Background checks in Austria: legal basics for employers

Austrian employers increasingly rely on background checks to validate qualifications, mitigate hiring risk and meet sectoral due-diligence expectations. Yet Austria applies the GDPR alongside national instruments such as the Datenschutzgesetz (DSG) and the Arbeitsvertragsrechts-Anpassungsgesetz (AVRAG), which together shape what may be collected, from whom, and on what legal basis. This article outlines the legal basics in a practical, step-by-step format for HR and compliance teams operating in Austria.

Legal framework at a glance

Three layers are relevant for pre-employment screening in Austria:

• GDPR: Directly applicable. It governs the lawfulness of processing personal data, the principles under Article 5, and candidate rights.
• Datenschutzgesetz (DSG): Austria’s national data protection law, which complements the GDPR and clarifies certain procedural aspects, including the role of the Datenschutzrat and rules on data transfers.
• Labour law instruments: AVRAG, the Angestelltengesetz (AngG) and the Allgemeines Bürgerliches Gesetzbuch (ABGB) define reference obligations, probationary-period rules and the limits of what an employer may ask of a candidate or former employer.

Sector-specific rules may add further requirements, for example for credit institutions supervised under the Bankwesengesetz (BWG) or for operators of essential and important entities under Austria’s implementation of the NIS Directive (Netz- und Informationssystemsicherheitsgesetz, NISG).

Step 1: Identify a legitimate purpose

Before collecting any data, define the specific purpose of the check. Generic “we want to know more about the candidate” is not sufficient under Article 5(1)(b) GDPR.

Typical legitimate purposes in the Austrian context include:

• Verifying identity and the right to work.
• Confirming professional qualifications and registrations (e.g., for regulated professions).
• Assessing integrity for roles with fiduciary duties or access to sensitive assets.
• Meeting statutory fit-and-proper requirements in financial services.

The purpose must be documented and linked to the specific role. A blanket check applied to every applicant, regardless of position, is difficult to justify.

Step 2: Apply data minimisation and necessity

Article 5(1)(c) GDPR requires that data be adequate, relevant and limited to what is necessary. In Austria this is reinforced by the constitutional right to secrecy of personal data under § 1 DSG, which binds private controllers directly. In practice this means:

• A warehouse hire does not require a financial probity check.
• A CFO candidate justifies deeper screening than a temporary administrative role.
• Criminal record checks should be limited to roles where a clean record is a genuine occupational requirement (e.g., access to vulnerable persons, fiduciary functions). Where the role involves contact with minors, the relevant instrument is the narrower Strafregisterbescheinigung Kinder- und Jugendfürsorge under § 10 StRegG 1968, which discloses only convictions relevant to child protection and should be preferred over a full certificate.

Necessity is assessed against the role profile, not the employer’s general risk appetite. If the same hiring decision can reasonably be reached with less data, the additional data is not necessary.

Step 3: Choose lawful information sources

Austrian practice recognises several source categories, each with distinct legal characteristics.

Candidate-provided documents. The candidate may supply a CV, diplomas, certificates and a current Strafregisterbescheinigung (criminal record certificate) issued by the Landespolizeidirektion and obtainable at any municipal office (Gemeinde / Magistrat) or police station. Self-disclosure is generally the least intrusive route.

Dienstzeugnis (employment reference). Under § 39 AngG (for salaried employees) and § 1163 ABGB (general), former employers are obliged, on request, to issue a written reference stating the nature and duration of the employment. Under § 39(2) AngG it must not contain any entry that would make it harder for the employee to find new employment, and an Austrian Dienstzeugnis is an einfaches Zeugnis — it does not include a performance or conduct assessment unless the employee asks for one. Direct contact between prospective and former employers without the candidate’s knowledge is not the standard route and raises data protection concerns.

Public registers. The Firmenbuch (commercial register) supports verification of previous business mandates. Beneficial-ownership data sits in a separate register, the Register der wirtschaftlichen Eigentümer under the WiEReG, maintained by the Federal Ministry of Finance; since CJEU Joined Cases C-37/20 and C-601/20 it is no longer open to the general public, so employers cannot treat it as a routine screening source. Professional registers (e.g., for lawyers, auditors, medical professions) confirm current licensing.

Sanctions and adverse-media screening. Screening against EU and national sanctions lists, plus structured adverse-media sources, is common for senior and regulated roles. Results must be reviewed by a human before any decision is taken.

AMS context. Where a candidate has been referred through the Arbeitsmarktservice (AMS), certain placement-related information may already be available to the prospective employer through the AMS process. This does not extend to a general licence to collect further background data beyond what the AMS referral covers.

Step 4: Inform the candidate and secure consent where required

Transparency under Articles 13 and 14 GDPR is mandatory. Candidates should receive a clear privacy notice describing:

• the controller and any processor;
• the categories of data collected;
• the sources used;
• the purpose and legal basis for each processing step;
• retention periods;
• the candidate’s rights, including access, rectification and erasure.

Consent (Article 6(1)(a) GDPR) is one possible basis, but its validity in an employment context is limited because of the power imbalance. Where consent is relied upon, it must be freely given, specific, informed and revocable. For many checks, a more appropriate basis is Article 6(1)(b) (steps preparatory to a contract) or Article 6(1)(f) (legitimate interests), supported by a documented balancing test.

For special categories of data under Article 9 GDPR — such as health information or trade-union membership — the thresholds are higher and such data should generally not be collected at the pre-offer stage. Criminal conviction and offence data sits under a separate and stricter rule: Article 10 GDPR permits processing only under the control of official authority or where authorised by Union or Member State law providing appropriate safeguards. In Austria that authorisation is given by § 4(3) DSG, which is why a candidate-supplied Strafregisterbescheinigung — rather than any employer-initiated register query — is the normal route.

Step 5: Document the processing

Accountability under Article 5(2) GDPR requires that the employer can demonstrate compliance. Maintain:

• a record of processing activities (Verarbeitungsverzeichnis) covering the screening workflow;
• the purpose definition for each role category;
• the legal basis analysis, including any legitimate-interest assessment;
• consent records where consent is used;
• a data retention schedule tied to the hiring outcome.

Documentation should be proportionate. A small employer need not replicate the governance structure of a regulated bank, but the core elements must exist and be retrievable.

Step 6: Handle results and adverse decisions

When screening returns adverse information, the employer must:

• Verify the match. Names and dates of birth can produce false positives, particularly in sanctions and adverse-media screening.
• Apply human review before any decision. Automated decisions with legal or similarly significant effects are restricted under Article 22 GDPR.
• Give the candidate an opportunity to comment where the information may influence the hiring decision, consistent with Article 22(3) GDPR, which entitles the data subject to express their point of view and contest a decision.
• Retain only what is necessary. If a candidate is not hired, screening data should generally be deleted after a defined period, unless a longer retention is justified (e.g., documentation of a rejected application in case of a discrimination claim under the Gleichbehandlungsgesetz).

Practical checklist

Common pitfalls in the Austrian context

Over-broad consent forms. A single consent clause covering “all background checks” is unlikely to meet the specific and informed standard. Break consent into discrete, purpose-linked items where consent is the chosen basis.

Informal reference calls. Contacting a former employer directly, without the candidate’s knowledge, processes personal data without a clear lawful basis and risks breaching the duty of confidentiality owed by the former employer.

Treating the Strafregisterbescheinigung as a general screening tool. A clean criminal record certificate is relevant only where the role genuinely requires it. Requesting it routinely for every position weakens the necessity argument.

Ignoring cross-border elements. Where the candidate has worked in other DACH jurisdictions or outside the EEA, transfer rules under Chapter V GDPR apply. Austria’s DSG does not displace these obligations.

Relying on automated adverse-media hits. Media reports may be inaccurate, outdated or refer to a different individual. A human reviewer must assess relevance and reliability before any consequence follows.

How Indicium supports Austrian employers

Indicium Technologies AG provides registry-based verification, UBO and sanctions screening, and structured adverse-media review for DACH employers, including those hiring in Austria. Each screening output is reviewed by a human analyst before delivery, supporting employers in applying necessity, accuracy and fairness within their own hiring processes. The employer remains responsible for the legal basis, the purpose definition and the final hiring decision.

This article provides general information and does not constitute legal advice in individual cases.