Companies in Austria that run background checks on job applicants often point to consent as their legal basis. Validato, a Swiss provider of background checks and human risk management, says that is usually the wrong starting point. In Austria, the stronger basis is legitimate interest under Article 6(1)(f) GDPR, not the applicant's signature on a consent form.


The reason is simple. There is a power imbalance between an employer and a job applicant. That imbalance puts the “freely given” requirement for consent under Article 7(4) GDPR in serious doubt. If an applicant feels they have no real choice but to agree, the consent is not legally solid, and this applies in Austria just as it does across the rest of the EU.

No Local Equivalent to Fall Back On

Austria's Datenschutzgesetz, the national law that implements GDPR, mainly covers the supervisory authority and the constitutional right to data protection. It does not contain a provision written specifically for employee data processing, unlike Germany's Section 26 BDSG.


That means Austrian employers cannot lean on a national employment clause. The legal basis for a background check has to come directly from the GDPR itself, mainly Article 6(1)(b) for checking facts the applicant already provided, and Article 6(1)(f) for anything that goes further, such as public register searches.

Why Consent Alone Is Risky

A company that relies only on a consent clause in its application form is building its screening process on shaky ground. If agreeing to a background check is effectively a condition of being considered for the job, a court is unlikely to view that consent as truly voluntary.


The coupling prohibition in Article 7(4) GDPR applies in Austria exactly as it does anywhere else in the EU. Employers cannot make consent a condition for employment.

Legitimate Interest Is the Stronger Foundation

Legitimate interest asks for something more concrete than a signature. The employer has to name a real, legitimate goal, for example protecting sensitive roles in banking, critical infrastructure, or IT, and show that the check is suitable, necessary, and proportionate for that goal.

So Why Does Consent Still Matter?

Even without a legal basis role, consent still has a practical job to do. A separately collected, documented consent proves the applicant agreed to the review and confirmed their own details, such as identity, CV history, and past employers.


Many institutions holding information about a candidate, such as former employers or universities, will only release it once they have a signed release. Consent does not replace the employer's GDPR basis, but it is often the key that opens the door with these third parties.


“Legitimate interest and consent are two different tools for two different jobs,” Reto Marti, Managing Partner at Validato, explains. “One justifies the check to the applicant. The other makes the check practically possible with outside institutions in Austria, and defensible if there is ever a dispute.”

What This Means for Employers in Austria

Validato recommends that Austrian companies document both layers clearly: a written balancing of interests as proof of the legal basis, plus a separate, electronically signed consent from the applicant that spells out the scope and purpose of the check.


Validato's platform gives companies a documented interest assessment, a digital consent tool with e-signature, and more than 18 individually selectable screening modules, so both layers stay separate, clean, and provable from day one.