China Employment Background Checks and Privacy: The Line Between Due Diligence and Over-Collection

Introduction

A background check is the point where hiring diligence meets China's privacy law, and most disputes turn on one question: did the employer collect more than the role justified? The Personal Information Protection Law (PIPL), effective 1 November 2021, governs the collection, and it treats several categories a foreign employer reflexively checks — criminal records, credit, health — as sensitive personal information that cannot be swept in casually.

The baseline: what an employer may ask

Article 8 of the Labor Contract Law lets an employer learn the basic information directly relevant to the labour contract, and the employee must truthfully explain it. That is the ceiling, not the floor: relevance to the specific job is the test, and the Employment Promotion Law layers on a non-discrimination duty that makes irrelevant questions themselves a risk. A question that is not "directly related to the job" is not protected simply because the employer asks it.

The PIPL and sensitive personal information

Under Article 28 of the PIPL, sensitive personal information includes biometric data, religious belief, specific identity, medical health, financial accounts and location tracking, as well as the personal information of minors under 14. Processing such information requires a specific purpose, sufficient necessity, strict protection measures, and — critically — the individual's separate consent (Article 29). A blanket clause in the employment application is generally not enough for a criminal-record or credit check; the consent must be specific to that collection.

Criminal records: the special rule

Criminal-record information is doubly protected. On one side, Article 100 of the Criminal Law requires a person who has received a criminal punishment to truthfully report it when joining the military or taking employment — with an exception for offences committed under 18 that drew a sentence of five years or less. On the other side, criminal-record data is sensitive information, and the employer's right to check it exists only where the position genuinely requires it — security roles, regulated posts, positions involving minors. For a general office role, demanding a criminal-record certificate is over-collection, and the employer, not the candidate, bears the legal risk.

Third-party agencies and the practical risk

Many foreign employers outsource the check to a background-screening agency. That does not move the liability — the employer remains the personal-information processor, and it must ensure the agency processes under a compliant contract and a lawful basis. The three recurring failures are: no separate consent for sensitive categories; a scope far wider than the role justifies; and no retention or deletion plan, so the collected data lingers past the hiring decision. Any one of them can support an administrative complaint or a privacy claim.

A compliant check in practice

• Define the role's genuine requirements first, and limit the check to what Article 8 justifies;
• Notify the candidate in a stand-alone document, and obtain separate consent for sensitive categories;
• Treat criminal-record and credit checks as the exception, not the default;
• Contract with any agency as a processor, with scope and deletion obligations;
• Keep a retention schedule and delete what the hiring decision does not require.