a private opinion, and relying on it alone. Two problems stacked: unauthorised processing of personal data, and basing a decision on unverifiable, single-source subjective comment. If references matter to you, keep them within the authorised scope, documented, and weighed against objective facts.
• Investigating health or pregnancy. Health assessment belongs to the pre-employment medical, and its output should answer fitness for the role and nothing more. The Philippines has specific anti-discrimination protection covering certain health conditions, including HIV status, and pregnancy — refusing to hire or renew on those grounds carries heavy exposure. And never ask a former employer how much sick leave someone took.
• Deep social media searches into private life. Public professional information is one thing; family, relationships, religion, political views and social circles are sensitive data with almost no necessary link to job performance, and they contaminate your decision record — if a discrimination complaint follows, you can no longer show what the decision actually rested on.
• Using credit standing or personal finances as a gate, unless there is a genuine and demonstrable connection to the role, such as direct handling of substantial funds, and you can articulate it.
• Requiring family information unrelated to the job: spouse's income, parents' occupations, property holdings. That is excessive collection here.
• Sharing findings. Passing a candidate's adverse information to peer groups or other companies, or circulating an informal blacklist, engages both data protection breach and defamation risk.
• Holding originals. Verify identity and credential originals, return them immediately and keep copies. Withholding passports and original documents is plainly unlawful in the Philippines, and written consent does not cure it.

A field test that works: could you sit across from the candidate and explain every item you checked and why? Anything you would rather not say out loud is probably something you should not be checking.

Why Former Employers Will Only Confirm Dates and Title

Foreign employers screening in the Philippines all hit the same wall: the previous company will confirm the employment dates and the position held, and comment on nothing else. That is not obstruction — it is a widely adopted risk policy among Philippine employers.

Two reasons sit behind it:

• Defamation exposure. The Philippines attaches both criminal and civil liability to defamatory statements, written or spoken. A former employer giving a negative reference that turns out to be inaccurate, unprovable or apparently malicious can be sued by the ex-employee. Communications made in good faith on a matter of legitimate interest may attract some protection, but companies would rather not test it.
• Data protection exposure. Disclosing performance records, disciplinary history or reasons for separation to a third party is itself processing and needs a lawful basis.

So many companies simply adopt a policy: confirm dates and position only, no comment beyond that, with responses centralised in HR. Adjust your own approach accordingly:

1. Treat reference checking as verification rather than intelligence gathering. Confirming that the dates and title on the CV are real already filters out a meaningful share of problems.
2. Have the candidate nominate referees and authorise you to contact them. That route is both lawful and cooperative. Remember the referee was chosen by the candidate, so ask about specific behaviour and situations rather than what are they like.
3. Adopt the same policy yourself. Responses about former staff should be centralised in HR and limited to factual information. A supervisor casually telling an industry chat group that someone was light-fingered is a lawsuit waiting to happen.

This is general guidance, not legal advice; consult a licensed Philippine lawyer on your specific situation.

Handling Adverse Findings: Give Them a Chance to Explain

When a check throws up a discrepancy, the instinct is to drop the candidate. Two extra steps make that decision safe:

1. Separate a discrepancy from a misrepresentation. Dates out by a month or two can be a recollection or convention issue (probation start, final-pay period). A title mismatch can be an internal versus external naming difference. A school record that cannot be located may be a name change, a namesake or a registrar system issue. Keep could not verify strictly apart from verified as false — the former usually just needs more documentation.
2. Put the finding to the candidate in writing. Share the specific item (only what is necessary — do not forward an entire third-party report), invite documents or an explanation, and give a reasonable period to respond. This reflects the individual's rights under the privacy framework and protects you: a good explanation saves a hire, and a poor one gives your decision a record.
3. Record the basis of the decision. If you decline, note the objective fact relied on rather than a general impression. If you withdraw an offer, tie it to the condition precedent stated in the offer letter — background results satisfactory to the employer, documents verified — and state in writing which condition was not met.
4. Honour your retention promise. Delete or anonymise unsuccessful candidates' material when the stated period ends; for hires, fold only the necessary conclusion into the personnel file rather than parking raw reports on a shared drive indefinitely.
5. Do not blacklist and do not circulate. Passing adverse findings to other companies triggers both data protection breach and defamation risk.

A related scenario: the person is already employed when the falsification comes to light. That may constitute a just cause for dismissal — fraud or wilful breach of trust — subject to two conditions. First, the misrepresentation must be material and substantially connected to the role; an exaggerated hobby does not qualify. Second, the procedure must be complete: a first notice setting out the specific charge and factual basis with a reasonable period to answer in writing, a genuine opportunity to be heard, then a second notice with the findings. The burden of proof sits with the employer, so the authorisation, the verification records and the report all need to be retained. Where the ground is valid but procedure was defective, the dismissal usually stands, but the employer still owes nominal damages.

The through-line is that background screening here rewards discipline over technique: a properly drafted authorisation, a scope trimmed to what the role requires, verification through proper channels, a chance to respond, and deletion when the period ends. Obtaining, verifying and authenticating clearances and credential documents has its own procedural traps. Have Yixing handle NBI clearance and the verification and authentication of onboarding documents so candidate paperwork clears in one pass under the current procedures. This article is general guidance, not legal advice; consult a licensed Philippine lawyer on your specific situation.